Edit tour

Windows Analysis Report
Payment.exe

Overview

General Information

Sample name:	Payment.exe
Analysis ID:	1432021
MD5:	872fc876d25908a93236dcf98e09e3de
SHA1:	06da1381d9aaa978ace25c409a59c3d6560975c0
SHA256:	a6cd55461ca16e33b153c509417d91eec660cc6d447764c9a312a0ad871ca9c5
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment.exe (PID: 3924 cmdline: "C:\Users\user\Desktop\Payment.exe" MD5: 872FC876D25908A93236DCF98E09E3DE)

RegSvcs.exe (PID: 5648 cmdline: "C:\Users\user\Desktop\Payment.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.italiacanda-it.com", "Username": "snpss@italiacanda-it.com", "Password": "dsrociz1               "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33879:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment.exe PID: 3924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment.exe PID: 3924	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 5648	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5648	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payment.exe.2150000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment.exe.2150000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment.exe.2150000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3175b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31877:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31953:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a79:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33879:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment.exe.2150000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment.exe.2150000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment.exe.2150000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33879:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 5648, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49727

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	04/26/24-10:06:22.580286
SID:	2030171
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	04/26/24-10:06:22.580370
SID:	2855542
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	04/26/24-10:06:22.580370
SID:	2855245
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	04/26/24-10:06:22.580370
SID:	2840032
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	04/26/24-10:06:22.580370
SID:	2851779
Source Port:	49727
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.italiacanda-it.com", "Username": "snpss@italiacanda-it.com", "Password": "dsrociz1 "}

Multi AV Scanner detection for submitted file

Source: Payment.exe	ReversingLabs: Detection: 43%
Source: Payment.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for sample

Source: Payment.exe

Joe Sandbox ML: detected

Source: Payment.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49725 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Payment.exe, 00000000.00000003.2152965174.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Payment.exe, 00000000.00000003.2153287366.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payment.exe, 00000000.00000003.2152965174.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Payment.exe, 00000000.00000003.2153287366.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B34696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B34696
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B3C9C7
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3C93C FindFirstFileW,FindClose,	0_2_00B3C93C
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B3F200
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B3F35D
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B3F65E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B33A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B33A2B
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B33D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B33D4E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B3BF27

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49727 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49727 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49727 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49727 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49727 -> 208.91.198.143:587

Source: global traffic

TCP traffic: 192.168.2.5:49727 -> 208.91.198.143:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49727 -> 208.91.198.143:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B425E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B425E2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.italiacanda-it.com

Source: RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.italiacanda-it.com
Source: RegSvcs.exe, 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Payment.exe, 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payment.exe, 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49725 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payment.exe.2150000.1.raw.unpack, K6raBsUk6.cs

.Net Code: _1kx

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B4425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B4425A

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B44458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B44458

Source: C:\Users\user\Desktop\Payment.exe

0_2_00B4425A

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B30219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B30219

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B5CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B5CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Payment.exe.2150000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment.exe.2150000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Payment.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00AD3B4C
Source: Payment.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Payment.exe, 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_df352232-5
Source: Payment.exe, 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f4793a40-7
Source: Payment.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cf9b2c80-1
Source: Payment.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2ba005b0-8

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment.exe

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B340B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00B340B1

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B28858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B28858

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B3545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B3545F

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00ADE800	0_2_00ADE800
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFDBB5	0_2_00AFDBB5
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00ADE060	0_2_00ADE060
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B5804A	0_2_00B5804A
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE4140	0_2_00AE4140
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF2405	0_2_00AF2405
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B06522	0_2_00B06522
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B0267E	0_2_00B0267E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B50665	0_2_00B50665
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF283A	0_2_00AF283A
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE6843	0_2_00AE6843
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B089DF	0_2_00B089DF
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B06A94	0_2_00B06A94
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B50AE2	0_2_00B50AE2
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE8A0E	0_2_00AE8A0E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B38B13	0_2_00B38B13
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B2EB07	0_2_00B2EB07
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFCD61	0_2_00AFCD61
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B07006	0_2_00B07006
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE3190	0_2_00AE3190
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE710E	0_2_00AE710E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AD1287	0_2_00AD1287
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF33C7	0_2_00AF33C7
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFF419	0_2_00AFF419
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE5680	0_2_00AE5680
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF16C4	0_2_00AF16C4
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AE58C0	0_2_00AE58C0
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF78D3	0_2_00AF78D3
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF1BB8	0_2_00AF1BB8
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B09D05	0_2_00B09D05
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00ADFE40	0_2_00ADFE40
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFBFE6	0_2_00AFBFE6
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF1FD0	0_2_00AF1FD0
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_02143660	0_2_02143660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017EE1C1	2_2_017EE1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017EA950	2_2_017EA950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017E4A98	2_2_017E4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017E3E80	2_2_017E3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017E41C8	2_2_017E41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C0A198	2_2_06C0A198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C0B9F0	2_2_06C0B9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C165E8	2_2_06C165E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C155A8	2_2_06C155A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C1B220	2_2_06C1B220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C13060	2_2_06C13060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C1C170	2_2_06C1C170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C17D78	2_2_06C17D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C17698	2_2_06C17698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C1E388	2_2_06C1E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C1034B	2_2_06C1034B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C10007	2_2_06C10007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C15CDB	2_2_06C15CDB

Source: C:\Users\user\Desktop\Payment.exe	Code function: String function: 00AD7F41 appears 35 times
Source: C:\Users\user\Desktop\Payment.exe	Code function: String function: 00AF0D27 appears 70 times
Source: C:\Users\user\Desktop\Payment.exe	Code function: String function: 00AF8B40 appears 42 times

Source: Payment.exe, 00000000.00000003.2149304388.0000000003EC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payment.exe
Source: Payment.exe, 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed1d0086e-f958-473c-b56d-1a9de9dc0359.exe4 vs Payment.exe
Source: Payment.exe, 00000000.00000003.2155034288.00000000040AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payment.exe

Source: Payment.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Payment.exe.2150000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment.exe.2150000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Payment.exe.2150000.1.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment.exe.2150000.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@4/2

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B3A2D5 GetLastError,FormatMessageW,

0_2_00B3A2D5

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B28713 AdjustTokenPrivileges,CloseHandle,		0_2_00B28713
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B28CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B28CC3

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B3B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B3B59E

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B4F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B4F121

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B486D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B486D0

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AD4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Payment.exe

File created: C:\Users\user\AppData\Local\Temp\aut29F3.tmp

Jump to behavior

Source: Payment.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment.exe	ReversingLabs: Detection: 43%
Source: Payment.exe	Virustotal: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\Payment.exe "C:\Users\user\Desktop\Payment.exe"
Source: C:\Users\user\Desktop\Payment.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payment.exe"
Source: C:\Users\user\Desktop\Payment.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payment.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payment.exe

Static file information: File size 1062912 > 1048576

Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Payment.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Payment.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Payment.exe, 00000000.00000003.2152965174.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Payment.exe, 00000000.00000003.2153287366.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payment.exe, 00000000.00000003.2152965174.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Payment.exe, 00000000.00000003.2153287366.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Source: Payment.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Payment.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Payment.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Payment.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Payment.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B4C304 LoadLibraryA,GetProcAddress,

0_2_00B4C304

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AF8B85 push ecx; ret	0_2_00AF8B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017E0C3D push edi; ret	2_2_017E0CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_017E0C95 push edi; retf	2_2_017E0C3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06C0FAF3 push es; ret	2_2_06C0FAF4

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AD4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00AD4A35
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B555FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B555FD

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AF33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00AF33C7

Source: C:\Users\user\Desktop\Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6625			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1251			Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B34696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B34696
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B3C9C7
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3C93C FindFirstFileW,FindClose,	0_2_00B3C93C
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B3F200
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B3F35D
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B3F65E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B33A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B33A2B
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B33D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B33D4E
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B3BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B3BF27

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AD4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99542	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98231	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96799	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96451	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96120	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3390903447.0000000006590000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Payment.exe	API call chain: ExitProcess graph end node			graph_0-99207
Source: C:\Users\user\Desktop\Payment.exe	API call chain: ExitProcess graph end node			graph_0-99276

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B441FD BlockInput,

0_2_00B441FD

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AD3B4C

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B05CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B05CCC

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B4C304 LoadLibraryA,GetProcAddress,

0_2_00B4C304

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_021434F0 mov eax, dword ptr fs:[00000030h]	0_2_021434F0
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_02143550 mov eax, dword ptr fs:[00000030h]	0_2_02143550
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_02141ED0 mov eax, dword ptr fs:[00000030h]	0_2_02141ED0

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B281F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B281F7

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00AFA395
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00AFA364 SetUnhandledExceptionFilter,		0_2_00AFA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Payment.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Payment.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1029008

Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B28C93 LogonUserW,

0_2_00B28C93

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AD3B4C

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00AD4A35

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B34EF5 mouse_event,

0_2_00B34EF5

Source: C:\Users\user\Desktop\Payment.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payment.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe

0_2_00B281F7

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B34C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B34C03

Source: Payment.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Payment.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AF886B cpuid

0_2_00AF886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B050D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B050D7

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B12230 GetUserNameW,

0_2_00B12230

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00B0418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B0418A

Source: C:\Users\user\Desktop\Payment.exe

Code function: 0_2_00AD4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AD4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Payment.exe.2150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment.exe.2150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5648, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Payment.exe	Binary or memory string: WIN_81
Source: Payment.exe	Binary or memory string: WIN_XP
Source: Payment.exe	Binary or memory string: WIN_XPe
Source: Payment.exe	Binary or memory string: WIN_VISTA
Source: Payment.exe	Binary or memory string: WIN_7
Source: Payment.exe	Binary or memory string: WIN_8
Source: Payment.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.Payment.exe.2150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment.exe.2150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5648, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Payment.exe.2150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment.exe.2150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5648, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B46596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B46596
Source: C:\Users\user\Desktop\Payment.exe	Code function: 0_2_00B46A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B46A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment.exe	43%	ReversingLabs	Win32.Spyware.Negasteal
Payment.exe	37%	Virustotal		Browse
Payment.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
smtp.italiacanda-it.com	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://smtp.italiacanda-it.com	0%	Avira URL Cloud	safe
http://smtp.italiacanda-it.com	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high
api.ipify.org	104.26.12.205	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
smtp.italiacanda-it.com	unknown	unknown	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Payment.exe, 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Payment.exe, 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://smtp.italiacanda-it.com	RegSvcs.exe, 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://us2.smtp.mailhostbox.com	RegSvcs.exe, 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3389464276.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432021
Start date and time:	2024-04-26 10:05:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 267
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:06:17	API Interceptor	39x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	HDPESDR11OD5606METERS.exe	Get hash	malicious	AgentTesla	Browse
	HDPESDR1145-6METERS.exe	Get hash	malicious	AgentTesla	Browse
	TT copy of the first payment.exe	Get hash	malicious	AgentTesla	Browse
	rTDN001-180424_PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	1iO53raUh69l6nV.exe	Get hash	malicious	AgentTesla	Browse
	HmGUCvTQIacWu7Q.exe	Get hash	malicious	AgentTesla	Browse
	Payment.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse
	Gcerti Quote.exe	Get hash	malicious	AgentTesla	Browse
	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	SecuriteInfo.com.Win32.PWSX-gen.29608.5434.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.224
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	PR2403016.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	OKJ2402PRT000025.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	HDPESDR11OD5606METERS.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	HDPESDR1145-6METERS.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	TT copy of the first payment.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	rTDN001-180424_PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
	1iO53raUh69l6nV.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
fp2e7a.wpc.phicdn.net	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://colmec.it/category/news	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://farolcontabilidade.com/secure/securehtm/securehtm/?uid=vxyz@conde.jp.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://householdshop.club/	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://gmial.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	192.229.211.108
	SWIFT.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.229.211.108
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://callumsyed.net/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.211.108
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	192.229.211.108
api.ipify.org	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://asana.wf	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.18376.4403.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Proforma Request.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
bg.microsoft.map.fastly.net	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://cnmxukx5efilc7lvlel.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.xf2rnb.cn/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://sabbynarula-73p7yyw32q-ue.a.run.app/Win0belzer0sys07/index.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://heiqi.xyz/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	199.232.214.172
	https://c-m-c-group.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	SecuriteInfo.com.Win32.PWSX-gen.29608.5434.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.224
	Dhl Express Shipping Docs .pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	PR2403016.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	OKJ2402PRT000025.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PO82100088.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	162.215.248.214
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	72625413524.vbs	Get hash	malicious	XWorm	Browse	116.206.104.215
CLOUDFLARENETUS	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	172.67.144.70
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	http://householdshop.club/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://xred.site50.net/syn/SSLLibrary.dll	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://tracking.theimpco.com/tracking/click?d=OrpweRVshItmHO3qVpYwg0JJ3qp4iuwmt5687ge2H9uFpmeuDd2X4dPYczAnrgigX6DFu-Km6YtBvUpjEWnC0qAPektAg_1gGuxaDYDl5nf8rOcHvuOtOBIWknNeVHzB3g2	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	http://cleverchoice.com.au	Get hash	malicious	Unknown	Browse	104.18.28.104
	Commande No 00007 de M.N.S. S.A. 24000127 MNS Distribution.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.191.112
	http://callumsyed.net/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	104.26.12.205
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	a.cmd	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	104.26.12.205
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	Isass.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\Payment.exe
File Type:	data
Category:	dropped
Size (bytes):	151716
Entropy (8bit):	7.912451959234274
Encrypted:	false
SSDEEP:	3072:klowTzZsW2bcfOoYwabKblNLHmQRQGcdsWG7BMdxufUIzEo7o0a8Vt86l27K0nM5:k1f+7EUb4PLG67cdshOxaUIUgVtBPJH
MD5:	0D495EFC25E9F16FB6F9E1389DD5D06F
SHA1:	6DCE28B1908FDBD964AFD469D2F24F464F243B44
SHA-256:	581E995B49006C75D1BD8DA316D306F0FA7E1F772987E482030792207C93B17C
SHA-512:	703CAC22700C4D8952B0D6DF0DEF8443903523B0D7A1B605AE35766A120D2B8DE7EC71009A545CDF93AB5A9114F127B23153601AA0B9C0F4EEC3EAA2A495E797
Malicious:	false
Reputation:	low
Preview:	EA06.....D.SzE..W......2.V(5Z.6.H.M.`....X...S)...h@.....X.T..j.....{.Pl./'..c....{?.IlUIT.W8..R...O\.Le.X..)h..%.K]j.@..,f#..Sat.....L@.5.P..e2.B.M...l_1.......b( ....C......x.5.0..........ZD.eK..j.:...B.N).....cwe...!UP..Ch.._7^.A...~@..DJqX...v..`B..;l..3.......T..f.G..,\|1...kt..'R..b.R..1@.......@....>.r.J......H...;z..H.B3S.....J.B.,>:.....F....V.M..h.z}.W..h@........?.....w.l..@.Ss..Ws[.y.>...Yx.@...{...Bk.=../...(<8\./N....z.?e..Q.5.$....d=.{...&..s.e.g....E..<._?.y_.s......r}\|._?......!5..R...N..:..Y{..f.I<f1 ..2?M#sN..t.\......dS.t6.I.....U.'..f-...{..c'`...............I.7.h..=..(...p.c7 ....XO...(.a9.,9..Uc...H...h.Eo.....k..lo.\.2.#.Q.r;n?m..y/.......0.Hdz.......4/GU..(.h.n.Q....Y.n.h.A.;..Z.E..4.&.r.^x....Sk.c/{..Ni..k s......Zm....px.}......[......R8S}.......I..}W.K%.YD.i'.Pe..l./..N.2.P.v).Z].cC...4.E..R.L.\9T..G.o$U....<.....D.q\..+T.d.37..m.Z..9J..e.I.b.W.W..D....ht.....xQg...z.Y.Ni.....a.T..}Jm..Z`..m6.B..1....F.P.....A.............

C:\Users\user\AppData\Local\Temp\aut2A9F.tmp

Download File

Process:	C:\Users\user\Desktop\Payment.exe
File Type:	data
Category:	dropped
Size (bytes):	9902
Entropy (8bit):	7.589420241366998
Encrypted:	false
SSDEEP:	192:C+cK50L02Jtyl2ftvwmziMVC6baopzBvq5xQtxfChACTtobpcqzLrOOnsqQE+R:h750LRJtyl2ftLCghBmgx6hrTeVcyXOP
MD5:	33839E826D04985CBBD35C20D8D304E3
SHA1:	00484D5F99DEA9BFA4C1AAF8AD985D5AE5CA31C6
SHA-256:	52666D2AFDDE1A10BFEFA7C644A8A488CC7384510D4F55246994837AED155AF2
SHA-512:	3139ABDE0798D843B5223EF13A85E4189F5CAF75D94A176C5BABB61B4FF63D38046544A9C5F51DC49EDF9816A10487BFC50D4137609AA67CB1DFC54FE1A3DD98
Malicious:	false
Reputation:	low
Preview:	EA06..p0.M'.)..e4.N'.).......T9..l.0L.s.5..3..s.4.8.......k8.Yls....c..&S...k6...S....1.L&.i..i5.M,S....K.@...7...p. ....P.o...m.X.V........9....3...f....s2.Xf@.]..g3@..h.m.M.......8.l..6.....a........i4........g3Y...c ._..k4...d....H, ......Ac.H..g...(.F..=d....>....C`....@02..N@...u......Y..ab.M.]>.$....M.x>;$....N.j.;%....X.j.;%......j.;,....P'.b.5... .^..f./Z..@F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn......d...

C:\Users\user\AppData\Local\Temp\outbluffed

Download File

Process:	C:\Users\user\Desktop\Payment.exe
File Type:	ASCII text, with very long lines (28720), with no line terminators
Category:	dropped
Size (bytes):	28720
Entropy (8bit):	3.5971472643342133
Encrypted:	false
SSDEEP:	768:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNboE+I026c024vfF3if6L:wiTZ+2QoioGRk6ZklputwjpjBkCiw2Rk
MD5:	9447223DB34835958033A65ED42D0A32
SHA1:	0C6F202979F1B81D5D719AD5FF114626F6BC6A64
SHA-256:	2ADEDBEF4DCF1AECC6FFD84E6769E2A222C5D6621D02DBDDAE095573C5437C3E
SHA-512:	EFE9ADD9289B8F9E845942370D9492B03779EFCA6BBD75F94E8EF8171683E9B8C1264021777693D0A38D6391F5B6533F5C31139510294B5D52A6C9A565A708B4
Malicious:	false
Reputation:	low
Preview:	048B4C24088B008B093BC8760483C8FFC31BC0F7D8C38B0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c00000066

C:\Users\user\AppData\Local\Temp\pensum

Download File

Process:	C:\Users\user\Desktop\Payment.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.75581145510075
Encrypted:	false
SSDEEP:	6144:e01xYm6nIN/nn5Ui9DVMzWaZBHgM+HUE4WaJEYRxP5dJAT+iu:pJhn5p9DAWPb4vEY93AT+iu
MD5:	96F1853F2F7C00485D710A9047CFC858
SHA1:	4C2DADC3F3A2C77F6D76B61F562BC95B4B008EC8
SHA-256:	8798A866E079C118437258474CA297E545FF6817C6460B3508413C48B991B95D
SHA-512:	7BFF0D329B7025FC230EAF6D4DF9CDB5FF105FC62CE21AD68AF4B1D1D421B710BB5D819CC43AE3CF9003F94C93E9560FF5FAD0376A5097B482AC75523BA277E0
Malicious:	false
Reputation:	low
Preview:	...7HAEWGJPJ..R2.XAUZMGH.7KAEWCJPJCOR28XAUZMGHB7KAEWCJPJCOR2.XAUTR.FB.B.d.B..k.';A.(3:=?&%bT/+87j2/c='\.1/u...h/X/$kZN@tJCOR28X..ZM.IA7N.N1CJPJCOR2.XCTQLLHB.HAE_CJPJCO\|.;XAuZMG.A7KA.WCjPJCMR2<XAUZMGHF7KAEWCJPJGOR08XAUZMEH..KAUWCZPJCOB28HAUZMGHR7KAEWCJPJCO..;X.UZMG.A7.DEWCJPJCOR28XAUZMGHB.HAIWCJPJCOR28XAUZMGHB7KAEWCJPJCOR28XAUZMGHB7KAEWCJPJCOR.8XIUZMGHB7KAEWKjPJ.OR28XAUZMGHlC.91WCJd.@OR.8XA.YMGJB7KAEWCJPJCOR2.XA5t?4:!7KA.RCJP.@OR48XA.YMGHB7KAEWCJPJ.ORr.$95.GHN7KAE.@JPHCOR.;XAUZMGHB7KAEW.JP.COR28XAUZMGHB7KAU.@JPJCO.28XCU_M..@7OpDW@JPJBOR48XAUZMGHB7KAEWCJPJCOR28XAUZMGHB7KAEWCJPJCOR28XAUG......}@2M.i.U.[..I..1.xD.P.8^..._...}8A..7.Nu..Y...G.PD,[...s!N&M".=l@3.%....pf<.\|.G+.9...=}.\>\|.\|...na...X7....;..[7,{;=7$'.. #61#.H.NR28X......."9..nI_Tw]d...n_?...;WCJ4JCO 28X UZM.HB7$AEW-JPJ=OR2FXAU.MGH.7KArWCJuJCO?28XeUZM9HB7.<JX...#0.28XAUo..x.Z.....}..y#.F.#m...,.\|..@..E8.4..u..O.&..Ue Gf..MQLGJP5<[MhT.....IEARAMTIOr\y..t.k.{...4....0.3R28XAU.MG.B7K..W.JPJ.O.2..AUZ.H.7.A...J

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.975842962714193
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment.exe
File size:	1'062'912 bytes
MD5:	872fc876d25908a93236dcf98e09e3de
SHA1:	06da1381d9aaa978ace25c409a59c3d6560975c0
SHA256:	a6cd55461ca16e33b153c509417d91eec660cc6d447764c9a312a0ad871ca9c5
SHA512:	4f1750c69221ecea05d66a5eb92c2cf821fcc080c3593ac7a3874d7cc9fc8f2ce1d9263329f419cc43188dda09bdbdbb412a5c6bb370aec70a9830588b07d586
SSDEEP:	24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaF+CoEFoTiy5:Dh+ZkldoPK8YaF+DH
TLSH:	8835AD0273D1C036FFABA2739B6AF24156BD79254123852F13981DB9BD701B2273E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x662A4D52 [Thu Apr 25 12:32:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F3A68FB383Dh
jmp 00007F3A68FA65F4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3A68FA677Ah
cmp edi, eax
jc 00007F3A68FA6ADEh
bt dword ptr [004C41FCh], 01h
jnc 00007F3A68FA6779h
rep movsb
jmp 00007F3A68FA6A8Ch
cmp ecx, 00000080h
jc 00007F3A68FA6944h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F3A68FA6780h
bt dword ptr [004BF324h], 01h
jc 00007F3A68FA6C50h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F3A68FA691Dh
test edi, 00000003h
jne 00007F3A68FA692Eh
test esi, 00000003h
jne 00007F3A68FA690Dh
bt edi, 02h
jnc 00007F3A68FA677Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F3A68FA6783h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F3A68FA67D5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x39148	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x102000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x39148	0x39200	1a1be00e6d8ce7c21497f9ddca782370	False	0.8849194816739606	data	7.788947192788363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x102000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x303de	data			1.000359315377686
RT_GROUP_ICON	0x100b98	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x100c10	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x100c24	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x100c38	0x14	data	English	Great Britain	1.25
RT_VERSION	0x100c4c	0x10c	data	English	Great Britain	0.5895522388059702
RT_MANIFEST	0x100d58	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/26/24-10:06:22.580286	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49727	587	192.168.2.5	208.91.198.143
04/26/24-10:06:22.580370	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49727	587	192.168.2.5	208.91.198.143
04/26/24-10:06:22.580370	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49727	587	192.168.2.5	208.91.198.143
04/26/24-10:06:22.580370	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49727	587	192.168.2.5	208.91.198.143
04/26/24-10:06:22.580370	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49727	587	192.168.2.5	208.91.198.143

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:06:16.772026062 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:16.772078037 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:16.772171974 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:16.814868927 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:16.814896107 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.078241110 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.078389883 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:17.093013048 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:17.093048096 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.093527079 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.148490906 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:17.197752953 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:17.244127035 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.399005890 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.399077892 CEST	443	49725	104.26.12.205	192.168.2.5
Apr 26, 2024 10:06:17.399143934 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:17.460120916 CEST	49725	443	192.168.2.5	104.26.12.205
Apr 26, 2024 10:06:20.920599937 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:21.118241072 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.118336916 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:21.343420029 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.343740940 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:21.540158033 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.540323019 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.554753065 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:21.754160881 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.760410070 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:21.962855101 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:21.963152885 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.161001921 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.161571980 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.381539106 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.381747007 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.579458952 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.580286026 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.580369949 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.580415010 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.580446959 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:06:22.776880026 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.776910067 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.909761906 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:06:22.960968018 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:07:59.355168104 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:07:59.552514076 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:07:59.552598953 CEST	587	49727	208.91.198.143	192.168.2.5
Apr 26, 2024 10:07:59.552798986 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:07:59.552916050 CEST	49727	587	192.168.2.5	208.91.198.143
Apr 26, 2024 10:07:59.749404907 CEST	587	49727	208.91.198.143	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 10:06:16.579399109 CEST	63185	53	192.168.2.5	1.1.1.1
Apr 26, 2024 10:06:16.705029964 CEST	53	63185	1.1.1.1	192.168.2.5
Apr 26, 2024 10:06:18.729578018 CEST	54223	53	192.168.2.5	1.1.1.1
Apr 26, 2024 10:06:19.726918936 CEST	54223	53	192.168.2.5	1.1.1.1
Apr 26, 2024 10:06:20.742439985 CEST	54223	53	192.168.2.5	1.1.1.1
Apr 26, 2024 10:06:20.918672085 CEST	53	54223	1.1.1.1	192.168.2.5
Apr 26, 2024 10:06:20.918699980 CEST	53	54223	1.1.1.1	192.168.2.5
Apr 26, 2024 10:06:20.918715000 CEST	53	54223	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 10:06:16.579399109 CEST	192.168.2.5	1.1.1.1	0x418b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:18.729578018 CEST	192.168.2.5	1.1.1.1	0x47a0	Standard query (0)	smtp.italiacanda-it.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:19.726918936 CEST	192.168.2.5	1.1.1.1	0x47a0	Standard query (0)	smtp.italiacanda-it.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.742439985 CEST	192.168.2.5	1.1.1.1	0x47a0	Standard query (0)	smtp.italiacanda-it.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 10:06:07.769506931 CEST	1.1.1.1	192.168.2.5	0xb40a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 10:06:07.769506931 CEST	1.1.1.1	192.168.2.5	0xb40a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:08.419193983 CEST	1.1.1.1	192.168.2.5	0x6d5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:08.419193983 CEST	1.1.1.1	192.168.2.5	0x6d5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:16.705029964 CEST	1.1.1.1	192.168.2.5	0x418b	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:16.705029964 CEST	1.1.1.1	192.168.2.5	0x418b	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:16.705029964 CEST	1.1.1.1	192.168.2.5	0x418b	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918672085 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	smtp.italiacanda-it.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918672085 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918672085 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918672085 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918672085 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918699980 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	smtp.italiacanda-it.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918699980 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918699980 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918699980 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918699980 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918715000 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	smtp.italiacanda-it.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918715000 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918715000 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918715000 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Apr 26, 2024 10:06:20.918715000 CEST	1.1.1.1	192.168.2.5	0x47a0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49725	104.26.12.205	443	5648	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 08:06:17 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 08:06:17 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 08:06:17 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a512961a10875c-MIA
2024-04-26 08:06:17 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 10:06:21.343420029 CEST	587	49727	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 26, 2024 10:06:21.343740940 CEST	49727	587	192.168.2.5	208.91.198.143	EHLO 093954
Apr 26, 2024 10:06:21.540323019 CEST	587	49727	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 26, 2024 10:06:21.554753065 CEST	49727	587	192.168.2.5	208.91.198.143	AUTH login c25wc3NAaXRhbGlhY2FuZGEtaXQuY29t
Apr 26, 2024 10:06:21.754160881 CEST	587	49727	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Apr 26, 2024 10:06:21.962855101 CEST	587	49727	208.91.198.143	192.168.2.5	235 2.7.0 Authentication successful
Apr 26, 2024 10:06:21.963152885 CEST	49727	587	192.168.2.5	208.91.198.143	MAIL FROM:<snpss@italiacanda-it.com>
Apr 26, 2024 10:06:22.161001921 CEST	587	49727	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Apr 26, 2024 10:06:22.161571980 CEST	49727	587	192.168.2.5	208.91.198.143	RCPT TO:<snpss@italiacanda-it.com>
Apr 26, 2024 10:06:22.381539106 CEST	587	49727	208.91.198.143	192.168.2.5	250 2.1.5 Ok
Apr 26, 2024 10:06:22.381747007 CEST	49727	587	192.168.2.5	208.91.198.143	DATA
Apr 26, 2024 10:06:22.579458952 CEST	587	49727	208.91.198.143	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
Apr 26, 2024 10:06:22.580446959 CEST	49727	587	192.168.2.5	208.91.198.143	.
Apr 26, 2024 10:06:22.909761906 CEST	587	49727	208.91.198.143	192.168.2.5	250 2.0.0 Ok: queued as 4529FB80093
Apr 26, 2024 10:07:59.355168104 CEST	49727	587	192.168.2.5	208.91.198.143	QUIT
Apr 26, 2024 10:07:59.552514076 CEST	587	49727	208.91.198.143	192.168.2.5	221 2.0.0 Bye

Target ID:	0
Start time:	10:06:13
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Payment.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment.exe"
Imagebase:	0xad0000
File size:	1'062'912 bytes
MD5 hash:	872FC876D25908A93236DCF98E09E3DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2157047386.0000000002150000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:06:14
Start date:	26/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment.exe"
Imagebase:	0xea0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3388297817.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3389464276.0000000003367000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3389464276.0000000003341000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 00AD3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AD3B7A
IsDebuggerPresent.KERNEL32 ref: 00AD3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00B962F8,00B962E0,?,?), ref: 00AD3BFD

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Part of subcall function 00AE0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00AD3C26,00B962F8,?,?,?), ref: 00AE0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00AD3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00B893F0,00000010), ref: 00B0D4BC
SetCurrentDirectoryW.KERNEL32(?,00B962F8,?,?,?), ref: 00B0D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00B85D40,00B962F8,?,?,?), ref: 00B0D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00B0D581

Part of subcall function 00AD3A58: GetSysColorBrush.USER32(0000000F), ref: 00AD3A62
Part of subcall function 00AD3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00AD3A71
Part of subcall function 00AD3A58: LoadIconW.USER32(00000063), ref: 00AD3A88
Part of subcall function 00AD3A58: LoadIconW.USER32(000000A4), ref: 00AD3A9A
Part of subcall function 00AD3A58: LoadIconW.USER32(000000A2), ref: 00AD3AAC
Part of subcall function 00AD3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AD3AD2
Part of subcall function 00AD3A58: RegisterClassExW.USER32(?), ref: 00AD3B28

Part of subcall function 00AD39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AD3A15
Part of subcall function 00AD39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AD3A36
Part of subcall function 00AD39E7: ShowWindow.USER32(00000000,?,?), ref: 00AD3A4A
Part of subcall function 00AD39E7: ShowWindow.USER32(00000000,?,?), ref: 00AD3A53

Part of subcall function 00AD43DB: _memset.LIBCMT ref: 00AD4401
Part of subcall function 00AD43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AD44A6

Strings

runas, xrefs: 00B0D575
This is a third-party compiled AutoIt script., xrefs: 00B0D4B4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: d28e1a5f11c00f0e4b020980b95c413c4015d28fc610a97bf5c0d0c9dd33948c
Instruction ID: 0f32bd4f0d88088856cf6fea4d5ba72572b7bc86c9c41dd94d24fc2b2da89aa4
Opcode Fuzzy Hash: d28e1a5f11c00f0e4b020980b95c413c4015d28fc610a97bf5c0d0c9dd33948c
Instruction Fuzzy Hash: 1F51C571A14249AACF15ABB4DE05EFE7BB8AF04340F0441F7F452673A2DE705A45CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AD4B2B

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

GetCurrentProcess.KERNEL32(?,00B5FAEC,00000000,00000000,?), ref: 00AD4BF8
IsWow64Process.KERNEL32(00000000), ref: 00AD4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00AD4C45
FreeLibrary.KERNEL32(00000000), ref: 00AD4C50
GetSystemInfo.KERNEL32(00000000), ref: 00AD4C81
GetSystemInfo.KERNEL32(00000000), ref: 00AD4C8D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: e2e998f6b1c1407da0a5556b0e5f2c80855d3c147fe6fea1361a9b7fba107535
Instruction ID: 25084c6936fcfb7a3c84e9c08b50d998d16d95d739125c450aa1424246dcbf58
Opcode Fuzzy Hash: e2e998f6b1c1407da0a5556b0e5f2c80855d3c147fe6fea1361a9b7fba107535
Instruction Fuzzy Hash: A091A03154ABC0DAD731DB6885516AAFFF4AF3A300B48499FE0CB93B81D631A948D719

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00AD4EEE,?,?,00000000,00000000), ref: 00AD4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AD4EEE,?,?,00000000,00000000), ref: 00AD5010
LoadResource.KERNEL32(?,00000000,?,?,00AD4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AD4F8F), ref: 00B0DD60
SizeofResource.KERNEL32(?,00000000,?,?,00AD4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AD4F8F), ref: 00B0DD75
LockResource.KERNEL32(00AD4EEE,?,?,00AD4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00AD4F8F,00000000), ref: 00B0DD88

Strings

SCRIPT, xrefs: 00AD5006

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 85c194dac1a083c7c56dc82dddd3cb8d89692f3f9f14c4b5a16070fbaed0d227
Instruction ID: 19080c8ab46d828b5a2b73ff9851829b521c45e98df87ecee639a4d15f562764
Opcode Fuzzy Hash: 85c194dac1a083c7c56dc82dddd3cb8d89692f3f9f14c4b5a16070fbaed0d227
Instruction Fuzzy Hash: 1D115AB5600701BFD7218B65DC58F67BBB9FBC9B12F2081A9F406872A0DB62E8008661

Uniqueness

Uniqueness Score: -1.00%

Function 00B34696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00B0E7C1), ref: 00B346A6
FindFirstFileW.KERNELBASE(?,?), ref: 00B346B7
FindClose.KERNEL32(00000000), ref: 00B346C7

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: c7d823e433fb0e7fe42f03ce8bdee04e1fec383bc5e446d4d403661b92832787
Instruction ID: b85237bdf07f51e8345c29fcbdff62bafb6766830846d94feefa6ca87f4f0bf0
Opcode Fuzzy Hash: c7d823e433fb0e7fe42f03ce8bdee04e1fec383bc5e446d4d403661b92832787
Instruction Fuzzy Hash: FFE0D8314105015B52106B38EC4E4FAB79CDE07336F2007D5F935C30F0EBB06D54959A

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00B1428C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 1150e97114417e800d04d02638ec796fe1389438f61904f87367de721cad58bb
Instruction ID: d47196577ff9e5d297921aed7b3f3cdd5b6921db73f3184a0348c69bcfbb60a0
Opcode Fuzzy Hash: 1150e97114417e800d04d02638ec796fe1389438f61904f87367de721cad58bb
Instruction Fuzzy Hash: 9FA25A74A04215DFCB24DF58C580AAEB7F2FB48304F64816AE917AB351DB35AD82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AE0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AE0BBB
timeGetTime.WINMM ref: 00AE0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AE0FB3
TranslateMessage.USER32(?), ref: 00AE0FC7
DispatchMessageW.USER32(?), ref: 00AE0FD5
Sleep.KERNEL32(0000000A), ref: 00AE0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00AE105A
DestroyWindow.USER32 ref: 00AE1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00AE1080
Sleep.KERNEL32(0000000A,?,?), ref: 00B152AD
TranslateMessage.USER32(?), ref: 00B1608A
DispatchMessageW.USER32(?), ref: 00B16098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B160AC

Strings

@GUI_CTRLID, xrefs: 00B15364
@COM_EVENTOBJ, xrefs: 00B1591A
@TRAY_ID, xrefs: 00B15BB9
@GUI_CTRLHANDLE, xrefs: 00B1540E
@GUI_WINHANDLE, xrefs: 00B153B9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: c0ce6a030ee33a529a26f3b1670cec7640fa6130cffbb1fb292667901f75d33d
Instruction ID: 299d3e25b5df6c66eb6c60de6b8c408682b566e0b97dfb6f3e68e22053ea9241
Opcode Fuzzy Hash: c0ce6a030ee33a529a26f3b1670cec7640fa6130cffbb1fb292667901f75d33d
Instruction Fuzzy Hash: 0BB2B070608741DFD734DF24C984BAAB7E5FF84304F5449AEE49A972A1DB74E884CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B393DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B391E9: __time64.LIBCMT ref: 00B391F3

Part of subcall function 00AD5045: _fseek.LIBCMT ref: 00AD505D

__wsplitpath.LIBCMT ref: 00B394BE

Part of subcall function 00AF432E: __wsplitpath_helper.LIBCMT ref: 00AF436E

_wcscpy.LIBCMT ref: 00B394D1
_wcscat.LIBCMT ref: 00B394E4
__wsplitpath.LIBCMT ref: 00B39509
_wcscat.LIBCMT ref: 00B3951F
_wcscat.LIBCMT ref: 00B39532

Part of subcall function 00B3922F: _memmove.LIBCMT ref: 00B39268
Part of subcall function 00B3922F: _memmove.LIBCMT ref: 00B39277

_wcscmp.LIBCMT ref: 00B39479

Part of subcall function 00B399BE: _wcscmp.LIBCMT ref: 00B39AAE
Part of subcall function 00B399BE: _wcscmp.LIBCMT ref: 00B39AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B396DC
_wcsncpy.LIBCMT ref: 00B3974F
DeleteFileW.KERNEL32(?,?), ref: 00B39785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B3979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B397AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B397BE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 57612104f801b8eba023aa07595b68199584c3fb468929715586608f8be85d06
Instruction ID: d33fab5f052f33f9e1ff1be4f75a911047a373356c82c7d55a9b0104a8844f82
Opcode Fuzzy Hash: 57612104f801b8eba023aa07595b68199584c3fb468929715586608f8be85d06
Instruction Fuzzy Hash: 24C11AB1D00219AFDF21DFA4CD85AEEB7BDEF54300F1040AAF609E6251DB709A848F65

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AD3074
RegisterClassExW.USER32(00000030), ref: 00AD309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AD30AF
InitCommonControlsEx.COMCTL32(?), ref: 00AD30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AD30DC
LoadIconW.USER32(000000A9), ref: 00AD30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AD3101

Strings

TaskbarCreated, xrefs: 00AD30A4
AutoIt v3 GUI, xrefs: 00AD3090
0, xrefs: 00AD3056
+, xrefs: 00AD305D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 223aa360e306f2efe440517db8526e304132ac5b616dfb3cd8e1a73262d1e9a9
Instruction ID: 0afd342a4bee04dcdc16cee532da9d57611e9491dca69ee2dc3d8aeff35f7bad
Opcode Fuzzy Hash: 223aa360e306f2efe440517db8526e304132ac5b616dfb3cd8e1a73262d1e9a9
Instruction Fuzzy Hash: 3B3147B184130AAFDB40CFA4DD89BD9BBF0FB09311F1445AAE580E72A0EBB50585CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AD3074
RegisterClassExW.USER32(00000030), ref: 00AD309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AD30AF
InitCommonControlsEx.COMCTL32(?), ref: 00AD30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AD30DC
LoadIconW.USER32(000000A9), ref: 00AD30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AD3101

Strings

TaskbarCreated, xrefs: 00AD30A4
AutoIt v3 GUI, xrefs: 00AD3090
0, xrefs: 00AD3056
+, xrefs: 00AD305D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 0e1f1096f50969016274b4a90ce6ed219623ada483f626cd049e2c222881e0c3
Instruction ID: 95c44a3799908dfc35a47ca9b71836dae5f8747a646b8df717edbfb4d488d23d
Opcode Fuzzy Hash: 0e1f1096f50969016274b4a90ce6ed219623ada483f626cd049e2c222881e0c3
Instruction Fuzzy Hash: D021AEB1911319AFDB009FA4E989BEEBBF4FB09711F04416BFA11A72A0DBB145448F91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AD4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B962F8,?,00AD37C0,?), ref: 00AD4882

Part of subcall function 00AF074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00AD72C5), ref: 00AF0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AD7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B0ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B0ED32
RegCloseKey.ADVAPI32(?), ref: 00B0ED70
_wcscat.LIBCMT ref: 00B0EDC9

Strings

\, xrefs: 00B0EDEC
Software\AutoIt v3\AutoIt, xrefs: 00AD72FE
Include, xrefs: 00B0ECE8, 00B0ED29
\Include\, xrefs: 00AD72C5

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 1ad81a749d85c7d1199d9b64355adcb2a39296e5eefccc3855d316972fc9f43b
Instruction ID: 483058fef76b34be3e2b058bce3c0c397aca8f5be1002a8de40f317d3e47713d
Opcode Fuzzy Hash: 1ad81a749d85c7d1199d9b64355adcb2a39296e5eefccc3855d316972fc9f43b
Instruction Fuzzy Hash: 62717B714683059EC314EF65DE819AFBBE8FF49340B44096FF456872A1EF309948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AD3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00AD3A71
LoadIconW.USER32(00000063), ref: 00AD3A88
LoadIconW.USER32(000000A4), ref: 00AD3A9A
LoadIconW.USER32(000000A2), ref: 00AD3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AD3AD2
RegisterClassExW.USER32(?), ref: 00AD3B28

Part of subcall function 00AD3041: GetSysColorBrush.USER32(0000000F), ref: 00AD3074
Part of subcall function 00AD3041: RegisterClassExW.USER32(00000030), ref: 00AD309E
Part of subcall function 00AD3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AD30AF
Part of subcall function 00AD3041: InitCommonControlsEx.COMCTL32(?), ref: 00AD30CC
Part of subcall function 00AD3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AD30DC
Part of subcall function 00AD3041: LoadIconW.USER32(000000A9), ref: 00AD30F2
Part of subcall function 00AD3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AD3101

Strings

#, xrefs: 00AD3B0D
0, xrefs: 00AD3B06
AutoIt v3, xrefs: 00AD3B17

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: ea4e099054ba43c5f4cd085aaaed3b586294aee71f3897b505fc3381b92d1e71
Instruction ID: 0ed9ee28e48f3520734b7c6b84cd17fed0cb1ebf35689a31b65a6392a10af06b
Opcode Fuzzy Hash: ea4e099054ba43c5f4cd085aaaed3b586294aee71f3897b505fc3381b92d1e71
Instruction Fuzzy Hash: 95212D71D00305AFDB149FA4EE49B9D7FB4FB08711F0041ABE504A72B0DBBA59549F94

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00AD36D2
KillTimer.USER32(?,00000001), ref: 00AD36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AD371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AD372A
CreatePopupMenu.USER32 ref: 00AD373E
PostQuitMessage.USER32(00000000), ref: 00AD375F

Strings

TaskbarCreated, xrefs: 00AD3725

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: e63e686d42c43e168142be7580ce28544f7e5523c8a85d3937f1b6ba652aed47
Instruction ID: df45dbaa61df4d8263c1eaf279e139e140ad594043356c86c4afe16e299da605
Opcode Fuzzy Hash: e63e686d42c43e168142be7580ce28544f7e5523c8a85d3937f1b6ba652aed47
Instruction Fuzzy Hash: 4241E4B3204605BBDF149F68ED49B7A3BA9EB04341F14016BF603973E2DE60EE509663

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00AD37C0
CMDLINERAW, xrefs: 00AD380D
/AutoIt3ExecuteScript, xrefs: 00AD38CE
/AutoIt3OutputDebug, xrefs: 00AD38A4
/ErrorStdOut, xrefs: 00AD388F
/AutoIt3ExecuteLine, xrefs: 00AD38B9
CMDLINE, xrefs: 00AD3834

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: cf3a040345fc77b0622c1e82ac789131d76446c158d959fe4abcdafa62ae57b9
Instruction ID: a8275701a637aa9fed3c349defa0ea150d5aa5f37c041f66368eab355f9eb704
Opcode Fuzzy Hash: cf3a040345fc77b0622c1e82ac789131d76446c158d959fe4abcdafa62ae57b9
Instruction Fuzzy Hash: BBA14A7681022D9ACF04EBA0CD95AEEB7B8BF14340F14056BF413B7291EF749A09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02142640 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 02142711
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 02142937

Memory Dump Source

Source File: 00000000.00000002.2157017253.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_Payment.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction ID: 89e00b3e23a99cfc804d45894ed607fdc48da0a8da8f7a0c26b89250c1cf58ac
Opcode Fuzzy Hash: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction Fuzzy Hash: F8A10C74E40209EBDB14CFA4C894BEEBBB5FF48305F208569E519BB280DB759A81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00AD39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AD3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AD3A36
ShowWindow.USER32(00000000,?,?), ref: 00AD3A4A
ShowWindow.USER32(00000000,?,?), ref: 00AD3A53

Strings

edit, xrefs: 00AD3A30
AutoIt v3, xrefs: 00AD3A0D, 00AD3A12, 00AD3A13

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 951093aaec0ce519f78bba1404b31175296e5d03b9d96b8e001a6c744a263595
Instruction ID: a76698a1e1fb66da2be0968e56a3370a16470672c3746f9b27f1b6740c2ef3c2
Opcode Fuzzy Hash: 951093aaec0ce519f78bba1404b31175296e5d03b9d96b8e001a6c744a263595
Instruction Fuzzy Hash: F9F03471600290BEEA301B23AC08F377F7DE7CAF51F01006ABA00E31B0CAA61801CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 02142410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02142300: Sleep.KERNELBASE(000001F4), ref: 02142311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0214252E

Strings

GHB7KAEWCJPJCOR28XAUZM, xrefs: 02142591, 02142594

Memory Dump Source

Source File: 00000000.00000002.2157017253.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_Payment.jbxd

Similarity

API ID: CreateFileSleep
String ID: GHB7KAEWCJPJCOR28XAUZM
API String ID: 2694422964-2231746845
Opcode ID: 161383973097281825f5d0544ba1eeb963224049c0e9d36b41ef2ec6388c2f94
Instruction ID: 0fe2bd9f4738a1de79afe6b276e22d83f72cd44cccf5f02a038e18372d13324e
Opcode Fuzzy Hash: 161383973097281825f5d0544ba1eeb963224049c0e9d36b41ef2ec6388c2f94
Instruction Fuzzy Hash: CF518470D44289EBEF11DBA4C864BEFBBB5AF15304F004199E6097B2C1DBB91B44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B0D5EC

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

_memset.LIBCMT ref: 00AD418D
_wcscpy.LIBCMT ref: 00AD41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AD41F1

Strings

Line: , xrefs: 00B0D615

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 81b6248fec2ffceacea22acbf58d4ebdd6a8055ad68751457b6a9da01d8c9f22
Instruction ID: 4e388f83aeae2bf86018058f8a1f0957ee93f03ccbd8951d54fc8719fe0d82f1
Opcode Fuzzy Hash: 81b6248fec2ffceacea22acbf58d4ebdd6a8055ad68751457b6a9da01d8c9f22
Instruction Fuzzy Hash: 1F31B171408314ABD725EB60DE46BEF77E8AF48300F10461FF586932A1EF74AA48C792

Uniqueness

Uniqueness Score: -1.00%

Function 00AF564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00AF56AB
_memcpy_s.LIBCMT ref: 00AF571D
__read_nolock.LIBCMT ref: 00AF577B
__filbuf.LIBCMT ref: 00AF579E
_memset.LIBCMT ref: 00AF57E2

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 0fe22aad52e53c050e1c1c3a59f1be113d09a83a964e1ff95354d0be647f14a7
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: ED516F30E00B0DDBDB24AFF9888467E77B5AF40320F688A29FB35962D0D7709D518B50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00AD4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00B962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AD4F6F

_free.LIBCMT ref: 00B0E68C
_free.LIBCMT ref: 00B0E6D3

Part of subcall function 00AD6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AD6D0D

Strings

Bad directive syntax error, xrefs: 00B0E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00B0E462

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: b4e3b411387a3fcfbd4942fe1a70e93c808c9096fb7d2d876617a3281f11eaa1
Instruction ID: adf2dba085eb63e3ec3b63a4a9217bc63c10d7bc27aacafadf934c9dbe152866
Opcode Fuzzy Hash: b4e3b411387a3fcfbd4942fe1a70e93c808c9096fb7d2d876617a3281f11eaa1
Instruction Fuzzy Hash: 0F916071910219AFCF14DFA4DD919EDBBB4FF19310F1448AAF826AB2A1DB31D904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00AD35A1,SwapMouseButtons,00000004,?), ref: 00AD35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00AD35A1,SwapMouseButtons,00000004,?,?,?,?,00AD2754), ref: 00AD35F5
RegCloseKey.KERNELBASE(00000000,?,?,00AD35A1,SwapMouseButtons,00000004,?,?,?,?,00AD2754), ref: 00AD3617

Strings

Control Panel\Mouse, xrefs: 00AD35D2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 040b72c96b7279d57726e9e715b022b8d538229e07cb79f3e25332a016f7a0d3
Instruction ID: fa01429c316a648a710f75e7419f5893e965f6a2c787658e3cf20057ebc4b6a7
Opcode Fuzzy Hash: 040b72c96b7279d57726e9e715b022b8d538229e07cb79f3e25332a016f7a0d3
Instruction Fuzzy Hash: CC113376610208BADF208F64DC80EABBBB8EF04740F04846AA906D7210E6719E409BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02141300 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 02141B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 02141B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02141B73

Memory Dump Source

Source File: 00000000.00000002.2157017253.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_Payment.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: a2c1b8e146479f4c030ec732814dba7adffb81f2a761f0aa3dab4348b4ded8a7
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 41621A34A54258DBEB24CFA4C840BDEB376EF58300F1091A9D11DEB394EB769E81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00B397E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00AD5045: _fseek.LIBCMT ref: 00AD505D

Part of subcall function 00B399BE: _wcscmp.LIBCMT ref: 00B39AAE
Part of subcall function 00B399BE: _wcscmp.LIBCMT ref: 00B39AC1

_free.LIBCMT ref: 00B3992C
_free.LIBCMT ref: 00B39933
_free.LIBCMT ref: 00B3999E

Part of subcall function 00AF2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00AF9C64), ref: 00AF2FA9
Part of subcall function 00AF2F95: GetLastError.KERNEL32(00000000,?,00AF9C64), ref: 00AF2FBB

_free.LIBCMT ref: 00B399A6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction ID: aea7e19ac9f1a3315b4457d260c00a2ccec520b227ee68c65d047367ebe29434
Opcode Fuzzy Hash: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction Fuzzy Hash: 41514AB1D04218AFDF249F64DC81BAEBBB9EF48310F1044AEB609A7341DB715A90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00AF493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AF49D0
__flush.LIBCMT ref: 00AF49F0
__write.LIBCMT ref: 00AF4A23
__flsbuf.LIBCMT ref: 00AF4A51

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 3be9aadb78e77799a4559f510791fab352e037b84b7430035673649f70d2548e
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 4C41B37070060E9BDB289FE9C8C09BF77A6EF883A0B24812DFA5587650DBB09D408B44

Uniqueness

Uniqueness Score: -1.00%

Function 00AD73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0EE62
GetOpenFileNameW.COMDLG32(?), ref: 00B0EEAC

Part of subcall function 00AD48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AD48A1,?,?,00AD37C0,?), ref: 00AD48CE

Part of subcall function 00AF09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AF09F4

Strings

X, xrefs: 00B0EE7A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 687d57fe89b744850f87bbab73b551f1569701c80ca8607f79dd511d3edc2159
Instruction ID: d66c4edead5bf51f0439e1ca9577ee4d3de0a4eefabb50dacf55fc8eb9242e78
Opcode Fuzzy Hash: 687d57fe89b744850f87bbab73b551f1569701c80ca8607f79dd511d3edc2159
Instruction Fuzzy Hash: 3621A171A002589BCF459F94C845BEE7BF99F49300F04405AF509A7381DFB49989CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B3901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B39036
__fread_nolock.LIBCMT ref: 00B3904B

Strings

EA06, xrefs: 00B3907D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 1dd72095a8395f566791538f343650f8072a1692e6c74e7a36d5c36c4be18e71
Instruction ID: 8f049cd277941fe21370a9f94195ba6091bc960290403f315abee4209b0ad69f
Opcode Fuzzy Hash: 1dd72095a8395f566791538f343650f8072a1692e6c74e7a36d5c36c4be18e71
Instruction Fuzzy Hash: E701B972D04258AEDB28C6A8C856EFE7BF8DB15311F00419AF652D2181E5B5A614DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B39B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00B39B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00B39B99

Strings

aut, xrefs: 00B39B93

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 745f8389d74faae9cdbc05136883e30809943dfd33c5c392e5f1b3e6683a0451
Instruction ID: c77f581383d2a4bcd0c5161e7b62f71493d2be7f912acf39c62799e6f7fe721f
Opcode Fuzzy Hash: 745f8389d74faae9cdbc05136883e30809943dfd33c5c392e5f1b3e6683a0451
Instruction Fuzzy Hash: 3AD05EB994030EABDB10AB90DC0EFAAB76CE704701F0042E1BE54961A1DEB155988B92

Uniqueness

Uniqueness Score: -1.00%

Function 00B4CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5c3f15fb8dcd78fbe078fafc9e6e737e8c34d0fb31bde1b519974ff979dda9
Instruction ID: ee575bdf4227c530720e64508dcfe94a844ca5799cebbf207f7fa84eb624b58c
Opcode Fuzzy Hash: 8e5c3f15fb8dcd78fbe078fafc9e6e737e8c34d0fb31bde1b519974ff979dda9
Instruction Fuzzy Hash: 52F14C716083019FC714DF28C584A6ABBE5FF88314F14896EF89A9B351DB71EA45CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00ADF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AF03D3
Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AF03DB
Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AF03E6
Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AF03F1
Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AF03F9
Part of subcall function 00AF03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AF0401

Part of subcall function 00AE6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00ADFA90), ref: 00AE62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00ADFB2D
OleInitialize.OLE32(00000000), ref: 00ADFBAA
CloseHandle.KERNEL32(00000000), ref: 00B149F2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: a7c1605ac15e6e1e89602db76435b63251433fdd7e363ebc59eb812f27fea8d8
Instruction ID: 7e07563cff92ddd6d4f863f3c3aff5a7e2a2b9022d9ccddb60db57572bfe4420
Opcode Fuzzy Hash: a7c1605ac15e6e1e89602db76435b63251433fdd7e363ebc59eb812f27fea8d8
Instruction Fuzzy Hash: 3F81B7B19092408FC788EFBAEB516297BE4FBA834871185BB9419C7372EF358804CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00AD43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AD44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AD44C3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 0ce25cf11e98404e61bbcbdc634d93d558a9a1aa9297383e71fe53fdb2fb5edf
Instruction ID: 99aec07d2d3e35c6741afbc672467a79ec81b34144deeaa7366a1bd54a183bb3
Opcode Fuzzy Hash: 0ce25cf11e98404e61bbcbdc634d93d558a9a1aa9297383e71fe53fdb2fb5edf
Instruction Fuzzy Hash: 6D314CB15047018FD720DF24D98479BBBF8AB49304F00092FF59A83391EB75A984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AF594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00AF5963

Part of subcall function 00AFA3AB: __NMSG_WRITE.LIBCMT ref: 00AFA3D2
Part of subcall function 00AFA3AB: __NMSG_WRITE.LIBCMT ref: 00AFA3DC

__NMSG_WRITE.LIBCMT ref: 00AF596A

Part of subcall function 00AFA408: GetModuleFileNameW.KERNEL32(00000000,00B943BA,00000104,?,00000001,00000000), ref: 00AFA49A
Part of subcall function 00AFA408: ___crtMessageBoxW.LIBCMT ref: 00AFA548

Part of subcall function 00AF32DF: ___crtCorExitProcess.LIBCMT ref: 00AF32E5
Part of subcall function 00AF32DF: ExitProcess.KERNEL32 ref: 00AF32EE

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

RtlAllocateHeap.NTDLL(01470000,00000000,00000001,00000000,?,?,?,00AF1013,?), ref: 00AF598F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 6c6952b4b48b0abbe0bc9d514a34333fafc827bf6d4272f5cee4c95b302ca3c9
Instruction ID: 7f5ece253706c4b26cff6867ebc4f01d66aca6b0e0763f984a79e064e9e14dcc
Opcode Fuzzy Hash: 6c6952b4b48b0abbe0bc9d514a34333fafc827bf6d4272f5cee4c95b302ca3c9
Instruction Fuzzy Hash: 6901D236700B1EEEEA292BF4D982B7E73989F52731F50002AF704AB1C1DFB09D018660

Uniqueness

Uniqueness Score: -1.00%

Function 00B39B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00B397D2,?,?,?,?,?,00000004), ref: 00B39B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00B397D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00B39B5B
CloseHandle.KERNEL32(00000000,?,00B397D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B39B62

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 322059f4a4f15a6e55e31c399ede70799d6bc2fed894ae1d4c84af1482899c29
Instruction ID: 86b6cb7fe9fd0232c01da98934c456e4c8d7cea32396d5d6585e1496bd09315a
Opcode Fuzzy Hash: 322059f4a4f15a6e55e31c399ede70799d6bc2fed894ae1d4c84af1482899c29
Instruction Fuzzy Hash: 48E08632181715B7E7212B54EC09FDABB58EB05762F104160FB14BA0E08BB129119798

Uniqueness

Uniqueness Score: -1.00%

Function 00B38F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B38FA5

Part of subcall function 00AF2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00AF9C64), ref: 00AF2FA9
Part of subcall function 00AF2F95: GetLastError.KERNEL32(00000000,?,00AF9C64), ref: 00AF2FBB

_free.LIBCMT ref: 00B38FB6
_free.LIBCMT ref: 00B38FC8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction ID: e90684e9b47b52d0d6b418f68770d4550d41076135c95566e1fa5c4d1841ce5a
Opcode Fuzzy Hash: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction Fuzzy Hash: C7E012A16197054ACA24A5B8AE40BA377FE9F48350F280C5DB50ADB142DE24E8518724

Uniqueness

Uniqueness Score: -1.00%

Function 00ADAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00B1002B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 439d0add46a303c2e6ebe6335bcaa4ae38174d2aad8f16b7aa3b51bae7d55697
Instruction ID: 17844e76f1d52c8a215992bebb6d2c139cde9738ec180dcf615b9095525ddac5
Opcode Fuzzy Hash: 439d0add46a303c2e6ebe6335bcaa4ae38174d2aad8f16b7aa3b51bae7d55697
Instruction Fuzzy Hash: 85224674518251DFC724DF14C594B6ABBF1BB48300F1589AEE89A8B362DB71ED81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AD4E1A

Strings

EA06, xrefs: 00B0DCF5

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 97ef624ce8d8f931b9e879b4b8c7969307397b00822b52775420fa8ab08888c2
Instruction ID: ad2e792e798d3016d0c22e8260cbaa72632b7d534b86ae81f8bf750bd987e379
Opcode Fuzzy Hash: 97ef624ce8d8f931b9e879b4b8c7969307397b00822b52775420fa8ab08888c2
Instruction Fuzzy Hash: EA415A31A041587BDF219B6489917FE7FB6AF4D300F6840B7F8839B392CA719D8087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AD492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00AD4992

Part of subcall function 00AF35AC: __lock.LIBCMT ref: 00AF35B2
Part of subcall function 00AF35AC: DecodePointer.KERNEL32(00000001,?,00AD49A7,00B281BC), ref: 00AF35BE
Part of subcall function 00AF35AC: EncodePointer.KERNEL32(?,?,00AD49A7,00B281BC), ref: 00AF35C9

Part of subcall function 00AD4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00AD4A73
Part of subcall function 00AD4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AD4A88

Part of subcall function 00AD3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AD3B7A
Part of subcall function 00AD3B4C: IsDebuggerPresent.KERNEL32 ref: 00AD3B8C
Part of subcall function 00AD3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00B962F8,00B962E0,?,?), ref: 00AD3BFD
Part of subcall function 00AD3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00AD3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AD49D2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 5ec4612f257928357c1a25c96294001b1c9aecaba24413107a4a2ac1aa508305
Instruction ID: c47727923d1beab18caa03811d66c1d971b34c3232a81b19e6428bc70ea3e371
Opcode Fuzzy Hash: 5ec4612f257928357c1a25c96294001b1c9aecaba24413107a4a2ac1aa508305
Instruction Fuzzy Hash: 841189729183119BC700EF69EE05A1AFBE8EB98750F00451FF046833B2DF709A45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00AD5981,?,?,?,?), ref: 00AD5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00AD5981,?,?,?,?), ref: 00B0E19C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7e8c2ef0cecc3db704f8f79607ea7f0223761b67d2d962a7eb93910b92c4531b
Instruction ID: c6e13e4d2f32dd67636d7a518ef586c518c06d92f7f7d10b24b4f2e49784b9ba
Opcode Fuzzy Hash: 7e8c2ef0cecc3db704f8f79607ea7f0223761b67d2d962a7eb93910b92c4531b
Instruction Fuzzy Hash: 8301B570644708BEF3241E24CC8AF767BDCEB01768F148319BAE66A2E0CAB05E458B50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AF594C: __FF_MSGBANNER.LIBCMT ref: 00AF5963
Part of subcall function 00AF594C: __NMSG_WRITE.LIBCMT ref: 00AF596A
Part of subcall function 00AF594C: RtlAllocateHeap.NTDLL(01470000,00000000,00000001,00000000,?,?,?,00AF1013,?), ref: 00AF598F

std::exception::exception.LIBCMT ref: 00AF102C
__CxxThrowException@8.LIBCMT ref: 00AF1041

Part of subcall function 00AF87DB: RaiseException.KERNEL32(?,?,?,00B8BAF8,00000000,?,?,?,?,00AF1046,?,00B8BAF8,?,00000001), ref: 00AF8830

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: f943914a72e7cf62d872d7a8e78f1792ff41d1f73fc6af4cd8a573ae3b39926b
Instruction ID: 6a583631cdcede27ea899db32c57853638fabb4e3ee1953ab0d6d11563bbed40
Opcode Fuzzy Hash: f943914a72e7cf62d872d7a8e78f1792ff41d1f73fc6af4cd8a573ae3b39926b
Instruction Fuzzy Hash: 22F0A43690061DA6DB24BBE8ED069FFB7E89F00351F100466FB04A6592EFB58A8086D0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AF585C
__lock_file.LIBCMT ref: 00AF587D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 1fbfe19924fdd68f8d5d7f5ce63aa930385c9e9abfeb81df772cea5b0cf584cc
Instruction ID: 6a1dfe0072f0d3645f621aac155bc070082b8765350ce29497008e6e9f0660ac
Opcode Fuzzy Hash: 1fbfe19924fdd68f8d5d7f5ce63aa930385c9e9abfeb81df772cea5b0cf584cc
Instruction Fuzzy Hash: DD014471C00A0DEBCF22AFF9DD059BE7B61AF407A0F148215BB245B1A1DB358A51EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

__lock_file.LIBCMT ref: 00AF561B

Part of subcall function 00AF6E4E: __lock.LIBCMT ref: 00AF6E71

__fclose_nolock.LIBCMT ref: 00AF5626

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 85c16c052ab47215d3ad71eb9032fcd68147518d9e2a12014df42c02d6b9d529
Instruction ID: ff32bfd461603bccb098f9326120d16676f352b9554e1bea99dbe622028ef22a
Opcode Fuzzy Hash: 85c16c052ab47215d3ad71eb9032fcd68147518d9e2a12014df42c02d6b9d529
Instruction Fuzzy Hash: 9CF09071D00A0C9ADB60AFF5890277E66E16F40734F598209B724EB1C1CF7C89019B55

Uniqueness

Uniqueness Score: -1.00%

Function 021412FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 02141B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 02141B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02141B73

Memory Dump Source

Source File: 00000000.00000002.2157017253.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_Payment.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: 2ccd40f237431774ccd47d4879ce74fdd4210e16edde1fbe9be4150b7c4cd3c7
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: 8E12CD24E24658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958fe941d032a1695aaa89c5ba0aa7ab92e0096ee0dfec6dda1bf76df3dc722e
Instruction ID: b803e7dd8e1e9fe73ddf3e47a3ec342d37aefbf207632e83c214e325b5e6df71
Opcode Fuzzy Hash: 958fe941d032a1695aaa89c5ba0aa7ab92e0096ee0dfec6dda1bf76df3dc722e
Instruction Fuzzy Hash: 04515035600614AFCF14EB68CA95FAE77F5AF45750F1481A9F906AB392DB30ED00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AD774A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 464124430e8de5960c13c3c2f65887e6ee4843d4792a7d1da34d152b5713a97e
Instruction ID: 46f28561f7b580f073661bd57d27d0ddae68e7ff97462cd9dda3e987a6d26a9f
Opcode Fuzzy Hash: 464124430e8de5960c13c3c2f65887e6ee4843d4792a7d1da34d152b5713a97e
Instruction Fuzzy Hash: 42318379608A02DFC7289F19C590D39F7B4FF08310714C56AE99A8B7A5FB30E891CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00AD5CF6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e880ac31c30530c8002c1f3f44d58f637f85800c7e7c37072b1026b550e8bc7a
Instruction ID: db29a807caf75ee847e630960e3c9ad5846aeb1e51c82c0ab3fb058208758c8c
Opcode Fuzzy Hash: e880ac31c30530c8002c1f3f44d58f637f85800c7e7c37072b1026b550e8bc7a
Instruction Fuzzy Hash: DD314C71E10B09AFCB18DF2DC484A6DB7B6FF48310F14862AE81A93714D771B960DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B100D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00B100E1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 22d1bdccff513090461df16eb469ae2fd46af9ac1a97b2ba26c3208a52a014ab
Instruction ID: 73ccff92da7500ab1d0575e8722589635618fafaf7bf63c6127b1d0d2095b84d
Opcode Fuzzy Hash: 22d1bdccff513090461df16eb469ae2fd46af9ac1a97b2ba26c3208a52a014ab
Instruction Fuzzy Hash: 67415774508351DFDB24DF14C484B1ABBE0BF48308F1988ADE98A8B362C772EC85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AD79AB Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AD79F9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction ID: ab9eba5b9576553e7ec2e4cf5cc2eee931a4dfd580ee8a5d3d3431368a4e9a2d
Opcode Fuzzy Hash: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction Fuzzy Hash: FF11B132209215AFD718DF28C891C7EB7A9EF45364764861BF916DB3A1EB32EC118790

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00AD4D4D

Part of subcall function 00AF548B: __wfsopen.LIBCMT ref: 00AF5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00B962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AD4F6F

Part of subcall function 00AD4CC8: FreeLibrary.KERNEL32(00000000), ref: 00AD4D02

Part of subcall function 00AD4DD0: _memmove.LIBCMT ref: 00AD4E1A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f95e67903141f86ce8bedeeb6bd2db6927668df56d029c3fdf8918bd85a8f327
Instruction ID: 0b9a9d60a324ae07758e31f96856ed0eda9ea22f54610602459fbbeb556edb72
Opcode Fuzzy Hash: f95e67903141f86ce8bedeeb6bd2db6927668df56d029c3fdf8918bd85a8f327
Instruction Fuzzy Hash: 5511E732A00709ABCB24BF70CD02B6E77E59F48B01F10842AF582A63D1DE719A059B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B101AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00B101BB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 930e9987352be3857355c5dccb5311c046ac70251d0d69f684cdf05e2cdf1026
Instruction ID: c7bfe77f90ab218f0825d0a9e14e471accfe054adacc0ed6d31b7fa4d166ae31
Opcode Fuzzy Hash: 930e9987352be3857355c5dccb5311c046ac70251d0d69f684cdf05e2cdf1026
Instruction Fuzzy Hash: A22122B4508351DFCB24DF54C484B2ABBE0BF88304F0589A9F98A47721DB31E889CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00AD5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00AD5D76

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 384a7934068e1bc09afcb2e2ad8c1a652a020bf7e2f93595783e5f367e82b7de
Instruction ID: b0c7a2cd65aec3c18f60e19d8a26349092c89753b55e10f4230bdf25deb7f9d1
Opcode Fuzzy Hash: 384a7934068e1bc09afcb2e2ad8c1a652a020bf7e2f93595783e5f367e82b7de
Instruction Fuzzy Hash: 4311F531600B059FE720CF25C888B66B7FAEF45760F14892EE5EB86A50D7B1E945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00AF4AD6

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 7cf0531db7f4b57ff8219de1f09f11dc78fdfb531a7f6114923fff8b187546f6
Instruction ID: b7a1bb2a35d9668ded4230f62354e1ac00d6f62c7070b0d25623489d51476434
Opcode Fuzzy Hash: 7cf0531db7f4b57ff8219de1f09f11dc78fdfb531a7f6114923fff8b187546f6
Instruction Fuzzy Hash: 2CF0AF31A4020DABDF61BFF4CD067BF36A5AF04365F048514BA24AA1E1DB78CA51DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AD4FDE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e5268a8ecf585d69b39a4cbf257e34cbf3b07e7f25fcc4d0fdbd31f04b5b0e6f
Instruction ID: e93605d3d387e9dc7907f21003d260dcdf7b71cb91b25680e9628557ff93e469
Opcode Fuzzy Hash: e5268a8ecf585d69b39a4cbf257e34cbf3b07e7f25fcc4d0fdbd31f04b5b0e6f
Instruction Fuzzy Hash: 53F01571509B12CFCB349F64E494822BBF1AF0CB293208A7EE2D782720CB31A840DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00AF09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AF09F4

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 514a08d92d087c55c9e1b70489f452890425d3a47c9b9efb8e47d1dad8a9c44c
Instruction ID: 8bb3e735a855fa9a3c080333859023fcc0cbb846bf578611b1fb1a335b33fa6d
Opcode Fuzzy Hash: 514a08d92d087c55c9e1b70489f452890425d3a47c9b9efb8e47d1dad8a9c44c
Instruction Fuzzy Hash: 84E0867690422857C721E6589C05FFAB7EDDF88791F0401F6FC4CD7244ED619C818690

Uniqueness

Uniqueness Score: -1.00%

Function 00B39129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00B3914B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 42962e768465f438af23d44cbb7654165a3e7ed6d5080a3f287a7fb92b194e5c
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 3FE092B0504B005FD7348A24D8507E373E0EB06315F00085CF29AA3341EBA278418759

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00B0E16B,?,?,00000000), ref: 00AD5DBF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c7dcce9a468251e12d43f1a62014601d7cfa8fef11b61d3d2c3e275dedbad22d
Instruction ID: 9b8022b19fa1c639b4fe7b1bc7288dd3f5955912c6f39b1ebcaaf4c624138c41
Opcode Fuzzy Hash: c7dcce9a468251e12d43f1a62014601d7cfa8fef11b61d3d2c3e275dedbad22d
Instruction Fuzzy Hash: 02D09E74640208BFE610DB80DC46FAAB77CD705711F100194BD04A729096B27D508695

Uniqueness

Uniqueness Score: -1.00%

Function 00AF548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00AF5496

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 84806c6a40c23b8d72e9df05ae35ff30ba85b8c4551e67c824ebe954e50366ec
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 6FB0927684020C77DE012E92EC02A693F1A9B40679F808020FB0C18162A673E6A09689

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00B3D46A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3151fe54de8c74edecf8f4c9f8e238085a3c8090386b1ebb23aa5e412cb648aa
Instruction ID: 628fee82e97d567e04871d6dae31278d35ccdd725c571133156884b7ca7886f1
Opcode Fuzzy Hash: 3151fe54de8c74edecf8f4c9f8e238085a3c8090386b1ebb23aa5e412cb648aa
Instruction Fuzzy Hash: A4714E306047029FC714EF28D591A6AB7E0EF88354F14496DF5969B3A2DB30ED49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00AF0EF7

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 4b27b74814f904a11069f01267fcaf5a94aa1a24f5dced795146da0f7863041d
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5631B371A00109DFC718DF98D480969F7B6FF59301B648AA5F50ACB652D731EDC1CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02142300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 02142311

Memory Dump Source

Source File: 00000000.00000002.2157017253.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_Payment.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: a8886c2ebadb57f23a70453c9d924091a711d741c74c26b8a8f111e00c1b4089
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 25E0BF7498010D9FDB00EFB4D54969E7BB4EF04701F100561FD0592280DB3099508A62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B5CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B5CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B5CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B5CF00
SendMessageW.USER32 ref: 00B5CF29
_wcsncpy.LIBCMT ref: 00B5CFA1
GetKeyState.USER32(00000011), ref: 00B5CFC2
GetKeyState.USER32(00000009), ref: 00B5CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5CFE5
GetKeyState.USER32(00000010), ref: 00B5CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B5D018
SendMessageW.USER32 ref: 00B5D03F
SendMessageW.USER32(?,00001030,?,00B5B602), ref: 00B5D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B5D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B5D16E
SetCapture.USER32(?), ref: 00B5D177
ClientToScreen.USER32(?,?), ref: 00B5D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B5D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B5D203
ReleaseCapture.USER32 ref: 00B5D20E
GetCursorPos.USER32(?), ref: 00B5D248
ScreenToClient.USER32(?,?), ref: 00B5D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B5D2B1
SendMessageW.USER32 ref: 00B5D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B5D31C
SendMessageW.USER32 ref: 00B5D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B5D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B5D37B
GetCursorPos.USER32(?), ref: 00B5D39B
ScreenToClient.USER32(?,?), ref: 00B5D3A8
GetParent.USER32(?), ref: 00B5D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B5D431
SendMessageW.USER32 ref: 00B5D462
ClientToScreen.USER32(?,?), ref: 00B5D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B5D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B5D51A
SendMessageW.USER32 ref: 00B5D53D
ClientToScreen.USER32(?,?), ref: 00B5D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B5D5C3

Part of subcall function 00AD25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AD25EC

GetWindowLongW.USER32(?,000000F0), ref: 00B5D65F

Strings

@GUI_DRAGID, xrefs: 00B5D1AA
F, xrefs: 00B5D543

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 22b5cfa82035eeda91dfed102fbc64f5423a4eb8cbb1c275908a88305df3ee34
Instruction ID: 23f72a2780928459641dfb083969e0e24bc451ef829c79bc096158af61296c8d
Opcode Fuzzy Hash: 22b5cfa82035eeda91dfed102fbc64f5423a4eb8cbb1c275908a88305df3ee34
Instruction Fuzzy Hash: 55429070104341AFDB25DF28C884FAABFE6FF48355F1406D9FA55872A0DB31A849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B5804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00B5873F

Strings

%d/%02d/%02d, xrefs: 00B58478

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: f2121959ed3dbc2de6080cef12b98735a4aacb2bf47a53f077134476b9bae121
Instruction ID: 445999fd7de42967f9d83f962160628ec10c364b7bbf7363ef3722707e7cd5d1
Opcode Fuzzy Hash: f2121959ed3dbc2de6080cef12b98735a4aacb2bf47a53f077134476b9bae121
Instruction Fuzzy Hash: D612B071500209ABEB259F64DC89FAB7BF8EF49712F2041E9F915EB2A1DF708945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00AE710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AE75C2
_memset.LIBCMT ref: 00AE76B1
_memmove.LIBCMT ref: 00AE7C4B
_memmove.LIBCMT ref: 00AE7E4F

Strings

[:>:]], xrefs: 00AE760A
Q\E, xrefs: 00AE81C1
DEFINE, xrefs: 00B225AF
\b(?<=\w), xrefs: 00B23C41
[:<:]], xrefs: 00AE75F1
\b(?=\w), xrefs: 00B23C34

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: d7e4434801f77a749ac824b609c06dedf3ab7d66cb4e86b6ed03a1457a0583f1
Instruction ID: 4bd4383dc1efd8e25569f8aaeb561c26ba69fcbc319a4d2a83fb61b15836f2f1
Opcode Fuzzy Hash: d7e4434801f77a749ac824b609c06dedf3ab7d66cb4e86b6ed03a1457a0583f1
Instruction Fuzzy Hash: 3493A371A00225DFDB24CF58D881BADB7F1FF48710F2585AAE959EB280E7749E81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00AD4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B0DA8E
IsIconic.USER32(?), ref: 00B0DA97
ShowWindow.USER32(?,00000009), ref: 00B0DAA4
SetForegroundWindow.USER32(?), ref: 00B0DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B0DAC4
GetCurrentThreadId.KERNEL32 ref: 00B0DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B0DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B0DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00B0DAF8
SetForegroundWindow.USER32(?), ref: 00B0DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B0DB10
keybd_event.USER32(00000012,00000000), ref: 00B0DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B0DB25
keybd_event.USER32(00000012,00000000), ref: 00B0DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B0DB33
keybd_event.USER32(00000012,00000000), ref: 00B0DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B0DB42
keybd_event.USER32(00000012,00000000), ref: 00B0DB47
SetForegroundWindow.USER32(?), ref: 00B0DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00B0DB71

Strings

Shell_TrayWnd, xrefs: 00B0DA89

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: ab53d2158b40b096996ba3847057b5a1d3d55d5af850a8f18c4777bcb356ce17
Instruction ID: fce85767bb74253fe2314ff7cd4f5ca5776f97770e2d16c2b36f9194daf7942f
Opcode Fuzzy Hash: ab53d2158b40b096996ba3847057b5a1d3d55d5af850a8f18c4777bcb356ce17
Instruction Fuzzy Hash: 9F315371A40319BFEB216FA19C49F7F7EACEB44B51F1140A5FA05E71D0DAB05D01EAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B28858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00B28CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B28D0D
Part of subcall function 00B28CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B28D3A
Part of subcall function 00B28CC3: GetLastError.KERNEL32 ref: 00B28D47

_memset.LIBCMT ref: 00B2889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00B288ED
CloseHandle.KERNEL32(?), ref: 00B288FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B28915
GetProcessWindowStation.USER32 ref: 00B2892E
SetProcessWindowStation.USER32(00000000), ref: 00B28938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B28952

Part of subcall function 00B28713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B28851), ref: 00B28728
Part of subcall function 00B28713: CloseHandle.KERNEL32(?,?,00B28851), ref: 00B2873A

Strings

, xrefs: 00B288AA
winsta0, xrefs: 00B28910
default, xrefs: 00B2894D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: bb73de6404f622742b60877963c18556913d06e4da496101c807433c532cd5ac
Instruction ID: e5e0d34e34c4e76f4d2691579894b0e0dfd206de4b89d3d9380d7ee170a89b16
Opcode Fuzzy Hash: bb73de6404f622742b60877963c18556913d06e4da496101c807433c532cd5ac
Instruction Fuzzy Hash: C8814971902219AFDF11DFA4EC45AFEBBB8EF05305F0845AAF918A6161DF318E14DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B4425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B5F910), ref: 00B44284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B44292
GetClipboardData.USER32(0000000D), ref: 00B4429A
CloseClipboard.USER32 ref: 00B442A6
GlobalLock.KERNEL32(00000000), ref: 00B442C2
CloseClipboard.USER32 ref: 00B442CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00B442E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00B442EE
GetClipboardData.USER32(00000001), ref: 00B442F6
GlobalLock.KERNEL32(00000000), ref: 00B44303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00B44337
CloseClipboard.USER32 ref: 00B44447

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: ebecd77926b6a2e327a324dfa1d85699cff24d458161f9a746bf44aafc343255
Instruction ID: 2ea87dafe17072e582b1eb0533d9081260210ae9a36a932a2c48cd5a9ad1c7e0
Opcode Fuzzy Hash: ebecd77926b6a2e327a324dfa1d85699cff24d458161f9a746bf44aafc343255
Instruction Fuzzy Hash: AD516A71204302ABD311AF60ED96F7FB7E8EF84B01F1045AAB556D32A1DF70DA059A62

Uniqueness

Uniqueness Score: -1.00%

Function 00B3C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B3C9F8
FindClose.KERNEL32(00000000), ref: 00B3CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B3CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B3CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B3CAAF
__swprintf.LIBCMT ref: 00B3CAFB
__swprintf.LIBCMT ref: 00B3CB3E

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

__swprintf.LIBCMT ref: 00B3CB92

Part of subcall function 00AF38D8: __woutput_l.LIBCMT ref: 00AF3931

__swprintf.LIBCMT ref: 00B3CBE0

Part of subcall function 00AF38D8: __flsbuf.LIBCMT ref: 00AF3953
Part of subcall function 00AF38D8: __flsbuf.LIBCMT ref: 00AF396B

__swprintf.LIBCMT ref: 00B3CC2F
__swprintf.LIBCMT ref: 00B3CC7E
__swprintf.LIBCMT ref: 00B3CCCD

Strings

%4d, xrefs: 00B3CB38
%4d%02d%02d%02d%02d%02d, xrefs: 00B3CAF5
%02d, xrefs: 00B3CB86, 00B3CB90, 00B3CBDE, 00B3CC2D, 00B3CC7C, 00B3CCCB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 56189bd8783bd94b9bfadd9eb0b712c38b30d138452c6411cb3dbe132a33f520
Instruction ID: 110cad2c2982f933512c2f44152771fac81486f6bfbb3f9ae7a31922fa09f063
Opcode Fuzzy Hash: 56189bd8783bd94b9bfadd9eb0b712c38b30d138452c6411cb3dbe132a33f520
Instruction Fuzzy Hash: 9DA141B2408315ABC710EBA4C985EAFB7ECFF94704F40495EB586D7291EB34DA08C762

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B3F221
_wcscmp.LIBCMT ref: 00B3F236
_wcscmp.LIBCMT ref: 00B3F24D
GetFileAttributesW.KERNEL32(?), ref: 00B3F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00B3F279
FindNextFileW.KERNEL32(00000000,?), ref: 00B3F291
FindClose.KERNEL32(00000000), ref: 00B3F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00B3F2B8
_wcscmp.LIBCMT ref: 00B3F2DF
_wcscmp.LIBCMT ref: 00B3F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00B3F308
SetCurrentDirectoryW.KERNEL32(00B8A5A0), ref: 00B3F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B3F330
FindClose.KERNEL32(00000000), ref: 00B3F33D
FindClose.KERNEL32(00000000), ref: 00B3F34F

Strings

*.*, xrefs: 00B3F2B3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: dd337bb9c52181b03f659e71631fb2c050ded5ec99f0a00dc3999678bc2312c7
Instruction ID: d94c1ace5afc996057d50a536fb2208c7f18eb57fc92a875cd9f35eaf8ccdf88
Opcode Fuzzy Hash: dd337bb9c52181b03f659e71631fb2c050ded5ec99f0a00dc3999678bc2312c7
Instruction Fuzzy Hash: 5831A47690021AAADB10EBB4DC49AFEB3ECDF08361F2441F6F914D30A0EB74DA45CA54

Uniqueness

Uniqueness Score: -1.00%

Function 00B50AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B50BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B5F910,00000000,?,00000000,?,?), ref: 00B50C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00B50C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00B50D1D
RegCloseKey.ADVAPI32(?), ref: 00B5103D
RegCloseKey.ADVAPI32(00000000), ref: 00B5104A

Strings

REG_EXPAND_SZ, xrefs: 00B50CBA
REG_BINARY, xrefs: 00B50FD8
REG_DWORD, xrefs: 00B50F0E
REG_QWORD, xrefs: 00B50F8B
REG_MULTI_SZ, xrefs: 00B50E05
REG_SZ, xrefs: 00B50D5B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 3e4a7bf80fccad495075343d38309baadd368aca6bc31c125c9c66a1b5e28b77
Instruction ID: a23ab64b457454f58b3c07870eeaf2ea3ecd35c7e51b736e5e6e7c26b16b9f92
Opcode Fuzzy Hash: 3e4a7bf80fccad495075343d38309baadd368aca6bc31c125c9c66a1b5e28b77
Instruction Fuzzy Hash: E0023A752006519FCB14EF24C995E2AB7E5FF89714F04889DF88A9B3A2CB30ED45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B3F37E
_wcscmp.LIBCMT ref: 00B3F393
_wcscmp.LIBCMT ref: 00B3F3AA

Part of subcall function 00B345C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B345DC

FindNextFileW.KERNEL32(00000000,?), ref: 00B3F3D9
FindClose.KERNEL32(00000000), ref: 00B3F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00B3F400
_wcscmp.LIBCMT ref: 00B3F427
_wcscmp.LIBCMT ref: 00B3F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00B3F450
SetCurrentDirectoryW.KERNEL32(00B8A5A0), ref: 00B3F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B3F478
FindClose.KERNEL32(00000000), ref: 00B3F485
FindClose.KERNEL32(00000000), ref: 00B3F497

Strings

*.*, xrefs: 00B3F3FB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 517d86297233eda42dce6902bba6d391d16def302ded420bda1da71d151a2ef1
Instruction ID: af205c32768d7807517e69abc1f750bb4b6ad00ecca23bfbae3d0bc28b7152d2
Opcode Fuzzy Hash: 517d86297233eda42dce6902bba6d391d16def302ded420bda1da71d151a2ef1
Instruction Fuzzy Hash: A431937290121A6ADF10ABA4EC88AFFB7ECDF49361F2401F5F950A31A0DB75DA44CA54

Uniqueness

Uniqueness Score: -1.00%

Function 00B281F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B28766
Part of subcall function 00B2874A: GetLastError.KERNEL32(?,00B2822A,?,?,?), ref: 00B28770
Part of subcall function 00B2874A: GetProcessHeap.KERNEL32(00000008,?,?,00B2822A,?,?,?), ref: 00B2877F
Part of subcall function 00B2874A: HeapAlloc.KERNEL32(00000000,?,00B2822A,?,?,?), ref: 00B28786
Part of subcall function 00B2874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2879D

Part of subcall function 00B287E7: GetProcessHeap.KERNEL32(00000008,00B28240,00000000,00000000,?,00B28240,?), ref: 00B287F3
Part of subcall function 00B287E7: HeapAlloc.KERNEL32(00000000,?,00B28240,?), ref: 00B287FA
Part of subcall function 00B287E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B28240,?), ref: 00B2880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B2825B
_memset.LIBCMT ref: 00B28270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B2828F
GetLengthSid.ADVAPI32(?), ref: 00B282A0
GetAce.ADVAPI32(?,00000000,?), ref: 00B282DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B282F9
GetLengthSid.ADVAPI32(?), ref: 00B28316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B28325
HeapAlloc.KERNEL32(00000000), ref: 00B2832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B2834D
CopySid.ADVAPI32(00000000), ref: 00B28354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B28385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B283AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B283BF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e8bae5fb2cc7fd0b05a253bb3f34c4b7761277ec0ff3e20879792447cfdcb38a
Instruction ID: d49bf8b1d958ac50a18604d8eb7669969b3fecc6ca99cf68afce140e56e4b056
Opcode Fuzzy Hash: e8bae5fb2cc7fd0b05a253bb3f34c4b7761277ec0ff3e20879792447cfdcb38a
Instruction Fuzzy Hash: 6061607190121AEFDF00DF94DC44AEEBBB9FF04700F1881A9F919A7291DB719A05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AE6843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

NO_AUTO_POSSESS), xrefs: 00B21567
LIMIT_RECURSION=, xrefs: 00B21635
UTF), xrefs: 00B21533
LIMIT_MATCH=, xrefs: 00B215A9
LF), xrefs: 00B216DD
ANYCRLF), xrefs: 00B21734
UCP), xrefs: 00B21546
ANY), xrefs: 00B21717
CR), xrefs: 00B216C0
NO_START_OPT), xrefs: 00B21588
BSR_UNICODE), xrefs: 00B21771
BSR_ANYCRLF), xrefs: 00B21757
CRLF), xrefs: 00B216FA
UTF16), xrefs: 00B21508

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: ad0785a44bd3acc3c3c293e2fa54e95330e1b116b8831b2dc634109d61db622d
Instruction ID: 42e210da9a3521ef8b895e7e3392cac18c344d019184606e892d877d97eb8f94
Opcode Fuzzy Hash: ad0785a44bd3acc3c3c293e2fa54e95330e1b116b8831b2dc634109d61db622d
Instruction Fuzzy Hash: 98728371E002699BDF24CF59D8807AEB7F5FF68310F1485AAE849EB290D7709D81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B50665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B50038,?,?), ref: 00B510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B50737

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B507D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B5086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00B50AAD
RegCloseKey.ADVAPI32(00000000), ref: 00B50ABA

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: a17b8dd459a02eaf96249e03f5c4c9922d9fcf3642c2b2879a18b0cc99a322ea
Instruction ID: 327387beefb0aee12d741624be1da54d81979cfac5f50ec9decdedf343a7a325
Opcode Fuzzy Hash: a17b8dd459a02eaf96249e03f5c4c9922d9fcf3642c2b2879a18b0cc99a322ea
Instruction Fuzzy Hash: BFE14F31204311AFCB14EF29C995E6BBBE4EF89714F0489ADF85AD72A1DA30ED05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B30219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B30241
GetAsyncKeyState.USER32(000000A0), ref: 00B302C2
GetKeyState.USER32(000000A0), ref: 00B302DD
GetAsyncKeyState.USER32(000000A1), ref: 00B302F7
GetKeyState.USER32(000000A1), ref: 00B3030C
GetAsyncKeyState.USER32(00000011), ref: 00B30324
GetKeyState.USER32(00000011), ref: 00B30336
GetAsyncKeyState.USER32(00000012), ref: 00B3034E
GetKeyState.USER32(00000012), ref: 00B30360
GetAsyncKeyState.USER32(0000005B), ref: 00B30378
GetKeyState.USER32(0000005B), ref: 00B3038A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7bc43b85ee33e862b594ca17788d8d2bea617dbb18e9870178aadefbc36a9548
Instruction ID: c8adc93a767c997359e0e10040d70548391fb7d83e71543f6542a33afb9f9324
Opcode Fuzzy Hash: 7bc43b85ee33e862b594ca17788d8d2bea617dbb18e9870178aadefbc36a9548
Instruction Fuzzy Hash: BD41BB645247CA6EFF31AA6498283B6FEE0EF15340F2840DDD9C6471C2EBD499C487A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B486D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

CoInitialize.OLE32 ref: 00B48718
CoUninitialize.OLE32 ref: 00B48723
CoCreateInstance.OLE32(?,00000000,00000017,00B62BEC,?), ref: 00B48783
IIDFromString.OLE32(?,?), ref: 00B487F6
VariantInit.OLEAUT32(?), ref: 00B48890
VariantClear.OLEAUT32(?), ref: 00B488F1

Strings

Failed to create object, xrefs: 00B4878E, 00B48844
Invalid parameter, xrefs: 00B4880F
NULL Pointer assignment, xrefs: 00B487C8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: eb273927c136da39647da07d06a4167e52adf6f237dd3a0db24025ea147b7c6f
Instruction ID: 6a502ac7dd529e2640ec942bfd5e1b8031c15e5f5026bb86b801d3fe29330127
Opcode Fuzzy Hash: eb273927c136da39647da07d06a4167e52adf6f237dd3a0db24025ea147b7c6f
Instruction Fuzzy Hash: 57619D70608311AFD710EF24C988B6FBBE4EF48714F104899F9859B2A1DB70EE44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B44458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B4447F
EmptyClipboard.USER32 ref: 00B44485
GlobalAlloc.KERNEL32(00000002,?), ref: 00B4449A
CloseClipboard.USER32 ref: 00B44539

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 393c33e5466b0209e87aa078b45d1cf796549689950a5a13d5a917deb74e321c
Instruction ID: 71cb6fbb17ee0f7ef8be14b1031d9db64c6a37197ebe2e1ca07faaf242a58949
Opcode Fuzzy Hash: 393c33e5466b0209e87aa078b45d1cf796549689950a5a13d5a917deb74e321c
Instruction Fuzzy Hash: B9217F35200221AFDB10AF64ED49B7AB7A8EF14711F1080AAF946DB2B1CF75AD11DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00B33A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AD48A1,?,?,00AD37C0,?), ref: 00AD48CE

Part of subcall function 00B34CD3: GetFileAttributesW.KERNEL32(?,00B33947), ref: 00B34CD4

FindFirstFileW.KERNEL32(?,?), ref: 00B33ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00B33B87
MoveFileW.KERNEL32(?,?), ref: 00B33B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00B33BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B33BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00B33BF5

Strings

\*.*, xrefs: 00B33A8A, 00B33A93, 00B33AA8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d9ea81b4e13086c877b3e513b7d2c6287873f0f4e0dd6a87f194a39ac3ecbd7b
Instruction ID: d4a2c4e47f74febb49f2f8cfcad79327b941eac8a1ae2d1f138e8b44b8f63fdc
Opcode Fuzzy Hash: d9ea81b4e13086c877b3e513b7d2c6287873f0f4e0dd6a87f194a39ac3ecbd7b
Instruction Fuzzy Hash: 9551403180525D9ACF15EBA0DE929FEB7F9AF14700F6441AAE442771A1EF316F09CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00B3F6AB
Sleep.KERNEL32(0000000A), ref: 00B3F6DB
_wcscmp.LIBCMT ref: 00B3F6EF
_wcscmp.LIBCMT ref: 00B3F70A
FindNextFileW.KERNEL32(?,?), ref: 00B3F7A8
FindClose.KERNEL32(00000000), ref: 00B3F7BE

Strings

*.*, xrefs: 00B3F690

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 39fed09e37ee454a47ee11dd66207bfc8440def37fd8d0cef3e48b3cf3590dff
Instruction ID: 9616fe5beb6766f5b41331a4a48c592a887674b616addc972266aeb5724dbc13
Opcode Fuzzy Hash: 39fed09e37ee454a47ee11dd66207bfc8440def37fd8d0cef3e48b3cf3590dff
Instruction Fuzzy Hash: 15412B71D0021A9BDF15EF64CD89AFEBBF4EF05350F2445A6E815A32A1EB309E44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AE4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00AE4520
VUUU, xrefs: 00AE44ED
VUUU, xrefs: 00AE44DB
ERCP, xrefs: 00AE421F
VUUU, xrefs: 00B17B0C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 084707f83d46cde881e055f037c5cd6fbcaa3cc60d89f207a292e987e710a147
Instruction ID: 16e535056cdece9b66a54e6bbc6f06cdfb1bb3c9334b94dada0297cd1ae3f9d1
Opcode Fuzzy Hash: 084707f83d46cde881e055f037c5cd6fbcaa3cc60d89f207a292e987e710a147
Instruction Fuzzy Hash: 50A27E70E0429ACBDF24CF59C9907EEB7B5FB58314F6481A9D856A7280DB309EC1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AE58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AE5A05
_memmove.LIBCMT ref: 00AE5A55
_memmove.LIBCMT ref: 00AE5ABB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f4f4dfe96e1e1bc765527b5d39ff22fb406be82fe41ebebc000cddcfdb73e40e
Instruction ID: f1c1cfa2f550e79fcf892ca352afd41793cd16708e95f1cb3ad1333f963d7a6f
Opcode Fuzzy Hash: f4f4dfe96e1e1bc765527b5d39ff22fb406be82fe41ebebc000cddcfdb73e40e
Instruction Fuzzy Hash: DF128970E00619DBDF14DFA5EA85AAEB7F5FF48304F108269E406A7292EB35AD11CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B28D0D
Part of subcall function 00B28CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B28D3A
Part of subcall function 00B28CC3: GetLastError.KERNEL32 ref: 00B28D47

ExitWindowsEx.USER32(?,00000000), ref: 00B3549B

Strings

@, xrefs: 00B3548E
SeShutdownPrivilege, xrefs: 00B3546B
, xrefs: 00B35489

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 765b6feb53dae8a0fcbf98f73ce8eed9af59f5beb8eb01d15a8a18768e597d93
Instruction ID: f224638e2e282303c3b0cf9b7b36339c3bd5e156d5a6723d76373b1a86d825bb
Opcode Fuzzy Hash: 765b6feb53dae8a0fcbf98f73ce8eed9af59f5beb8eb01d15a8a18768e597d93
Instruction Fuzzy Hash: DC01F771655B126AF73C6678EC8ABBBB2D8EB04753F3401E1FD4BD22D7EA915C808190

Uniqueness

Uniqueness Score: -1.00%

Function 00B46596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B465EF
WSAGetLastError.WSOCK32(00000000), ref: 00B465FE
bind.WSOCK32(00000000,?,00000010), ref: 00B4661A
listen.WSOCK32(00000000,00000005), ref: 00B46629
WSAGetLastError.WSOCK32(00000000), ref: 00B46643
closesocket.WSOCK32(00000000,00000000), ref: 00B46657

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 024cde72ab6543e902b3b9039d8de9da9af20830c6a299db831445a46828cc64
Instruction ID: ffd25791082ff86cca11ef6d2483c070a76b9af801ec8722bf4294fbcd36604c
Opcode Fuzzy Hash: 024cde72ab6543e902b3b9039d8de9da9af20830c6a299db831445a46828cc64
Instruction Fuzzy Hash: 1D21CE31200210AFCB00AF24D985BBEB7F9EF49321F11819AE956E73E1CB30AE019B51

Uniqueness

Uniqueness Score: -1.00%

Function 00AE5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00AF0FF6: std::exception::exception.LIBCMT ref: 00AF102C
Part of subcall function 00AF0FF6: __CxxThrowException@8.LIBCMT ref: 00AF1041

_memmove.LIBCMT ref: 00B2062F
_memmove.LIBCMT ref: 00B20744
_memmove.LIBCMT ref: 00B207EB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 97647c197972dd0578fe9252f85b2fdc7464b32642f5f9606109babd79aa4ec6
Instruction ID: 7fa29592190206c1aa4106b95e5c8fa80aeea3f45ce3b371341957125d86f381
Opcode Fuzzy Hash: 97647c197972dd0578fe9252f85b2fdc7464b32642f5f9606109babd79aa4ec6
Instruction Fuzzy Hash: 20028F70E00219DBCF04DF65E981AAEBBF5EF44300F1480A9E80ADB266EB35DD55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00AD19FA
GetSysColor.USER32(0000000F), ref: 00AD1A4E
SetBkColor.GDI32(?,00000000), ref: 00AD1A61

Part of subcall function 00AD1290: DefDlgProcW.USER32(?,00000020,?), ref: 00AD12D8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 54f08d848818c784a86a853b97690161845a8258a0778440efc7236e12f2a7a7
Instruction ID: 01202ad7f57ef264c6ebafe7c07d5c7c42ee8f5d65d8a14dcb9525a281d55c31
Opcode Fuzzy Hash: 54f08d848818c784a86a853b97690161845a8258a0778440efc7236e12f2a7a7
Instruction Fuzzy Hash: 84A12871105554BEE638AB295C98E7F3AEDDB42382F14019BF803D63E5DE24CD01D2B5

Uniqueness

Uniqueness Score: -1.00%

Function 00B46A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B480A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B480CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B46AB1
WSAGetLastError.WSOCK32(00000000), ref: 00B46ADA
bind.WSOCK32(00000000,?,00000010), ref: 00B46B13
WSAGetLastError.WSOCK32(00000000), ref: 00B46B20
closesocket.WSOCK32(00000000,00000000), ref: 00B46B34

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 03ff43c18e5f16382b646bb2a4926ef6f7813aab8fd5dc50016f82304d8a7626
Instruction ID: 71f66479e091c5434f399d62d7ce33d501ca8134adc49503b9328bb26647cc28
Opcode Fuzzy Hash: 03ff43c18e5f16382b646bb2a4926ef6f7813aab8fd5dc50016f82304d8a7626
Instruction Fuzzy Hash: FB41B675700610AFEB10BF24DD86F7E77E9EB49710F048099F91AAB3D2DA749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B555FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B5564C
IsWindowEnabled.USER32 ref: 00B5565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00B55667
IsIconic.USER32 ref: 00B55675
IsZoomed.USER32 ref: 00B55683

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 85260728880436aa8db1e36794b501adbcb88b93b6c73852d7cf2b9820afe328
Instruction ID: bca71d2ba2df8e2216e746f44dcd28e0ba7fc4200c4466a1054f5c2e02aa73d5
Opcode Fuzzy Hash: 85260728880436aa8db1e36794b501adbcb88b93b6c73852d7cf2b9820afe328
Instruction Fuzzy Hash: D011B232700A616FE7212F26DC64B6FB7D8EF54763B8140A9F806D7251CB70D902CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B11D88,?), ref: 00B4C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B4C324

Strings

kernel32.dll, xrefs: 00B4C30D
GetSystemWow64DirectoryW, xrefs: 00B4C31E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8ac47df87ba7541b5026b596c25ebf2664c824a1a3b858cee94d5c2b96c0256f
Instruction ID: 2dfadf961a00ec5d7d77a829c58ef67a309f563bcea16627163a107bbe557297
Opcode Fuzzy Hash: 8ac47df87ba7541b5026b596c25ebf2664c824a1a3b858cee94d5c2b96c0256f
Instruction Fuzzy Hash: D3E0EC74601713CFDB605F25D804F56BAD4EF08B56B8084F9E895D72A0EB70E840DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AE3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: c5e45754e7f5e4525e96a9971f01e206c8b33f67377277e1ce996c61e99369ef
Instruction ID: 0f67ab9aff8c1e7785251a23645bde8d798a986c2bcd9654336ba7cc1a08733d
Opcode Fuzzy Hash: c5e45754e7f5e4525e96a9971f01e206c8b33f67377277e1ce996c61e99369ef
Instruction Fuzzy Hash: FD22AA726083419FCB24DF25C995BABB7F4AF84300F10492DF99A97391DB70EA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B4F151
Process32FirstW.KERNEL32(00000000,?), ref: 00B4F15F

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Process32NextW.KERNEL32(00000000,?), ref: 00B4F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00B4F22E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 4de869343e7f8959d527a3d5e28b5122e967c32aa1efd87e494c84f682da2f89
Instruction ID: 34c42d5de2d12b82897cf442f494e5e7f24ca96d552a2c29bf205ea1199f0d66
Opcode Fuzzy Hash: 4de869343e7f8959d527a3d5e28b5122e967c32aa1efd87e494c84f682da2f89
Instruction Fuzzy Hash: 23515B71504711AFD310EF24DC85A6BBBE8FF98750F10496EF496972A1EB70EA04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B340B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B340D1
_memset.LIBCMT ref: 00B340F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00B34144
CloseHandle.KERNEL32(00000000), ref: 00B3414D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: e432114535e921f755c5e8cc988eb771c7792f13d33666e3bdcb2d5be7923b7d
Instruction ID: d91d5bee99499d247e146041ba970a9f32ff1bd79148198eae94736c5855832e
Opcode Fuzzy Hash: e432114535e921f755c5e8cc988eb771c7792f13d33666e3bdcb2d5be7923b7d
Instruction Fuzzy Hash: 1B11EB759013287AE7305BA59C4DFBBBBBCEF44760F1041D6F908E7180D6744E808BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B2EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B2EB19

Strings

|, xrefs: 00B2EB49
(, xrefs: 00B2EB5F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 66a0386200fbf597d6d64407d0725a899ed225890e4cc5762d36d49ff16fad6c
Instruction ID: c4b0820ce4487d3aa4c771da823ddf8cb9df9ad536798aeebe809ebe3ba4166b
Opcode Fuzzy Hash: 66a0386200fbf597d6d64407d0725a899ed225890e4cc5762d36d49ff16fad6c
Instruction Fuzzy Hash: F4323775A007159FDB28CF69D481A6AB7F0FF48310B15C5AEE8AADB3A1D770E941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B425E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00B426D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00B4270C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 38dd84647be38b4d7c9cf3b01c18e54c28b5f1c9618cfb5101ee3c275d16faa7
Instruction ID: 5c4009b7aefe7b438f6c742e3ac3d2388c357e66c08306db34d9de15115e8a6f
Opcode Fuzzy Hash: 38dd84647be38b4d7c9cf3b01c18e54c28b5f1c9618cfb5101ee3c275d16faa7
Instruction Fuzzy Hash: B341C371900209BFEB209B94DDC5EBBB7FCEB40764F5040EAFA01A6141EA719F41B664

Uniqueness

Uniqueness Score: -1.00%

Function 00B3B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B3B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B3B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00B3B655

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ac5d00fac418d0fae54c2f4ac2cc17e2989cbb399f510bc69b646f4f48c5ccf6
Instruction ID: 61d0e0059701654de65b1d87a49c1629f066aecbc68dfee0ecd9a8bec1a5b76b
Opcode Fuzzy Hash: ac5d00fac418d0fae54c2f4ac2cc17e2989cbb399f510bc69b646f4f48c5ccf6
Instruction Fuzzy Hash: B8216235A00618EFCB00EF65D885EAEFBF8FF48310F1480AAE945AB361DB319915CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B28CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AF0FF6: std::exception::exception.LIBCMT ref: 00AF102C
Part of subcall function 00AF0FF6: __CxxThrowException@8.LIBCMT ref: 00AF1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B28D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B28D3A
GetLastError.KERNEL32 ref: 00B28D47

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 664ec74687ab90104b42fdb8f12485e1e395e9e56c11a378cdb54c36b5910e06
Instruction ID: 5836743c69933348e19364a23b36644cc3581ba62f8a95a41f56884f4bbd96b4
Opcode Fuzzy Hash: 664ec74687ab90104b42fdb8f12485e1e395e9e56c11a378cdb54c36b5910e06
Instruction Fuzzy Hash: 3811BFB1414309AFE728AF64EC85D7BB7FCEB04711B24856EF44A87281EF30AC408B20

Uniqueness

Uniqueness Score: -1.00%

Function 00B34C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B34C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B34C43
FreeSid.ADVAPI32(?), ref: 00B34C53

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 9d7adb7ca34adc2e167d24487268124e1d560a984aea42eabf30b647cc3a56ba
Instruction ID: c73b297fea5acbac903e23d0a79ec47a2fdf86b3c9be21ae4ecd7c9e3d842d47
Opcode Fuzzy Hash: 9d7adb7ca34adc2e167d24487268124e1d560a984aea42eabf30b647cc3a56ba
Instruction Fuzzy Hash: C2F03775A11309BBDB04DFE09C89ABEBBB8EB08211F5444A9A902E2181E6706A048B50

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9856c896366ea244ecfda5f8789a3cea690d31e3177acf52ac989d7df3b8d845
Instruction ID: fb817854b4c81d0769d16902decf4c13d910e6863946b80e7389cb6327defec4
Opcode Fuzzy Hash: 9856c896366ea244ecfda5f8789a3cea690d31e3177acf52ac989d7df3b8d845
Instruction Fuzzy Hash: 01228A74A0021ADFDB24EF54C580ABEB7F0FF18310F1481AAE956AF351E735A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B3C966
FindClose.KERNEL32(00000000), ref: 00B3C996

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2935f2f592161bee8759394e3d8a900e4783705f488981abebd7e1f6529ae42a
Instruction ID: a0c18c217b161395fb4a15ff51f4e96e7b3dc468dc48a335e1b7cd806824f895
Opcode Fuzzy Hash: 2935f2f592161bee8759394e3d8a900e4783705f488981abebd7e1f6529ae42a
Instruction Fuzzy Hash: 0B115E726106109FD710EF29D845A2AF7E9FF85325F11865EF9AAD73A1DB30AC01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00B4977D,?,00B5FB84,?), ref: 00B3A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00B4977D,?,00B5FB84,?), ref: 00B3A314

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2a48577a5b4d5179c842060fb8802ab2d419cd6d1970554288ac8d3126940fba
Instruction ID: 1210a1c82bf33f4491e4397d5516c0556d303034ecb09b7656190067547b3234
Opcode Fuzzy Hash: 2a48577a5b4d5179c842060fb8802ab2d419cd6d1970554288ac8d3126940fba
Instruction Fuzzy Hash: 6CF0823554532DABEB20AFA4CC48FEA77ADFF08761F1081A6B909D7181DA309940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B28713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B28851), ref: 00B28728
CloseHandle.KERNEL32(?,?,00B28851), ref: 00B2873A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 2045dd346f5264ee241374150b11f0dc4b4500aa5bfee22e022b3dd31d41e530
Instruction ID: 4aa10d45f4c79a40aa85114c69a571bb841392cf0f5bcc81e1666689bf558d00
Opcode Fuzzy Hash: 2045dd346f5264ee241374150b11f0dc4b4500aa5bfee22e022b3dd31d41e530
Instruction Fuzzy Hash: D9E0B676011611EEEB252B60ED09E77BBE9EB043517248879B59681470DF62AC90DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00AFA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AF8F97,?,?,?,00000001), ref: 00AFA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00AFA3A3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bcb4e79cbe0ab646765808ed229d0736e4849658230f2b775465658b6f618c8d
Instruction ID: 273d3d48fe7a559b01c781d2ae6c3ed9746ebc0c03c676ff1b8393e95bfea56b
Opcode Fuzzy Hash: bcb4e79cbe0ab646765808ed229d0736e4849658230f2b775465658b6f618c8d
Instruction Fuzzy Hash: 40B0923105430AABEA002F91ED09BA9BF68EB44AA3F4040A0F60D86070CF6254508E99

Uniqueness

Uniqueness Score: -1.00%

Function 00AFF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc1e24a3fc52ccae3d5e7f64f327079c6c2b4dc6e6ec15e52e03e72e2c30be9
Instruction ID: 36dceea8538f1f14773d2921fc3a98f8b2d7866948205d21b2c5f66e30df234f
Opcode Fuzzy Hash: cdc1e24a3fc52ccae3d5e7f64f327079c6c2b4dc6e6ec15e52e03e72e2c30be9
Instruction Fuzzy Hash: 10321322D69F054DD7239635D832336A249AFB73D8F15D737F819B6AA6EF68C4834100

Uniqueness

Uniqueness Score: -1.00%

Function 00B0267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9a90f477e7b9597e87e85913f3c75aceb1e8ce7a6033c8d9809e0b649610de
Instruction ID: b040aab04ea0d81b23fb13d7025a0c7d7cb6df03c496c8722a7e39dd9c7f3d86
Opcode Fuzzy Hash: 1e9a90f477e7b9597e87e85913f3c75aceb1e8ce7a6033c8d9809e0b649610de
Instruction Fuzzy Hash: 33B11120D2AF404DD72396398835332BA9CAFBB2C5F51D71BFC2671EA2EF6685834541

Uniqueness

Uniqueness Score: -1.00%

Function 00B38B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00B38B25

Part of subcall function 00AF543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00B391F8,00000000,?,?,?,?,00B393A9,00000000,?), ref: 00AF5443
Part of subcall function 00AF543A: __aulldiv.LIBCMT ref: 00AF5463

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 0b9ef93d95c5fa8e7a9da0ee3ab09986b6d441d83c4b1735a02189a26fb03a20
Instruction ID: 69714f8c2ef148aec543c91cb3bbd89d7593fb9d655970675a9b73d1dfdd104c
Opcode Fuzzy Hash: 0b9ef93d95c5fa8e7a9da0ee3ab09986b6d441d83c4b1735a02189a26fb03a20
Instruction Fuzzy Hash: FA21D272635610CBC729CF25D441A52B3E1EBA4311F288E6DE1E5CB2D0CE75B905CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B441FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B44218

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 49665a35c2a0d8bacd4dbe1e731a0d5b158b0c4e652bb9fa4a0f78261549744c
Instruction ID: 7834c241c434ef8d10287fd3edf7bc69cabbcca8dcb254decf4c104e7176b2de
Opcode Fuzzy Hash: 49665a35c2a0d8bacd4dbe1e731a0d5b158b0c4e652bb9fa4a0f78261549744c
Instruction Fuzzy Hash: 90E012312502145FD710AF59D444B5AF7E8AF55761F008056F84AC7351DBB0E9419B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B34EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00B34F18

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 2bc2f758d30223299eef1871b1031f855dfec514598b5f0145d21f07d3505b1d
Instruction ID: e47132305648a37a9411ade434206af1ebaf9714607195a333c6a68011758d83
Opcode Fuzzy Hash: 2bc2f758d30223299eef1871b1031f855dfec514598b5f0145d21f07d3505b1d
Instruction Fuzzy Hash: 84D05EB016420539FC184B20AC0FF773188E341782FBC49C93209854C1AAF17800E034

Uniqueness

Uniqueness Score: -1.00%

Function 00B28C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00B288D1), ref: 00B28CB3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 47bd14ad2e6c11d47a36f2d09e0e748cdc693bb44edccf9529d6fe79c2e38aa4
Instruction ID: e542727ffa95d5bb8c59a8e50833fbcb02ab0db163abbe09461439257efb784e
Opcode Fuzzy Hash: 47bd14ad2e6c11d47a36f2d09e0e748cdc693bb44edccf9529d6fe79c2e38aa4
Instruction Fuzzy Hash: 0CD05E3226060EABEF018EA4DC01EBE3B69EB04B01F448111FE15C60A1C775D835AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B12230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B12242

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d10b6b73e7c326b55d1e081de11d4104f0a8b3585b85b407d8f0a7dd1224e103
Instruction ID: 256adbdc5195906bb5962f95de8b4df33489dca79bde25c4f7ad42beff16a83a
Opcode Fuzzy Hash: d10b6b73e7c326b55d1e081de11d4104f0a8b3585b85b407d8f0a7dd1224e103
Instruction Fuzzy Hash: 20C04CF1805109DBDB05DF90D988DFFB7BCAB04315F144495A101F2140D7749B448A71

Uniqueness

Uniqueness Score: -1.00%

Function 00AFA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00AFA36A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6e72838d77b091db182025cca1fdcdb562b75b257874f48c741b0ffd44af7a57
Instruction ID: 63d64a6c1f3e00515d1a3cf2b4382b34fd5f6107859b0cfd8071ecf8b7381a5a
Opcode Fuzzy Hash: 6e72838d77b091db182025cca1fdcdb562b75b257874f48c741b0ffd44af7a57
Instruction Fuzzy Hash: 25A0123000020DA78A002F41EC04454BF5CD6001917004060F40C410318B3254104984

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88337bc90626c6b505ba7d60de673178f34c69301b0224c082bb7f697b406af3
Instruction ID: e3bb108a1d16370bb85a93d37afe89567641a65d8774c59e1a0aa3e52898be19
Opcode Fuzzy Hash: 88337bc90626c6b505ba7d60de673178f34c69301b0224c082bb7f697b406af3
Instruction Fuzzy Hash: 0E2206305056A6CBCB388B16D4D467D77F1EB82344F3584AAD85E9B291DB3CDD81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 7fb4a519a38d913abde8fba8ab628a4e46668398059d69ba491be6d8ea3c3545
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D1C183322050974ADF6D47BA943423EBAE15AA27B131A075EF5F3CB5C4EF20D625D720

Uniqueness

Uniqueness Score: -1.00%

Function 00AF283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 9f3642387919acac3b20bdc0e078ab72bc7dfda27d06daa78a5eba3967b00515
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 57C1A33220519749DB2D47BA847413EBBE15BA27B131A076EF9F2DB4C4EF20D625E720

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 71f525b7c9a87275c32b2f32f4ffd5ff54b9c9c4a11e58a7230558c7de6e92ae
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 0CC1823221519789DF2D47BAD43403EBAE15AA27B131A076EF5F2CB5C4EF20D625D720

Uniqueness

Uniqueness Score: -1.00%

Function 00B47B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B47B70
DeleteObject.GDI32(00000000), ref: 00B47B82
DestroyWindow.USER32 ref: 00B47B90
GetDesktopWindow.USER32 ref: 00B47BAA
GetWindowRect.USER32(00000000), ref: 00B47BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00B47CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00B47D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47D4A
GetClientRect.USER32(00000000,?), ref: 00B47D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B47D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47DF8
GlobalFree.KERNEL32(00000000), ref: 00B47E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00B62CAC,00000000), ref: 00B47E2B
GlobalFree.KERNEL32(00000000), ref: 00B47E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00B47E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00B47E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B47EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B4808F

Strings

DISPLAY, xrefs: 00B47EF2
, xrefs: 00B48015
AutoIt v3, xrefs: 00B47D42
static, xrefs: 00B47D8A, 00B47EE1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: a146593823f70b0905fb15d81c3a4670cbd3f8dc3a80bdb916d9cec19b9da3ea
Instruction ID: 972d02bced61c1d58e245fe878ecc9ffc8fbee0511aa8e24387a4be6d855c254
Opcode Fuzzy Hash: a146593823f70b0905fb15d81c3a4670cbd3f8dc3a80bdb916d9cec19b9da3ea
Instruction Fuzzy Hash: 7C025D71900215EFDB14DFA4DD89EAEBBB9EF48311F148199F915AB2A1CB70DD01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B537F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00B5F910), ref: 00B538AF
IsWindowVisible.USER32(?), ref: 00B538D3

Strings

GETLINECOUNT, xrefs: 00B53B4E
ISVISIBLE, xrefs: 00B538BF
SETCURRENTSELECTION, xrefs: 00B53A3E
DELSTRING, xrefs: 00B539D1
GETLINE, xrefs: 00B53C23
CHECK, xrefs: 00B53AF5
SELECTSTRING, xrefs: 00B53A8E
HIDEDROPDOWN, xrefs: 00B53988
FINDSTRING, xrefs: 00B539FE
SHOWDROPDOWN, xrefs: 00B53968
GETCURRENTLINE, xrefs: 00B53B75
CURRENTTAB, xrefs: 00B53945
ISCHECKED, xrefs: 00B53AC1
TABRIGHT, xrefs: 00B53925
ISENABLED, xrefs: 00B538F3
GETCURRENTCOL, xrefs: 00B53BB0
UNCHECK, xrefs: 00B53B0B
TABLEFT, xrefs: 00B5390F
GETCURRENTSELECTION, xrefs: 00B53A6B
ADDSTRING, xrefs: 00B5399E
EDITPASTE, xrefs: 00B53BE7
SENDCOMMANDID, xrefs: 00B53C62
GETSELECTED, xrefs: 00B53B2B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3086ecaec0fa8f2c1aef4453fda39a2ae55879b77b6c523e900fad62d894933d
Instruction ID: b2891ff2b559af1ec02f206dc27aa9e7d56bdb140d794962752bb41d63f862f5
Opcode Fuzzy Hash: 3086ecaec0fa8f2c1aef4453fda39a2ae55879b77b6c523e900fad62d894933d
Instruction Fuzzy Hash: 0FD149312043199BCB24EF60C591F6AB7E1EF95785F1444D9BC865B3A3CB21EA0ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B5A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B5A89F
GetSysColorBrush.USER32(0000000F), ref: 00B5A8D0
GetSysColor.USER32(0000000F), ref: 00B5A8DC
SetBkColor.GDI32(?,000000FF), ref: 00B5A8F6
SelectObject.GDI32(?,?), ref: 00B5A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00B5A930
GetSysColor.USER32(00000010), ref: 00B5A938
CreateSolidBrush.GDI32(00000000), ref: 00B5A93F
FrameRect.USER32(?,?,00000000), ref: 00B5A94E
DeleteObject.GDI32(00000000), ref: 00B5A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00B5A9A0
FillRect.USER32(?,?,?), ref: 00B5A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00B5A9FD

Part of subcall function 00B5AB60: GetSysColor.USER32(00000012), ref: 00B5AB99
Part of subcall function 00B5AB60: SetTextColor.GDI32(?,?), ref: 00B5AB9D
Part of subcall function 00B5AB60: GetSysColorBrush.USER32(0000000F), ref: 00B5ABB3
Part of subcall function 00B5AB60: GetSysColor.USER32(0000000F), ref: 00B5ABBE
Part of subcall function 00B5AB60: GetSysColor.USER32(00000011), ref: 00B5ABDB
Part of subcall function 00B5AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B5ABE9
Part of subcall function 00B5AB60: SelectObject.GDI32(?,00000000), ref: 00B5ABFA
Part of subcall function 00B5AB60: SetBkColor.GDI32(?,00000000), ref: 00B5AC03
Part of subcall function 00B5AB60: SelectObject.GDI32(?,?), ref: 00B5AC10
Part of subcall function 00B5AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00B5AC2F
Part of subcall function 00B5AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B5AC46
Part of subcall function 00B5AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00B5AC5B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: ba435e4c12ea5face96d891d3fcb4ecbf2aaf23e12ae807fd15f4a9bb6f85e52
Instruction ID: 4807f29f2501b10035a09fdd2139bbfbedab8f91e4759f865484b3fbf09e7981
Opcode Fuzzy Hash: ba435e4c12ea5face96d891d3fcb4ecbf2aaf23e12ae807fd15f4a9bb6f85e52
Instruction Fuzzy Hash: 88A17071408302AFD7109F64DC48B6BBBE9FB88322F144BA9F952A71E0DB30D845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00AD2CA2
DeleteObject.GDI32(00000000), ref: 00AD2CE8
DeleteObject.GDI32(00000000), ref: 00AD2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00AD2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00AD2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00B0C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B0C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B0CAED

Part of subcall function 00AD1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AD2036,?,00000000,?,?,?,?,00AD16CB,00000000,?), ref: 00AD1B9A

SendMessageW.USER32(?,00001053), ref: 00B0CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B0CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00B0CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00B0CB62

Strings

0, xrefs: 00B0C981

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 5c8057ef16910519812d702391704bad02c21d457a42a82b06807a3b34f5a460
Instruction ID: 43658062dd9b81068584cf750f7082b7dcf36e37002918dd67388fcc93066129
Opcode Fuzzy Hash: 5c8057ef16910519812d702391704bad02c21d457a42a82b06807a3b34f5a460
Instruction Fuzzy Hash: E1128E30600201EFDB25CF24C984BA9BFE5FF55311F5446AAE996DB2A2CB31EC42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B477BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B477F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B478B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00B478EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00B47900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00B47946
GetClientRect.USER32(00000000,?), ref: 00B47952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00B47996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B479A5
GetStockObject.GDI32(00000011), ref: 00B479B5
SelectObject.GDI32(00000000,00000000), ref: 00B479B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00B479C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B479D2
DeleteDC.GDI32(00000000), ref: 00B479DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B47A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B47A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00B47A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B47A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B47A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00B47AAE
GetStockObject.GDI32(00000011), ref: 00B47AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B47AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00B47ACE

Strings

DISPLAY, xrefs: 00B4799B
msctls_progress32, xrefs: 00B47A4F
AutoIt v3, xrefs: 00B4793E
static, xrefs: 00B47990, 00B47AA8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 75f7a2fac45b8222dbb512c777d563f07a51ce6fa269a920e157de5fd43db6a7
Instruction ID: bab8009366b4b85ffea1510edc0f0ae010f5b3952242710d31e05742d403a1ce
Opcode Fuzzy Hash: 75f7a2fac45b8222dbb512c777d563f07a51ce6fa269a920e157de5fd43db6a7
Instruction Fuzzy Hash: 48A17E71A40219BFEB14DBA4DD4AFAFBBB9EB48711F004155FA15A72E1DB70AD00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B3AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B3AF89
GetDriveTypeW.KERNEL32(?,00B5FAC0,?,\\.\,00B5F910), ref: 00B3B066
SetErrorMode.KERNEL32(00000000,00B5FAC0,?,\\.\,00B5F910), ref: 00B3B1C4

Strings

iSCSI, xrefs: 00B3B169
Fibre, xrefs: 00B3B154
1394, xrefs: 00B3B146
Fixed, xrefs: 00B3B0AE
MMC, xrefs: 00B3B185
Unknown, xrefs: 00B3B086, 00B3B12A
SSA, xrefs: 00B3B14D
SATA, xrefs: 00B3B177
SAS, xrefs: 00B3B170
FileBackedVirtual, xrefs: 00B3B193
\\.\, xrefs: 00B3AFDB
PhysicalDrive, xrefs: 00B3B012
ATA, xrefs: 00B3B13F
SCSI, xrefs: 00B3B131
Virtual, xrefs: 00B3B18C
RAMDisk, xrefs: 00B3B090
SSD, xrefs: 00B3B0F1
ATAPI, xrefs: 00B3B138
CDROM, xrefs: 00B3B09A
USB, xrefs: 00B3B15B
RAID, xrefs: 00B3B162
Network, xrefs: 00B3B0A4
Removable, xrefs: 00B3B0B8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 1f9f5a6409fb2929eaf75ee2b2117402a8d2e2aeebd4153045572a6092a3bfd0
Instruction ID: 39f67595aaf821bef7ba1f3cb2669c8ca4ec79a4ad4bfd6326aeb390bb64def3
Opcode Fuzzy Hash: 1f9f5a6409fb2929eaf75ee2b2117402a8d2e2aeebd4153045572a6092a3bfd0
Instruction Fuzzy Hash: 00518434694B05AB9B04EB10CA92E7D73F1EB14741F3040D7E60AB72B4DBB5AD41DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00AD6A91
__wcsnicmp.LIBCMT ref: 00AD6AA9
__wcsnicmp.LIBCMT ref: 00AD6AC1
__wcsnicmp.LIBCMT ref: 00AD6AD9
__wcsnicmp.LIBCMT ref: 00AD6AF1
__wcsnicmp.LIBCMT ref: 00AD6B09
__wcsnicmp.LIBCMT ref: 00AD6B21
__wcsnicmp.LIBCMT ref: 00AD6B35
__wcsnicmp.LIBCMT ref: 00AD6B76
__wcsnicmp.LIBCMT ref: 00AD6B8A
__wcsnicmp.LIBCMT ref: 00AD6B9E
__wcsnicmp.LIBCMT ref: 00AD6BB2

Strings

Unterminated group of comments, xrefs: 00B0E82C
#include-once, xrefs: 00AD6AEB
#notrayicon, xrefs: 00AD6AA3
#comments-end, xrefs: 00AD6B98
#requireadmin, xrefs: 00AD6ABB
#OnAutoItStartRegister, xrefs: 00AD6AD3
#pragma compile, xrefs: 00AD6A8B
Bad directive syntax error, xrefs: 00B0E743
#ce, xrefs: 00AD6BAC
#include, xrefs: 00AD6B03
#cs, xrefs: 00AD6B2F, 00AD6B84
Cannot parse #include, xrefs: 00B0E819
#comments-start, xrefs: 00AD6B1B, 00AD6B70

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 10fdb5769f811503aaf7fbfe08f80b73ef2d34bd541d8397875137001037914e
Instruction ID: 39470aa07913badf078dac108eb01d9169e679ec5d4e3511e5bb2e1699364f15
Opcode Fuzzy Hash: 10fdb5769f811503aaf7fbfe08f80b73ef2d34bd541d8397875137001037914e
Instruction Fuzzy Hash: 67813D71640205BADB24BB60CE82FBE7BA8EF14740F044067FE57AB2D2EB61DE45C651

Uniqueness

Uniqueness Score: -1.00%

Function 00B5AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B5AB99
SetTextColor.GDI32(?,?), ref: 00B5AB9D
GetSysColorBrush.USER32(0000000F), ref: 00B5ABB3
GetSysColor.USER32(0000000F), ref: 00B5ABBE
CreateSolidBrush.GDI32(?), ref: 00B5ABC3
GetSysColor.USER32(00000011), ref: 00B5ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B5ABE9
SelectObject.GDI32(?,00000000), ref: 00B5ABFA
SetBkColor.GDI32(?,00000000), ref: 00B5AC03
SelectObject.GDI32(?,?), ref: 00B5AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00B5AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B5AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00B5AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B5ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B5ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00B5ACEC
DrawFocusRect.USER32(?,?), ref: 00B5ACF7
GetSysColor.USER32(00000011), ref: 00B5AD05
SetTextColor.GDI32(?,00000000), ref: 00B5AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00B5AD21
SelectObject.GDI32(?,00B5A869), ref: 00B5AD38
DeleteObject.GDI32(?), ref: 00B5AD43
SelectObject.GDI32(?,?), ref: 00B5AD49
DeleteObject.GDI32(?), ref: 00B5AD4E
SetTextColor.GDI32(?,?), ref: 00B5AD54
SetBkColor.GDI32(?,?), ref: 00B5AD5E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 021113a80422ea2217188714de6837bffda657ea6c1836986eb437cac744fb2e
Instruction ID: 90af68c230d11f997c43c7a6ee7710282302cc04ce6efdb5b3929abc5c17ff4e
Opcode Fuzzy Hash: 021113a80422ea2217188714de6837bffda657ea6c1836986eb437cac744fb2e
Instruction Fuzzy Hash: FE615071900219EFDF119FA4DC48FAEBBB9EB08321F1442A5F915BB2A1DA719D40DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B58C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B58D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B58D45
CharNextW.USER32(0000014E), ref: 00B58D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B58DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B58DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B58DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00B58DF9
SetWindowTextW.USER32(?,0000014E), ref: 00B58E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00B58E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B58E8C
_memset.LIBCMT ref: 00B58EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00B58EFA
_memset.LIBCMT ref: 00B58F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B58F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B58FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00B59088
InvalidateRect.USER32(?,00000000,00000001), ref: 00B590AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B590F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B59121
DrawMenuBar.USER32(?), ref: 00B59130
SetWindowTextW.USER32(?,0000014E), ref: 00B59158

Strings

0, xrefs: 00B590C2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 6ea618c932f24edcbba301190a94dd06cec2443db9fb997e21ab30f402c07d07
Instruction ID: fabaef655d14ccb0aa41db35231526d431fc639c3d3377a5c09003a4af06ea15
Opcode Fuzzy Hash: 6ea618c932f24edcbba301190a94dd06cec2443db9fb997e21ab30f402c07d07
Instruction Fuzzy Hash: D4E15E71900219AADF219F64CC84BFE7BF9EF05711F1081D9FE15AA291DB708A89DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00B54B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B54C51
GetDesktopWindow.USER32 ref: 00B54C66
GetWindowRect.USER32(00000000), ref: 00B54C6D
GetWindowLongW.USER32(?,000000F0), ref: 00B54CCF
DestroyWindow.USER32(?), ref: 00B54CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B54D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B54D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00B54D68
SendMessageW.USER32(?,00000421,?,?), ref: 00B54D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00B54D90
IsWindowVisible.USER32(?), ref: 00B54DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00B54DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00B54DDF
GetWindowRect.USER32(?,?), ref: 00B54DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00B54E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00B54E37
CopyRect.USER32(?,?), ref: 00B54E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00B54EB9

Strings

0, xrefs: 00B54BFC
(, xrefs: 00B54E2A
tooltips_class32, xrefs: 00B54D1D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6aae2d3568ba7e1ac0f11de811899a63981c23ac0002ad8df79654a39687903b
Instruction ID: 9ed37040fb54c46b53709d4091202e81198145cc26b9f46d4b59b9516de3d46d
Opcode Fuzzy Hash: 6aae2d3568ba7e1ac0f11de811899a63981c23ac0002ad8df79654a39687903b
Instruction Fuzzy Hash: F2B16A71604341AFDB04DF24C945B6ABBE4FF88315F00899DF99A9B2A1DB70DC49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B346D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B346E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B3470E
_wcscpy.LIBCMT ref: 00B3473C
_wcscmp.LIBCMT ref: 00B34747
_wcscat.LIBCMT ref: 00B3475D
_wcsstr.LIBCMT ref: 00B34768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B34784
_wcscat.LIBCMT ref: 00B347CD
_wcscat.LIBCMT ref: 00B347D4
_wcsncpy.LIBCMT ref: 00B347FF

Strings

%u.%u.%u.%u, xrefs: 00B34862
\VarFileInfo\Translation, xrefs: 00B3477C
DefaultLangCodepage, xrefs: 00B347E7
StringFileInfo\, xrefs: 00B34757
04090000, xrefs: 00B347BA

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: db5a4d083a835d2265d6dd3dc5c9fbe2e6311a4ce0aa65dc4ee0c38e5179c5ea
Instruction ID: 69a6b368233cb6eca578f22acda686e434ae309d8806bf246a8b5e0a36bea24a
Opcode Fuzzy Hash: db5a4d083a835d2265d6dd3dc5c9fbe2e6311a4ce0aa65dc4ee0c38e5179c5ea
Instruction Fuzzy Hash: 6A41E972600209BAEB10BBA48D43FBF77FCDF45710F1401A6FA05E6192EF75AA0197A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AD28BC
GetSystemMetrics.USER32(00000007), ref: 00AD28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AD28EF
GetSystemMetrics.USER32(00000008), ref: 00AD28F7
GetSystemMetrics.USER32(00000004), ref: 00AD291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AD2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AD2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AD297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AD2990
GetClientRect.USER32(00000000,000000FF), ref: 00AD29AE
GetStockObject.GDI32(00000011), ref: 00AD29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AD29D5

Part of subcall function 00AD2344: GetCursorPos.USER32(?), ref: 00AD2357
Part of subcall function 00AD2344: ScreenToClient.USER32(00B967B0,?), ref: 00AD2374
Part of subcall function 00AD2344: GetAsyncKeyState.USER32(00000001), ref: 00AD2399
Part of subcall function 00AD2344: GetAsyncKeyState.USER32(00000002), ref: 00AD23A7

SetTimer.USER32(00000000,00000000,00000028,00AD1256), ref: 00AD29FC

Strings

AutoIt v3 GUI, xrefs: 00AD2974

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 6f797746d0615d5aaa5103d0ae86ba2bb77a3806701585a8b32eba8de69613c3
Instruction ID: 6959fb0398b65533462152b18fbaacb573e4333d3e483392e981b7e33a93fc31
Opcode Fuzzy Hash: 6f797746d0615d5aaa5103d0ae86ba2bb77a3806701585a8b32eba8de69613c3
Instruction Fuzzy Hash: 47B15271A0020AEFDB14DFA8DD45BAE7BB4FB18315F10826AFA16D72E0DB749841CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00B54069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B540F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00B541B6

Strings

SELECTCLEAR, xrefs: 00B54235
ISSELECTED, xrefs: 00B541C1
VIEWCHANGE, xrefs: 00B54375
SELECTINVERT, xrefs: 00B54286
GETTEXT, xrefs: 00B5415F
DESELECT, xrefs: 00B542A4
SELECTALL, xrefs: 00B5421D
FINDITEM, xrefs: 00B54329
GETSUBITEMCOUNT, xrefs: 00B54141
SELECT, xrefs: 00B54250
GETITEMCOUNT, xrefs: 00B54128
GETSELECTED, xrefs: 00B542E4
GETSELECTEDCOUNT, xrefs: 00B54199

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 374479c23e59ba8218d3fa41bb71d37a14a6e64b4e5991232100cd8429ddc014
Instruction ID: 281fc05b09b60dc380f8d60ca618f19471c08ade71a5944f0a4bc87ca394c61a
Opcode Fuzzy Hash: 374479c23e59ba8218d3fa41bb71d37a14a6e64b4e5991232100cd8429ddc014
Instruction Fuzzy Hash: 9FA16E302142159FCB14EF20CA91F6AB7E5BF45319F1449E9B89A9B7A2DB30EC49CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B452F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00B45309
LoadCursorW.USER32(00000000,00007F8A), ref: 00B45314
LoadCursorW.USER32(00000000,00007F00), ref: 00B4531F
LoadCursorW.USER32(00000000,00007F03), ref: 00B4532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00B45335
LoadCursorW.USER32(00000000,00007F01), ref: 00B45340
LoadCursorW.USER32(00000000,00007F81), ref: 00B4534B
LoadCursorW.USER32(00000000,00007F88), ref: 00B45356
LoadCursorW.USER32(00000000,00007F80), ref: 00B45361
LoadCursorW.USER32(00000000,00007F86), ref: 00B4536C
LoadCursorW.USER32(00000000,00007F83), ref: 00B45377
LoadCursorW.USER32(00000000,00007F85), ref: 00B45382
LoadCursorW.USER32(00000000,00007F82), ref: 00B4538D
LoadCursorW.USER32(00000000,00007F84), ref: 00B45398
LoadCursorW.USER32(00000000,00007F04), ref: 00B453A3
LoadCursorW.USER32(00000000,00007F02), ref: 00B453AE
GetCursorInfo.USER32(?), ref: 00B453BE
GetLastError.KERNEL32(00000001,00000000), ref: 00B453E9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 07be97df1318ec957f1322b5194b66d981637fd1b3cfe2f2e0b85a00e78bcd4f
Instruction ID: 6b2462db604e8092c5849486d23153671f6a22468a9767d84c60c030b9db865c
Opcode Fuzzy Hash: 07be97df1318ec957f1322b5194b66d981637fd1b3cfe2f2e0b85a00e78bcd4f
Instruction Fuzzy Hash: C3418370E043196BDB209FBA8C4996FFFF8EF41B50B10452FF509E7291DAB895018E61

Uniqueness

Uniqueness Score: -1.00%

Function 00B2AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B2AAA5
__swprintf.LIBCMT ref: 00B2AB46
_wcscmp.LIBCMT ref: 00B2AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B2ABAE
_wcscmp.LIBCMT ref: 00B2ABEA
GetClassNameW.USER32(?,?,00000400), ref: 00B2AC21
GetDlgCtrlID.USER32(?), ref: 00B2AC73
GetWindowRect.USER32(?,?), ref: 00B2ACA9
GetParent.USER32(?), ref: 00B2ACC7
ScreenToClient.USER32(00000000), ref: 00B2ACCE
GetClassNameW.USER32(?,?,00000100), ref: 00B2AD48
_wcscmp.LIBCMT ref: 00B2AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00B2AD82
_wcscmp.LIBCMT ref: 00B2AD96

Part of subcall function 00AF386C: _iswctype.LIBCMT ref: 00AF3874

Strings

%s%u, xrefs: 00B2AB40

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 5122bce3af01df3034ca261f7435f6370562d98ba517d02283db119efcfef12b
Instruction ID: 513ae69425087dffca271315bc1f7dc36a65dc52a5edd802f065750cc7e14451
Opcode Fuzzy Hash: 5122bce3af01df3034ca261f7435f6370562d98ba517d02283db119efcfef12b
Instruction Fuzzy Hash: 23A1DD72204726ABDB14DF64D884BAAF7E8FF04355F1086A9F99DC2190DB30E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00B2B3DB
_wcscmp.LIBCMT ref: 00B2B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00B2B414
CharUpperBuffW.USER32(?,00000000), ref: 00B2B431
_wcscmp.LIBCMT ref: 00B2B44F
_wcsstr.LIBCMT ref: 00B2B460
GetClassNameW.USER32(00000018,?,00000400), ref: 00B2B498
_wcscmp.LIBCMT ref: 00B2B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00B2B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00B2B518
_wcscmp.LIBCMT ref: 00B2B528
GetClassNameW.USER32(00000010,?,00000400), ref: 00B2B550
GetWindowRect.USER32(00000004,?), ref: 00B2B5B9

Strings

ThumbnailClass, xrefs: 00B2B4A3, 00B2B523
@, xrefs: 00B2B3BC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 3ca6ba6a73099f50fca0f3b443c9bfb3217f82d0f14c3085983a2f676a52da2b
Instruction ID: 497ab6698be9ea970f8023a15fc7d313e5c3118fb67cf6dd095fcfefa77c3997
Opcode Fuzzy Hash: 3ca6ba6a73099f50fca0f3b443c9bfb3217f82d0f14c3085983a2f676a52da2b
Instruction Fuzzy Hash: F381C1720043169BDB05DF10E985FBABBE8EF54314F0885AAFD898A1A2DF34DD45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B2B23F

Strings

REGEXP=, xrefs: 00B2B254
ACTIVE, xrefs: 00B2B21A
[HANDLE:, xrefs: 00B2B24B
[ACTIVE, xrefs: 00B2B22C
[LAST, xrefs: 00B2B2EC
LAST, xrefs: 00B2B204
CLASSNAME=, xrefs: 00B2B27C
[ALL, xrefs: 00B2B2E5
HANDLE=, xrefs: 00B2B238
[CLASS:, xrefs: 00B2B28F
[REGEXPTITLE:, xrefs: 00B2B267
ALL, xrefs: 00B2B2D3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 8d88b8cc4a84f519e8285a2ba95ab6feb1d327272e00d4ffa215adf148fbaf79
Instruction ID: 8c2257a674e93456aaa30a137da33b6bf2c544e16ca6e70e3af50a2ef904e9a4
Opcode Fuzzy Hash: 8d88b8cc4a84f519e8285a2ba95ab6feb1d327272e00d4ffa215adf148fbaf79
Instruction Fuzzy Hash: AD31AD31A04319A6DF14FAA0DE83EFE7BE4AF10750F6401AAB456721F2FF616E04C651

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B2C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B2C4E6
SetWindowTextW.USER32(?,?), ref: 00B2C4FD
GetDlgItem.USER32(?,000003EA), ref: 00B2C512
SetWindowTextW.USER32(00000000,?), ref: 00B2C518
GetDlgItem.USER32(?,000003E9), ref: 00B2C528
SetWindowTextW.USER32(00000000,?), ref: 00B2C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B2C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B2C569
GetWindowRect.USER32(?,?), ref: 00B2C572
SetWindowTextW.USER32(?,?), ref: 00B2C5DD
GetDesktopWindow.USER32 ref: 00B2C5E3
GetWindowRect.USER32(00000000), ref: 00B2C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00B2C636
GetClientRect.USER32(?,?), ref: 00B2C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00B2C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B2C693

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: c70ab357e9d94c2f43c722feae0021e34d626e3d583eb183318318f66e783c8a
Instruction ID: 8043958aeaf973d2940a3a798f3041d781055d01caea0a3b8a25b5bf04bc8ae3
Opcode Fuzzy Hash: c70ab357e9d94c2f43c722feae0021e34d626e3d583eb183318318f66e783c8a
Instruction Fuzzy Hash: 10515D7190071AAFDB209FA8DE85B6FBBF5FF04705F004968E686A35A0DB75E904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B5A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B5A4C8
DestroyWindow.USER32(?,?), ref: 00B5A542

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B5A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B5A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B5A5F1
DestroyWindow.USER32(00000000), ref: 00B5A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AD0000,00000000), ref: 00B5A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B5A663
GetDesktopWindow.USER32 ref: 00B5A67C
GetWindowRect.USER32(00000000), ref: 00B5A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B5A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B5A6B3

Part of subcall function 00AD25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AD25EC

Strings

0, xrefs: 00B5A4DE
tooltips_class32, xrefs: 00B5A5B5, 00B5A643

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: b0b5597850d2ef397d45f3314181bc38724373f6d74b349533f040bccd78a6a7
Instruction ID: 5bd97314d930a51b74ae9e76b963df0b2fe6333669b45ae075645f6094045d9e
Opcode Fuzzy Hash: b0b5597850d2ef397d45f3314181bc38724373f6d74b349533f040bccd78a6a7
Instruction Fuzzy Hash: 2B719C75140305AFD721DF68DC49F6A7BE5FB88301F0846AEF985972A0DB70E906CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

DragQueryPoint.SHELL32(?,?), ref: 00B5C917

Part of subcall function 00B5ADF1: ClientToScreen.USER32(?,?), ref: 00B5AE1A
Part of subcall function 00B5ADF1: GetWindowRect.USER32(?,?), ref: 00B5AE90
Part of subcall function 00B5ADF1: PtInRect.USER32(?,?,00B5C304), ref: 00B5AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00B5C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B5C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B5C9AE
_wcscat.LIBCMT ref: 00B5C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B5C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00B5CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00B5CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00B5CA47
DragFinish.SHELL32(?), ref: 00B5CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B5CB41

Strings

@GUI_DRAGID, xrefs: 00B5CAB9
@GUI_DROPID, xrefs: 00B5CA6E
@GUI_DRAGFILE, xrefs: 00B5CAF0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: c0bc9619926e6822e93ef161d679ccc15472517c9416f2afca4b2dfce5c2d73b
Instruction ID: ccc5b468c76c50fab460ab1c811184bcc74063a6c1c91775c1454a3fcfff62a4
Opcode Fuzzy Hash: c0bc9619926e6822e93ef161d679ccc15472517c9416f2afca4b2dfce5c2d73b
Instruction Fuzzy Hash: F7614E71108301AFC711EF64CD85E9FBBE9EF88751F0009AEF592972A1DB709949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B54619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B546AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B546F6

Strings

GETTOTALCOUNT, xrefs: 00B546DD
ISCHECKED, xrefs: 00B54879
SELECT, xrefs: 00B548A7
CHECK, xrefs: 00B54716
UNCHECK, xrefs: 00B548D2
EXPAND, xrefs: 00B547A8
GETITEMCOUNT, xrefs: 00B547D8
GETTEXT, xrefs: 00B54849
EXISTS, xrefs: 00B5475F
COLLAPSE, xrefs: 00B5473C
GETSELECTED, xrefs: 00B54806

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: f513fea315b68c5676856d603ad8c1dc3cb77669c7994067b20e39cf3cd42362
Instruction ID: b415fb4dadcce09b8fca509f6919aa62f431d9b2b14ee0e1395b92930a17c6d2
Opcode Fuzzy Hash: f513fea315b68c5676856d603ad8c1dc3cb77669c7994067b20e39cf3cd42362
Instruction Fuzzy Hash: 80915C352047159FCB14EF20C591B6AB7E1AF99358F0448DDBC9A5B3A2DB30ED4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B5BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B5BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00B59431), ref: 00B5BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B5BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B5BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B5BC7D
FreeLibrary.KERNEL32(?), ref: 00B5BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B5BC99
DestroyIcon.USER32(?,?,?,?,?,00B59431), ref: 00B5BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B5BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B5BCD1

Part of subcall function 00AF313D: __wcsicmp_l.LIBCMT ref: 00AF31C6

Strings

.icl, xrefs: 00B5BAE4
.dll, xrefs: 00B5BB27
.exe, xrefs: 00B5BB04

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: e83c36091e920d774c652c0b345ce84e2b785675e32e21c3bb675826fcd732f0
Instruction ID: 1a16235eee72fdd9d487f876c4bcb95284e71b892fb1a7d1c380039c4fd14fcd
Opcode Fuzzy Hash: e83c36091e920d774c652c0b345ce84e2b785675e32e21c3bb675826fcd732f0
Instruction Fuzzy Hash: 3C61D171900619BAEB14DF64CD85FBE7BE8EB08712F104199FD15D61D0DBB4AD84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

CharLowerBuffW.USER32(?,?), ref: 00B3A636
GetDriveTypeW.KERNEL32 ref: 00B3A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B3A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B3A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B3A730

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Strings

wait, xrefs: 00B3A6ED
set cd door , xrefs: 00B3A6D1
open , xrefs: 00B3A692
closed, xrefs: 00B3A64A, 00B3A653
close, xrefs: 00B3A63C
open, xrefs: 00B3A65D
close cd wait, xrefs: 00B3A71B
type cdaudio alias cd wait, xrefs: 00B3A6AE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: b7f9c43e40f276f3872d892ca1687f74637721626e5e14980218d35f6f7ae1e2
Instruction ID: a58b10bff4ebbed780b5c8cf02ae4aaf12a3c9d5c57d52b4253c3780d38bef78
Opcode Fuzzy Hash: b7f9c43e40f276f3872d892ca1687f74637721626e5e14980218d35f6f7ae1e2
Instruction Fuzzy Hash: C4513A711043059FC704EF20C99196AB7F8FF98758F1449AEF89657261EB31EE0ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B3A47A
__swprintf.LIBCMT ref: 00B3A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B3A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B3A4FE
_memset.LIBCMT ref: 00B3A51D
_wcsncpy.LIBCMT ref: 00B3A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B3A58E
CloseHandle.KERNEL32(00000000), ref: 00B3A599
RemoveDirectoryW.KERNEL32(?), ref: 00B3A5A2
CloseHandle.KERNEL32(00000000), ref: 00B3A5AC

Strings

:, xrefs: 00B3A4BD
\??\%s, xrefs: 00B3A496
\, xrefs: 00B3A4B2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 6a86ac3a8db1c9c2398962f5d6198f641ddf6875579b8f44ad36adfd22856f2b
Instruction ID: b82e674b76c6cfb835c6662bac859ab2efd132f5f1e0116eafd630601c08cccf
Opcode Fuzzy Hash: 6a86ac3a8db1c9c2398962f5d6198f641ddf6875579b8f44ad36adfd22856f2b
Instruction Fuzzy Hash: 513162B550021AABDB219FA0DC49FFB77BCEF88701F2041F6F648D6160EB7096458B25

Uniqueness

Uniqueness Score: -1.00%

Function 00B3DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00B3DC7B
_wcscat.LIBCMT ref: 00B3DC93
_wcscat.LIBCMT ref: 00B3DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B3DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 00B3DCCE
GetFileAttributesW.KERNEL32(?), ref: 00B3DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B3DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 00B3DD12

Strings

*.*, xrefs: 00B3DD51

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: c458070890708222c2af6e078234ebf3054668175604bece4b98fe9977b2d6f2
Instruction ID: 88a013b765d1199187bee77fc3310b22086fc27c6ec3e7e480edcfcdc9564c0c
Opcode Fuzzy Hash: c458070890708222c2af6e078234ebf3054668175604bece4b98fe9977b2d6f2
Instruction Fuzzy Hash: DD8181715143419FCB24EF24D8859AAF7E8FB88310F658CAEF885C7250EB30D945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B5C4EC
GetFocus.USER32 ref: 00B5C4FC
GetDlgCtrlID.USER32(00000000), ref: 00B5C507
_memset.LIBCMT ref: 00B5C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B5C65D
GetMenuItemCount.USER32(?), ref: 00B5C67D
GetMenuItemID.USER32(?,00000000), ref: 00B5C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B5C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B5C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B5C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00B5C779

Strings

0, xrefs: 00B5C62A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 93e4f8e33fb0a7844330e0542ba5a199b95c42f1df78e5b570d7fe2d023ce11c
Instruction ID: 4a8ec1aeefaf476ee1f47b9542f3f56bfea426493c47007c2cd57e6cec20581d
Opcode Fuzzy Hash: 93e4f8e33fb0a7844330e0542ba5a199b95c42f1df78e5b570d7fe2d023ce11c
Instruction Fuzzy Hash: 28819C702083019FDB10CF24D984B6BBBEAEB98356F1045AEFD9597291DB70DD09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B283F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B28766
Part of subcall function 00B2874A: GetLastError.KERNEL32(?,00B2822A,?,?,?), ref: 00B28770
Part of subcall function 00B2874A: GetProcessHeap.KERNEL32(00000008,?,?,00B2822A,?,?,?), ref: 00B2877F
Part of subcall function 00B2874A: HeapAlloc.KERNEL32(00000000,?,00B2822A,?,?,?), ref: 00B28786
Part of subcall function 00B2874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2879D

Part of subcall function 00B287E7: GetProcessHeap.KERNEL32(00000008,00B28240,00000000,00000000,?,00B28240,?), ref: 00B287F3
Part of subcall function 00B287E7: HeapAlloc.KERNEL32(00000000,?,00B28240,?), ref: 00B287FA
Part of subcall function 00B287E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B28240,?), ref: 00B2880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B28458
_memset.LIBCMT ref: 00B2846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B2848C
GetLengthSid.ADVAPI32(?), ref: 00B2849D
GetAce.ADVAPI32(?,00000000,?), ref: 00B284DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B284F6
GetLengthSid.ADVAPI32(?), ref: 00B28513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B28522
HeapAlloc.KERNEL32(00000000), ref: 00B28529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B2854A
CopySid.ADVAPI32(00000000), ref: 00B28551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B28582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B285A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B285BC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e9dc053605bd0c9268844f4adf4801ad880391526c5c4d280d169ddf3dc082cb
Instruction ID: 28323bc016d73637269328cd419806286a80a6ffb7d59f97ce0b5c5d6a5ce365
Opcode Fuzzy Hash: e9dc053605bd0c9268844f4adf4801ad880391526c5c4d280d169ddf3dc082cb
Instruction Fuzzy Hash: 2461507190121AAFDF01DF94EC45AEEBBB9FF04311F0882A9F919A7291DB359A05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B476A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00B476AE
CreateCompatibleDC.GDI32(?), ref: 00B476BA
SelectObject.GDI32(00000000,?), ref: 00B476C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00B4771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00B47757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00B4777B
SelectObject.GDI32(00000006,?), ref: 00B47783
DeleteObject.GDI32(?), ref: 00B4778C
DeleteDC.GDI32(00000006), ref: 00B47793
ReleaseDC.USER32(00000000,?), ref: 00B4779E

Strings

(, xrefs: 00B47723

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2a95463e891067254fbec8c2c975224958046ea460e94dc9c5a225059342c02f
Instruction ID: 9fc1cedb482f81e2430c3453482679ec4b0bcba944b21e1da97da1cf690dd821
Opcode Fuzzy Hash: 2a95463e891067254fbec8c2c975224958046ea460e94dc9c5a225059342c02f
Instruction Fuzzy Hash: 1D513675904309EFCB15CFA8CC85EAEBBF9EF48710F148569F94AA7250DB31A940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00B5FB78), ref: 00B3A0FC

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00B3A11E
__swprintf.LIBCMT ref: 00B3A177
__swprintf.LIBCMT ref: 00B3A190
_wprintf.LIBCMT ref: 00B3A246
_wprintf.LIBCMT ref: 00B3A264

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00B3A241
Error: , xrefs: 00B3A20E
^ ERROR, xrefs: 00B3A1E8
Line %d (File "%s"):, xrefs: 00B3A171, 00B3A18A
"%s" (%d) : ==> %s:, xrefs: 00B3A25F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: ec075918d3e44b752e34e51de5ee10c704d89b585892e825559c0105ee7b3f19
Instruction ID: 40c4d8c3835a546c4f813de7fc5290f8c50e35198206f9aefb872ac339867548
Opcode Fuzzy Hash: ec075918d3e44b752e34e51de5ee10c704d89b585892e825559c0105ee7b3f19
Instruction Fuzzy Hash: 52515571900519AACF15EBE0CE86EEEB7B9EF04300F2401A6F516731A1EB316F58DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00AF0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00AD6C6C,?,00008000), ref: 00AF0BB7

Part of subcall function 00AD48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AD48A1,?,?,00AD37C0,?), ref: 00AD48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AD6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD6E5A

Part of subcall function 00AD59CD: _wcscpy.LIBCMT ref: 00AD5A05

Part of subcall function 00AF387D: _iswctype.LIBCMT ref: 00AF3885

Strings

EA06, xrefs: 00B0E87B
Bad directive syntax error, xrefs: 00B0EBC6
>>>AUTOIT SCRIPT<<<, xrefs: 00B0E8BF
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00B0E84A
Error opening the file, xrefs: 00B0E866, 00B0E8E1
AU3!, xrefs: 00AD6CC1
Unterminated string, xrefs: 00B0EC0D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: b57ec6ba48c21d5e329b8860771a6feb2108f9bee607cc0e2af6ed26a15f50c9
Instruction ID: 02b048dc72ff8e339701bc7b2e4d2c1bf07c88a579455d2f91f59526ce4a2e8e
Opcode Fuzzy Hash: b57ec6ba48c21d5e329b8860771a6feb2108f9bee607cc0e2af6ed26a15f50c9
Instruction Fuzzy Hash: 2302AA315083419FC724EF24C991AAFBBE5EF88354F14496EF49A972A1DB30E949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00AD45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD45F9
GetMenuItemCount.USER32(00B96890), ref: 00B0D7CD
GetMenuItemCount.USER32(00B96890), ref: 00B0D87D
GetCursorPos.USER32(?), ref: 00B0D8C1
SetForegroundWindow.USER32(00000000), ref: 00B0D8CA
TrackPopupMenuEx.USER32(00B96890,00000000,?,00000000,00000000,00000000), ref: 00B0D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B0D8E9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 0d15914264c1089612cd0586faab0968f36cba7e14b635995ece361a27cc15cb
Instruction ID: 8601c0af3cb5487ee7ac4cccea2b0d6e8a89b6e39f322be68aaacbbb8820b52d
Opcode Fuzzy Hash: 0d15914264c1089612cd0586faab0968f36cba7e14b635995ece361a27cc15cb
Instruction Fuzzy Hash: 9171E470640206BBEB219F54DC89FAAFFA4FF05364F204256F516A61E1DBB1AC10DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B510A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B50038,?,?), ref: 00B510BC

Strings

HKEY_CURRENT_USER, xrefs: 00B5119B
HKU, xrefs: 00B511CE
HKEY_CURRENT_CONFIG, xrefs: 00B51179
HKCR, xrefs: 00B51164
HKCU, xrefs: 00B511AC
HKEY_LOCAL_MACHINE, xrefs: 00B51125
HKLM, xrefs: 00B5113A
HKEY_USERS, xrefs: 00B511BD
HKEY_CLASSES_ROOT, xrefs: 00B5114F
HKCC, xrefs: 00B5118A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: ec12aea9a55d86ffc03b8478d8288af340701858a0bf709b72256f2db3a9d51f
Instruction ID: 453b961b6dbd0e22f485e6e79e285825649d185127fa1ef98ebed8a5a28c7e9d
Opcode Fuzzy Hash: ec12aea9a55d86ffc03b8478d8288af340701858a0bf709b72256f2db3a9d51f
Instruction Fuzzy Hash: 47412B3115024E8BCF20EFA4D995FEA37A4EF16341F5048D5FD916B2A2DB31A91ACB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B35569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Part of subcall function 00AD7A84: _memmove.LIBCMT ref: 00AD7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B355D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B355E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B355F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B3560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B3561C

Strings

open , xrefs: 00B35581
play PlayMe, xrefs: 00B35617
alias PlayMe, xrefs: 00B355AB
close PlayMe, xrefs: 00B355E3, 00B35610
status PlayMe mode, xrefs: 00B355CD
play PlayMe wait, xrefs: 00B35606

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 7a372d826d6e95e6c9775cb12604d62e3efba29d0d04c6e0eae93e3dbe050fcc
Instruction ID: b1f8e3d9f8980b92f91d8d472226ce7f9e16dbcb5274b3ff9224cef159aaf3d4
Opcode Fuzzy Hash: 7a372d826d6e95e6c9775cb12604d62e3efba29d0d04c6e0eae93e3dbe050fcc
Instruction Fuzzy Hash: BA11942095016979E724B661CC8ADFFBBBCFF95B40F5004ABB402A21F1EE601E05CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B348F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B3490E
gethostname.WSOCK32(?,00000100), ref: 00B34928
gethostbyname.WSOCK32(?), ref: 00B34935
_wcscpy.LIBCMT ref: 00B3495D
_memmove.LIBCMT ref: 00B34970
inet_ntoa.WSOCK32(?), ref: 00B3497B
_strcat.LIBCMT ref: 00B34989
_wcscpy.LIBCMT ref: 00B349A0
WSACleanup.WSOCK32 ref: 00B349AE
_wcscpy.LIBCMT ref: 00B349BC

Strings

0.0.0.0, xrefs: 00B34957

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 6241e318797fa5a6eaf46552162e4cdf1ed1b1f20ea59ea4d783144c8a16bd93
Instruction ID: 674827ebcd2b7d948530bfa1b6682de2241aed973b80f1787d8aad67784d9088
Opcode Fuzzy Hash: 6241e318797fa5a6eaf46552162e4cdf1ed1b1f20ea59ea4d783144c8a16bd93
Instruction Fuzzy Hash: 5011C331904219AFCB20AB64AD4AFEB77ECDB04721F1402F6F504960A1EF71AE818751

Uniqueness

Uniqueness Score: -1.00%

Function 00B35217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B3521C

Part of subcall function 00AF0719: timeGetTime.WINMM(?,75A8B400,00AE0FF9), ref: 00AF071D

Sleep.KERNEL32(0000000A), ref: 00B35248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00B3526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B3528E
SetActiveWindow.USER32 ref: 00B352AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B352BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B352DA
Sleep.KERNEL32(000000FA), ref: 00B352E5
IsWindow.USER32 ref: 00B352F1
EndDialog.USER32(00000000), ref: 00B35302

Strings

BUTTON, xrefs: 00B35280

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 7022274b00a9f628038e7a52dbc0872ae5b1b158409639024cc14e00b73994a7
Instruction ID: 66f013523f183eaae2ae8e8f4dce3ec3fb8776fb35dd35ff889289c1baedca14
Opcode Fuzzy Hash: 7022274b00a9f628038e7a52dbc0872ae5b1b158409639024cc14e00b73994a7
Instruction Fuzzy Hash: D9218070154705AFE7105B70EE88B36BBE9EB66347F2104A9F50293171DE719C04C721

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

CoInitialize.OLE32(00000000), ref: 00B3D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B3D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00B3D8FC
CoCreateInstance.OLE32(00B62D7C,00000000,00000001,00B8A89C,?), ref: 00B3D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B3D9B7
CoTaskMemFree.OLE32(?,?), ref: 00B3DA0F
_memset.LIBCMT ref: 00B3DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00B3DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B3DAAB
CoTaskMemFree.OLE32(00000000), ref: 00B3DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00B3DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00B3DAEB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 4f9d57def88d9e4a8db593855aaa97bd66a0743de27bf4e9b0b771c7a38903d4
Instruction ID: 42705236d1f6df2df7f0bf250a3868468eb8d0084c70347e3f25be4bfe47e55d
Opcode Fuzzy Hash: 4f9d57def88d9e4a8db593855aaa97bd66a0743de27bf4e9b0b771c7a38903d4
Instruction Fuzzy Hash: 9BB1DC75A00209AFDB04DFA4D984EAEBBF9EF48304F1484A9F506EB261DB30ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B305A7
SetKeyboardState.USER32(?), ref: 00B30612
GetAsyncKeyState.USER32(000000A0), ref: 00B30632
GetKeyState.USER32(000000A0), ref: 00B30649
GetAsyncKeyState.USER32(000000A1), ref: 00B30678
GetKeyState.USER32(000000A1), ref: 00B30689
GetAsyncKeyState.USER32(00000011), ref: 00B306B5
GetKeyState.USER32(00000011), ref: 00B306C3
GetAsyncKeyState.USER32(00000012), ref: 00B306EC
GetKeyState.USER32(00000012), ref: 00B306FA
GetAsyncKeyState.USER32(0000005B), ref: 00B30723
GetKeyState.USER32(0000005B), ref: 00B30731

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2260e161d8cfa18e3ca0bf095317667f5d3575344f7347e0d33f6ec2fb217781
Instruction ID: 6ef3e9dbcf194f06af2f02c50f4a36fae2bcfff53c2e12b8b8858632b2e9824e
Opcode Fuzzy Hash: 2260e161d8cfa18e3ca0bf095317667f5d3575344f7347e0d33f6ec2fb217781
Instruction Fuzzy Hash: 22512A20A1478829FB34FBB488617EABFF4DF11380F2845D9C5C2571C2DA64AB4CCB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B2C746
GetWindowRect.USER32(00000000,?), ref: 00B2C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00B2C7B6
GetDlgItem.USER32(?,00000002), ref: 00B2C7C1
GetWindowRect.USER32(00000000,?), ref: 00B2C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00B2C827
GetDlgItem.USER32(?,000003E9), ref: 00B2C835
GetWindowRect.USER32(00000000,?), ref: 00B2C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00B2C889
GetDlgItem.USER32(?,000003EA), ref: 00B2C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B2C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00B2C8C1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7782b9f4626d3926e15ac0653be9cc48a2958e76ad5c4246dc39e195fdad6396
Instruction ID: 4c0ec54825ef4e8b7dd3d9470ac4748da713fedf98f178eaaa46cb45064c8116
Opcode Fuzzy Hash: 7782b9f4626d3926e15ac0653be9cc48a2958e76ad5c4246dc39e195fdad6396
Instruction Fuzzy Hash: 00512F71B00205ABDB18CF69DD99BBEBBBAEB88311F14816DF519D72A0DB709D00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AD2036,?,00000000,?,?,?,?,00AD16CB,00000000,?), ref: 00AD1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00AD20D3
KillTimer.USER32(-00000001,?,?,?,?,00AD16CB,00000000,?,?,00AD1AE2,?,?), ref: 00AD216E
DestroyAcceleratorTable.USER32(00000000), ref: 00B0BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AD16CB,00000000,?,?,00AD1AE2,?,?), ref: 00B0BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AD16CB,00000000,?,?,00AD1AE2,?,?), ref: 00B0BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AD16CB,00000000,?,?,00AD1AE2,?,?), ref: 00B0BF5A
DeleteObject.GDI32(00000000), ref: 00B0BF6C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: cf080fa1b551fb44ad0d8cd4b4d0c8281f0a8c4c1ba6660bb21f5306085c64df
Instruction ID: aec18b3c91a5d8119ae50406f797ffefef57c476be745b866f0bceea26315df5
Opcode Fuzzy Hash: cf080fa1b551fb44ad0d8cd4b4d0c8281f0a8c4c1ba6660bb21f5306085c64df
Instruction Fuzzy Hash: 05615931500612DFCB25AF14DE88B2ABBF1FB64316F1485ABE54397AA0CB75AC81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00AD25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AD25EC

GetSysColor.USER32(0000000F), ref: 00AD21D3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d324767452fce9cec25b4ec971e887d952eb0dc4034bb4287bfbe88c56f07a80
Instruction ID: 0cc7b3dcf6a22983be38d040706d99ff5bfb57938eae74dc7ebe39f375d926ab
Opcode Fuzzy Hash: d324767452fce9cec25b4ec971e887d952eb0dc4034bb4287bfbe88c56f07a80
Instruction Fuzzy Hash: 9341A4310046409FDB215F28EC88BF97BA5EB16331F1443A6FD669B2E6CB318C42DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B3AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00B5F910), ref: 00B3AB76
GetDriveTypeW.KERNEL32(00000061,00B8A620,00000061), ref: 00B3AC40
_wcscpy.LIBCMT ref: 00B3AC6A

Strings

cdrom, xrefs: 00B3AB92
network, xrefs: 00B3ABD4
unknown, xrefs: 00B3AC01
removable, xrefs: 00B3ABA8
all, xrefs: 00B3AB7C
ramdisk, xrefs: 00B3ABEA
fixed, xrefs: 00B3ABBE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 65ed4f865687ffc23c37511784d5f953dc78cc2764599dba74454405a504462a
Instruction ID: 6cbec29f2a8cf5e7595a1d4ca29439775c21e7afaf4624527c38f295716e7390
Opcode Fuzzy Hash: 65ed4f865687ffc23c37511784d5f953dc78cc2764599dba74454405a504462a
Instruction Fuzzy Hash: 0E51AA311083019FC724EF14C991AAEB7E5EF95300F6048AEF5D6972A2EB31D94ACB53

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00AD99C2
__swprintf.LIBCMT ref: 00AD9A0C
__i64tow.LIBCMT ref: 00B0FA0F

Strings

False, xrefs: 00B0F9D7
True, xrefs: 00B0F9D0
%.15g, xrefs: 00AD9A06
0x%p, xrefs: 00B0F9F1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4e23630b2469825d0a5c98d834b553c312f9338092e2b721b809a165629032f1
Instruction ID: 27aa88a724f6f5ae56ea8259b3668d6918ea6534386a44a8a940c1119d37d911
Opcode Fuzzy Hash: 4e23630b2469825d0a5c98d834b553c312f9338092e2b721b809a165629032f1
Instruction Fuzzy Hash: E241847160460AAEDB34AB74D942E7B77F8EB44300F2444AFF64AD73A1EA71D941CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B573C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B573D9
CreateMenu.USER32 ref: 00B573F4
SetMenu.USER32(?,00000000), ref: 00B57403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B57490
IsMenu.USER32(?), ref: 00B574A6
CreatePopupMenu.USER32 ref: 00B574B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B574DD
DrawMenuBar.USER32 ref: 00B574E5

Strings

F, xrefs: 00B574D1
0, xrefs: 00B573CF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 2d3801521007a66f8c2c5d6ae3966426adfa91dbee4ea8a0bc3b1c74813b56b9
Instruction ID: 2ca24b8d1bedfc55fab6a84b7a8f2b63a9ac1a256baefbfe2a3a463ed0509d44
Opcode Fuzzy Hash: 2d3801521007a66f8c2c5d6ae3966426adfa91dbee4ea8a0bc3b1c74813b56b9
Instruction Fuzzy Hash: D2416775A00249EFDB10DF64E884FAABBF5FF09342F1440A9EE0597360DB30A914CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B5772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B577CD
CreateCompatibleDC.GDI32(00000000), ref: 00B577D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B577E7
SelectObject.GDI32(00000000,00000000), ref: 00B577EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B577FA
DeleteDC.GDI32(00000000), ref: 00B57803
GetWindowLongW.USER32(?,000000EC), ref: 00B5780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00B57821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00B5782D

Strings

static, xrefs: 00B57765

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 34972d060755f0915d4b7b2d8e39f81e7b541abfa1e8bc9e15d0dbd084af1275
Instruction ID: 61a8983172a664dcb3615320523aae88bad0990159ca5b1c72fd6d1ab429848f
Opcode Fuzzy Hash: 34972d060755f0915d4b7b2d8e39f81e7b541abfa1e8bc9e15d0dbd084af1275
Instruction Fuzzy Hash: 42318E31205215ABDF125F65EC09FEB7BA9EF0D322F1002A5FA15A61A0DB31D815DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AF7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AF707B

Part of subcall function 00AF8D68: __getptd_noexit.LIBCMT ref: 00AF8D68

__gmtime64_s.LIBCMT ref: 00AF7114
__gmtime64_s.LIBCMT ref: 00AF714A
__gmtime64_s.LIBCMT ref: 00AF7167
__allrem.LIBCMT ref: 00AF71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF71D9
__allrem.LIBCMT ref: 00AF71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF720E
__allrem.LIBCMT ref: 00AF7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF7243
__invoke_watson.LIBCMT ref: 00AF72B4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 7c3f95580cc1d875af80536f3a7399e2ef1e547f596e75387f04b89446f579ff
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: A671A571A0471AABE7149FB9CC41BBEB7F8AF14720F14427AF614D62C1EB70DA508790

Uniqueness

Uniqueness Score: -1.00%

Function 00B32A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B32A31
GetMenuItemInfoW.USER32(00B96890,000000FF,00000000,00000030), ref: 00B32A92
SetMenuItemInfoW.USER32(00B96890,00000004,00000000,00000030), ref: 00B32AC8
Sleep.KERNEL32(000001F4), ref: 00B32ADA
GetMenuItemCount.USER32(?), ref: 00B32B1E
GetMenuItemID.USER32(?,00000000), ref: 00B32B3A
GetMenuItemID.USER32(?,-00000001), ref: 00B32B64
GetMenuItemID.USER32(?,?), ref: 00B32BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B32BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B32C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B32C24

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: fdedbf6bda266a2eb53e833451bd7aad05c53dcc791cbe892a2ba6f08715ab81
Instruction ID: fb430d766273e6c92da188d775f9d0a811c6cd140bef5c15990b50248320599f
Opcode Fuzzy Hash: fdedbf6bda266a2eb53e833451bd7aad05c53dcc791cbe892a2ba6f08715ab81
Instruction Fuzzy Hash: EB618EB090024AAFDF21CF64DD88EBEBBF8EB45304F2445D9E941A7251EB31AD45DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00B57192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B57214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B57217
GetWindowLongW.USER32(?,000000F0), ref: 00B5723B
_memset.LIBCMT ref: 00B5724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B5725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B572D6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: c84520e538ecd43dc7251d4bfccefe21db7c582c69406803c5b4e99dc14cf858
Instruction ID: 70b8379750cb66e4c7363a6ccfabcfd57f692558bbccfb6ebd48ae7d712fe0f6
Opcode Fuzzy Hash: c84520e538ecd43dc7251d4bfccefe21db7c582c69406803c5b4e99dc14cf858
Instruction Fuzzy Hash: E5615B71A40208AFDB10DFA4DD81FEE77F8EB09710F14419AFE14A72A1DB70A945DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B2710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B27135
SafeArrayAllocData.OLEAUT32(?), ref: 00B2718E
VariantInit.OLEAUT32(?), ref: 00B271A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B271C0
VariantCopy.OLEAUT32(?,?), ref: 00B27213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B27227
VariantClear.OLEAUT32(?), ref: 00B2723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00B27249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B27252
VariantClear.OLEAUT32(?), ref: 00B27264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B2726F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b4cfac51ab46e2f3539e5b071cf0a47477564d91ea6762e5d66fba2501bf7a73
Instruction ID: ba39edd380def138f07fc7fdf4bfd322f1b3c07e76b5ffacba428d6bce16817c
Opcode Fuzzy Hash: b4cfac51ab46e2f3539e5b071cf0a47477564d91ea6762e5d66fba2501bf7a73
Instruction Fuzzy Hash: 2C410D35904229EFCF00EF64E844AAEBBB9FF48355F0080A9E955A7361DF34A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B45A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B45AA6
inet_addr.WSOCK32(?,?,?), ref: 00B45AEB
gethostbyname.WSOCK32(?), ref: 00B45AF7
IcmpCreateFile.IPHLPAPI ref: 00B45B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B45B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B45B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00B45C00
WSACleanup.WSOCK32 ref: 00B45C06

Strings

Ping, xrefs: 00B45B29

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 8f4d38a27f19a53a0c7b6374a619d5653ea89ff657a4a355da18551c250b5769
Instruction ID: bcb431c33f529fa93d47518bd06a58eaa5389d3172989a8258baaf010a3e4304
Opcode Fuzzy Hash: 8f4d38a27f19a53a0c7b6374a619d5653ea89ff657a4a355da18551c250b5769
Instruction Fuzzy Hash: 3F519331604B019FD721EF24CD85B2ABBE4EF48710F1489AAF556DB2A2DB70ED40DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00B3B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B3B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B3B7B1
GetLastError.KERNEL32 ref: 00B3B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00B3B828

Strings

UNKNOWN, xrefs: 00B3B7E0
READONLY, xrefs: 00B3B7F3
INVALID, xrefs: 00B3B7FA
NOTREADY, xrefs: 00B3B7E7
READY, xrefs: 00B3B801

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: df1e17a459d0ba96733c7764107fd0bb6f49f52e39fe61d56c99e308df3e3cb0
Instruction ID: 594d92cd9558a9bf18bf860fcd6de81a89de3489ac8c6f779c913a2cc50455c5
Opcode Fuzzy Hash: df1e17a459d0ba96733c7764107fd0bb6f49f52e39fe61d56c99e308df3e3cb0
Instruction Fuzzy Hash: D3314135A00205EFDB10EF68C985EBEBBF8EF44740F2440AAE606D72A5DB719D42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B29471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00B294F6
GetDlgCtrlID.USER32 ref: 00B29501
GetParent.USER32 ref: 00B2951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B29520
GetDlgCtrlID.USER32(?), ref: 00B29529
GetParent.USER32(?), ref: 00B29545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B29548

Strings

ListBox, xrefs: 00B294B3
ComboBox, xrefs: 00B2947E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 0ca02555ba96b62d003d5f8990c06a7347179a4e619c9978a8d182ef849a09b9
Instruction ID: 40bfb5216318b7fd0064fff9b9cd3063d4300cac0fc449a9a3a8ea23a0d96bef
Opcode Fuzzy Hash: 0ca02555ba96b62d003d5f8990c06a7347179a4e619c9978a8d182ef849a09b9
Instruction Fuzzy Hash: 8321F170E00214BBCF05AB60DC85EFEBBB4EF59300F1041AAB966972A2DF755919DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00B2955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00B295DF
GetDlgCtrlID.USER32 ref: 00B295EA
GetParent.USER32 ref: 00B29606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B29609
GetDlgCtrlID.USER32(?), ref: 00B29612
GetParent.USER32(?), ref: 00B2962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B29631

Strings

ListBox, xrefs: 00B2959E
ComboBox, xrefs: 00B29569

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ad5899cd6da4080c8a44c0f2d67dd092bb0814e0bd2b4d65ac02ec9c3fa7dbfe
Instruction ID: 9971bcc8715fcb4939bc4ed08c8da8839e9052d66aecba484213e290d22e8447
Opcode Fuzzy Hash: ad5899cd6da4080c8a44c0f2d67dd092bb0814e0bd2b4d65ac02ec9c3fa7dbfe
Instruction Fuzzy Hash: 6321D070A00215BBDF05AB60CCC5EFEBBF8EF58300F104196B926972A1DB759919DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00B29645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B29651
GetClassNameW.USER32(00000000,?,00000100), ref: 00B29666
_wcscmp.LIBCMT ref: 00B29678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B296F3

Strings

SHELLDLL_DefView, xrefs: 00B29672
smallicons, xrefs: 00B296BB
largeicons, xrefs: 00B29687
list, xrefs: 00B296D5
details, xrefs: 00B296A1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 059442cf43c3637cf5d7f41b11759df532aa5d5c8364902aee43e881b5031cad
Instruction ID: 97ec1417865e2d52cfbbbaf30a3a138d3b1a98d1e33874635a55951a049e3b3c
Opcode Fuzzy Hash: 059442cf43c3637cf5d7f41b11759df532aa5d5c8364902aee43e881b5031cad
Instruction Fuzzy Hash: E311C47624832BBAEF022660EC06DF677D8CB14760F2001E6FA08A50F1FE9159118658

Uniqueness

Uniqueness Score: -1.00%

Function 00B48BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B48BEC
CoInitialize.OLE32(00000000), ref: 00B48C19
CoUninitialize.OLE32 ref: 00B48C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00B48D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B48E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00B62C0C), ref: 00B48E84
CoGetObject.OLE32(?,00000000,00B62C0C,?), ref: 00B48EA7
SetErrorMode.KERNEL32(00000000), ref: 00B48EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B48F3A
VariantClear.OLEAUT32(?), ref: 00B48F4A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: ab21c391cbfc195d4e5482de3036eb4e3f46eac6daa41312b8a1eb64f4e60d45
Instruction ID: b34fd7fb2ef2582637277cb74433ffb28c20c633a1e17f0e646ac85ede2315df
Opcode Fuzzy Hash: ab21c391cbfc195d4e5482de3036eb4e3f46eac6daa41312b8a1eb64f4e60d45
Instruction Fuzzy Hash: A2C10571608305AFD700EF64C88492BB7E9FF89748F1049ADF58A9B261DB71EE05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B34189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B3419D
__swprintf.LIBCMT ref: 00B341AA

Part of subcall function 00AF38D8: __woutput_l.LIBCMT ref: 00AF3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00B341D4
LoadResource.KERNEL32(?,00000000), ref: 00B341E0
LockResource.KERNEL32(00000000), ref: 00B341ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00B3420D
LoadResource.KERNEL32(?,00000000), ref: 00B3421F
SizeofResource.KERNEL32(?,00000000), ref: 00B3422E
LockResource.KERNEL32(?), ref: 00B3423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00B3429B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 59b2b6a141889019d8de95ef930b8439daf196f21d295d049036cf4df762b4f6
Instruction ID: 0735be03d031a8e14a1d7ee88b9f128d228582d4a9d4edad6e370dd1e5be01f2
Opcode Fuzzy Hash: 59b2b6a141889019d8de95ef930b8439daf196f21d295d049036cf4df762b4f6
Instruction Fuzzy Hash: 2531AEB160520AABDB019FA0DD88EBFBBECEF04301F1045A5F905E3150EB34EA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B316DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B31700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B30778,?,00000001), ref: 00B31714
GetWindowThreadProcessId.USER32(00000000), ref: 00B3171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B30778,?,00000001), ref: 00B3172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B3173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B30778,?,00000001), ref: 00B31755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B30778,?,00000001), ref: 00B31767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B30778,?,00000001), ref: 00B317AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B30778,?,00000001), ref: 00B317C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B30778,?,00000001), ref: 00B317CC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5b6bdfc9b2febd2ae3d6bf326a82e14aeb969893378a01cec50d6d47f02aa2b9
Instruction ID: 7b6360e52ab6729a3ea08ecb7f3b3fe3b6f55eb9ff487e88298a66225ee87652
Opcode Fuzzy Hash: 5b6bdfc9b2febd2ae3d6bf326a82e14aeb969893378a01cec50d6d47f02aa2b9
Instruction Fuzzy Hash: 0931ACB5650304FBEB119F68DE88B797BEDEB16712F2444A6F800A72A0DF709D40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ADFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00ADFC06
OleUninitialize.OLE32(?,00000000), ref: 00ADFCA5
UnregisterHotKey.USER32(?), ref: 00ADFDFC
DestroyWindow.USER32(?), ref: 00B14A00
FreeLibrary.KERNEL32(?), ref: 00B14A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B14A92

Strings

close all, xrefs: 00ADFC01

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: c0701b3eeb5e7f4aa3291c7a08daddefd4eadd4ae2b893b1c32c799c52b5ccb9
Instruction ID: 8efee4ffbc6fc663dad5bdd0d04800014c7df7982ab1c891ed34c096827c28fe
Opcode Fuzzy Hash: c0701b3eeb5e7f4aa3291c7a08daddefd4eadd4ae2b893b1c32c799c52b5ccb9
Instruction Fuzzy Hash: 50A159307112228FCB29EF14C595A6AF7A4EF04740F5542EEE90BAB262DB30AD56CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00B2A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00B2AA64), ref: 00B2A9A2

Strings

CLASSNN, xrefs: 00B2A744
CLASS, xrefs: 00B2A721
REGEXPCLASS, xrefs: 00B2A767
INSTANCE, xrefs: 00B2A8B0
NAME, xrefs: 00B2A7D4
TEXT, xrefs: 00B2A8D9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 89e55f399cb183178aef98b2e499712e3c80d311eb87711192880903e159f4bb
Instruction ID: b039533a76ce7f844961d2bc82985869d9b5dc0f09ae903aa17fcff9337f3e4f
Opcode Fuzzy Hash: 89e55f399cb183178aef98b2e499712e3c80d311eb87711192880903e159f4bb
Instruction Fuzzy Hash: 5191B33190061AEBDF18EFA0D581BF9FBB4FF04304F148199E99EA7151DB306A99CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AD2EAE

Part of subcall function 00AD1DB3: GetClientRect.USER32(?,?), ref: 00AD1DDC
Part of subcall function 00AD1DB3: GetWindowRect.USER32(?,?), ref: 00AD1E1D
Part of subcall function 00AD1DB3: ScreenToClient.USER32(?,?), ref: 00AD1E45

GetDC.USER32 ref: 00B0CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B0CF95
SelectObject.GDI32(00000000,00000000), ref: 00B0CFA3
SelectObject.GDI32(00000000,00000000), ref: 00B0CFB8
ReleaseDC.USER32(?,00000000), ref: 00B0CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B0D04B

Strings

U, xrefs: 00B0CF20

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 85ba589add24c0e848f7c9a0d1a446eeb3d3724f530b0bf371d4c7de8583a3d2
Instruction ID: 458bdfe1a2954e97a3c79d69b59b308af2c0f9b54f056858e6f3d81b5100f3a9
Opcode Fuzzy Hash: 85ba589add24c0e848f7c9a0d1a446eeb3d3724f530b0bf371d4c7de8583a3d2
Instruction Fuzzy Hash: 2971AF30500205EFCF219FA4C894AAA7FF6FF48351F1442AAED565B2E6DB318C46DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

Part of subcall function 00AD2344: GetCursorPos.USER32(?), ref: 00AD2357
Part of subcall function 00AD2344: ScreenToClient.USER32(00B967B0,?), ref: 00AD2374
Part of subcall function 00AD2344: GetAsyncKeyState.USER32(00000001), ref: 00AD2399
Part of subcall function 00AD2344: GetAsyncKeyState.USER32(00000002), ref: 00AD23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00B5C2E4
ImageList_EndDrag.COMCTL32 ref: 00B5C2EA
ReleaseCapture.USER32 ref: 00B5C2F0
SetWindowTextW.USER32(?,00000000), ref: 00B5C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00B5C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00B5C48F

Strings

@GUI_DROPID, xrefs: 00B5C3E1
@GUI_DRAGFILE, xrefs: 00B5C424

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: da0898b6abeca15382869dd4cb988f07c012543963b26c1317b8a6992112c327
Instruction ID: a5fe1092d3987a106cda9c108d959aa588a61da51bf41bfcbf409a98fe062d3a
Opcode Fuzzy Hash: da0898b6abeca15382869dd4cb988f07c012543963b26c1317b8a6992112c327
Instruction Fuzzy Hash: 7651B030204305AFDB00EF20C995F6A7BE1FB88311F0485AEF9968B2F1DB70A949CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B48F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00B5F910), ref: 00B4903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00B5F910), ref: 00B49071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B491EB
SysFreeString.OLEAUT32(?), ref: 00B49215

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 8b998f1d6a24178742aa5d797524424eb5ec1cfd31100bdff39855c6d31a12de
Instruction ID: 31a25299c79df36f420726b067086cf4e792d7ed4be3ad08872b9285aaa0ecb3
Opcode Fuzzy Hash: 8b998f1d6a24178742aa5d797524424eb5ec1cfd31100bdff39855c6d31a12de
Instruction Fuzzy Hash: A1F14B71A00209EFDF04DF94C888EAEB7B9FF49315F108499F916AB291DB31AE45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B4F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B4FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B4FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B4FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B4FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B4FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00B4FD90
CloseHandle.KERNEL32(?), ref: 00B4FDBF
CloseHandle.KERNEL32(?), ref: 00B4FE36

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 108c08f733c52b6ca08c748eeae06b365269194df222f05e5e09bfcb8a7e49ea
Instruction ID: 56169daeb2cb95798b466e41e43b92a14bfc2b9e1fc28ecb067c86b8946ec419
Opcode Fuzzy Hash: 108c08f733c52b6ca08c748eeae06b365269194df222f05e5e09bfcb8a7e49ea
Instruction Fuzzy Hash: 63E1A0316043429FCB14EF24C991B7ABBE1EF85354F1484ADF89A8B2A2DB31DD44DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B34F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B348AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B338D3,?), ref: 00B348C7

Part of subcall function 00B348AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B338D3,?), ref: 00B348E0

Part of subcall function 00B34CD3: GetFileAttributesW.KERNEL32(?,00B33947), ref: 00B34CD4

lstrcmpiW.KERNEL32(?,?), ref: 00B34FE2
_wcscmp.LIBCMT ref: 00B34FFC
MoveFileW.KERNEL32(?,?), ref: 00B35017

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 7358c99de80f5145d2d762eb9875f2523fa49369e4c5e4bdab68eb0a1b234765
Instruction ID: 8d307fdf3b5cdbf3c9298b93f74e438d5d4ae333ffec83df3a52fe3abc7f02b5
Opcode Fuzzy Hash: 7358c99de80f5145d2d762eb9875f2523fa49369e4c5e4bdab68eb0a1b234765
Instruction Fuzzy Hash: 635176B24087859BC724DBA0C881ADFB7ECEF84341F14496EB289D3151EF75A68CC766

Uniqueness

Uniqueness Score: -1.00%

Function 00B588B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B5896E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 2f2de133446d0068ab5e6a00020f9a2b649afa999caab6ac4638ef7e6f2b209f
Instruction ID: dc6962bf0ef1740c7aa1d63f9bed0884f6b9904f3f9bebd5440bd3c8995fb986
Opcode Fuzzy Hash: 2f2de133446d0068ab5e6a00020f9a2b649afa999caab6ac4638ef7e6f2b209f
Instruction Fuzzy Hash: 97519130600209BBEF209F24CC85BA97BE5FB05352F6041D6FD15F62A1DF71A988CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00B0C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B0C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B0C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00B0C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B0C5C0
DestroyIcon.USER32(00000000), ref: 00B0C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B0C5EC
DestroyIcon.USER32(?), ref: 00B0C5FB

Part of subcall function 00B5A71E: DeleteObject.GDI32(00000000), ref: 00B5A757

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 7c8e25a1b80f7382d65c6b74fc01fca2a2712dbc6611285ed8bd19672230ae3a
Instruction ID: 020696ed0782b913f651d214de6b288d51501dc46238b1cc06e94ae74db83e43
Opcode Fuzzy Hash: 7c8e25a1b80f7382d65c6b74fc01fca2a2712dbc6611285ed8bd19672230ae3a
Instruction Fuzzy Hash: 21516B74600205AFDB24DF24DD85FAA7BF5EB68351F10466AF902972E0DBB0ED90DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B28E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00B28A84,00000B00,?,?), ref: 00B28E0C
HeapAlloc.KERNEL32(00000000,?,00B28A84,00000B00,?,?), ref: 00B28E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B28A84,00000B00,?,?), ref: 00B28E28
GetCurrentProcess.KERNEL32(?,00000000,?,00B28A84,00000B00,?,?), ref: 00B28E30
DuplicateHandle.KERNEL32(00000000,?,00B28A84,00000B00,?,?), ref: 00B28E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00B28A84,00000B00,?,?), ref: 00B28E43
GetCurrentProcess.KERNEL32(00B28A84,00000000,?,00B28A84,00000B00,?,?), ref: 00B28E4B
DuplicateHandle.KERNEL32(00000000,?,00B28A84,00000B00,?,?), ref: 00B28E4E
CreateThread.KERNEL32(00000000,00000000,00B28E74,00000000,00000000,00000000), ref: 00B28E68

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 17dcbf87e9afaba7c83645dc168a8dec097d1e38aa190424937df3f7183b25fa
Instruction ID: 8b019d148c3f54a7cf6a2fd412db4e7d6124dd5558a457368013a08e243d4ab6
Opcode Fuzzy Hash: 17dcbf87e9afaba7c83645dc168a8dec097d1e38aa190424937df3f7183b25fa
Instruction Fuzzy Hash: 8601A8B5640709FFEA10ABA5DC49F6B7BACEB89711F014461FA05DB1A1CA7598018A20

Uniqueness

Uniqueness Score: -1.00%

Function 00B49428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B4947C
VariantInit.OLEAUT32(?), ref: 00B4954D
VariantInit.OLEAUT32(?), ref: 00B4964E
VariantClear.OLEAUT32(?), ref: 00B49658
VariantClear.OLEAUT32(?), ref: 00B496B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00B494DD, 00B4960B, 00B496C3
Incorrect Object type in FOR..IN loop, xrefs: 00B49631

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 0256dbcd40431e6df6a7047666264f267d487efcf1ae3594a24cd993f34dea1d
Instruction ID: 82483aa9a5507d8060bd928f632aa851b3c012f5d905fc4bb27823355f90fab7
Opcode Fuzzy Hash: 0256dbcd40431e6df6a7047666264f267d487efcf1ae3594a24cd993f34dea1d
Instruction Fuzzy Hash: B4917C71A00219AFDF24DFA5D884FAFBBF8EF45710F10819AF515AB290D7709A05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B49A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00B27652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?,?,00B2799D), ref: 00B2766F
Part of subcall function 00B27652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?), ref: 00B2768A
Part of subcall function 00B27652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?), ref: 00B27698
Part of subcall function 00B27652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?), ref: 00B276A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00B49B1B
_memset.LIBCMT ref: 00B49B28
_memset.LIBCMT ref: 00B49C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00B49C97
CoTaskMemFree.OLE32(?), ref: 00B49CA2

Strings

NULL Pointer assignment, xrefs: 00B49CF0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: c6b7331fe9c3ceba02d009f2c3f9a71c0e25e8d23c7c86c5e72cdb69d7e3ab1f
Instruction ID: 37395be8beac758f28c54b22e6873b7dc606a22a57716b74c811aa93690cef8e
Opcode Fuzzy Hash: c6b7331fe9c3ceba02d009f2c3f9a71c0e25e8d23c7c86c5e72cdb69d7e3ab1f
Instruction Fuzzy Hash: B6912A71D00229EBDF10DFA4DD85ADEBBB9EF08710F2041AAF519A7251DB719A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B56FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B57093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00B570A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B570C1
_wcscat.LIBCMT ref: 00B5711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B57133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B57161

Strings

SysListView32, xrefs: 00B57065

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: b1b1b037e37717ce271561a0cde11d09c0efdf6b3f94ab6d5f916e8af5a5c9d8
Instruction ID: d826840edf1cced358c68d07800f2791ca91a810f60217adc6dee735d2777bd9
Opcode Fuzzy Hash: b1b1b037e37717ce271561a0cde11d09c0efdf6b3f94ab6d5f916e8af5a5c9d8
Instruction Fuzzy Hash: F441A371A44309AFDB219FA4DC85BEEB7E8EF08351F1005EAF944E72D1DA719D888B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00B33E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00B33EB6
Part of subcall function 00B33E91: Process32FirstW.KERNEL32(00000000,?), ref: 00B33EC4
Part of subcall function 00B33E91: CloseHandle.KERNEL32(00000000), ref: 00B33F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B4ECB8
GetLastError.KERNEL32 ref: 00B4ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B4ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B4ED77
GetLastError.KERNEL32(00000000), ref: 00B4ED82
CloseHandle.KERNEL32(00000000), ref: 00B4EDB7

Strings

SeDebugPrivilege, xrefs: 00B4ECD6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 11f2a01394743df463ba65a19bb2ad8ee0d945ebd40edb60ac8d883fbc4215c1
Instruction ID: 57be135290d7b7bd8acd7882b10dfdd0008a98374ba166a3b4126ed0c162a87c
Opcode Fuzzy Hash: 11f2a01394743df463ba65a19bb2ad8ee0d945ebd40edb60ac8d883fbc4215c1
Instruction Fuzzy Hash: 3D4195316002119FDB14EF24CC95F6EB7E1BF80714F1880A9F8469B2A2CBB4E904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B33226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B332C5

Strings

stop, xrefs: 00B33296
warning, xrefs: 00B332AE
question, xrefs: 00B3327E
info, xrefs: 00B33266
blank, xrefs: 00B33247

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c406bc89c2772ad9c848cb96f8bccfd3e608be5c5bf0412e25039df37c3ebaf2
Instruction ID: 0d49f7d4d6cc9f89a83fba557828aaad5ea2f52dba3d121af704af2a70558ce7
Opcode Fuzzy Hash: c406bc89c2772ad9c848cb96f8bccfd3e608be5c5bf0412e25039df37c3ebaf2
Instruction Fuzzy Hash: 6C11E73260834ABAEB016A94DC82D7BB7DCDF19B70F3000EAF601A6191EAA55F4046B5

Uniqueness

Uniqueness Score: -1.00%

Function 00B34534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B3454E
LoadStringW.USER32(00000000), ref: 00B34555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B3456B
LoadStringW.USER32(00000000), ref: 00B34572
_wprintf.LIBCMT ref: 00B34598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B345B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B34593

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: b5e26b043183512156b7e96680a4502342ae08c9fc40d837d2ba1a4947fea85c
Instruction ID: 7a14f62fa3639396472b2bee81fa90a8f940e46e8b8c6c06813cadbdcf96191f
Opcode Fuzzy Hash: b5e26b043183512156b7e96680a4502342ae08c9fc40d837d2ba1a4947fea85c
Instruction Fuzzy Hash: 3B012CF2900209BBE711A7A0DD89FFBB6ACDB08702F0005E5BB45E3051EA749E858B70

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

GetSystemMetrics.USER32(0000000F), ref: 00B5D78A
GetSystemMetrics.USER32(0000000F), ref: 00B5D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B5D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B5DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B5DA24
ShowWindow.USER32(00000003,00000000), ref: 00B5DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00B5DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00B5DA8B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 93049c74b6bc3420064a0a1950ab376455b373e4ba3a064088653f6979d03be1
Instruction ID: fa3cb37ae3c22b53eee6b4ba09bbca36a6f20948ae4f3fef3910c62ced9776ba
Opcode Fuzzy Hash: 93049c74b6bc3420064a0a1950ab376455b373e4ba3a064088653f6979d03be1
Instruction Fuzzy Hash: 3AB15871600215ABDF24CF69C9C57BA7BF1FF48702F0882E9ED489B295DB34A954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00B0C417,00000004,00000000,00000000,00000000), ref: 00AD2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00B0C417,00000004,00000000,00000000,00000000,000000FF), ref: 00AD2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00B0C417,00000004,00000000,00000000,00000000), ref: 00B0C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00B0C417,00000004,00000000,00000000,00000000), ref: 00B0C4D6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 4027e22dd6dafcdfb55b566637af5ea6b3c2d3ec976c7ba1205f056f754ecdb8
Instruction ID: d6eb3eac548bc539b7cb18405ccf2997b62a650008125d4337debc9234344341
Opcode Fuzzy Hash: 4027e22dd6dafcdfb55b566637af5ea6b3c2d3ec976c7ba1205f056f754ecdb8
Instruction Fuzzy Hash: 8E41E2352087809AD7358B288DDCB7A7FE2FBA5340F58899BE047877B1CA75A841D710

Uniqueness

Uniqueness Score: -1.00%

Function 00B37368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B3737F

Part of subcall function 00AF0FF6: std::exception::exception.LIBCMT ref: 00AF102C
Part of subcall function 00AF0FF6: __CxxThrowException@8.LIBCMT ref: 00AF1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00B373B6
EnterCriticalSection.KERNEL32(?), ref: 00B373D2
_memmove.LIBCMT ref: 00B37420
_memmove.LIBCMT ref: 00B3743D
LeaveCriticalSection.KERNEL32(?), ref: 00B3744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00B37461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B37480

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: dc2b8cc3633b05e5a83edb533735c5269de93369ecff2786d68bd801b891d89c
Instruction ID: 571d8252c3d73b1e72d4a5808f52a3a0224a88478b0a49769fb82ba73bf8bc23
Opcode Fuzzy Hash: dc2b8cc3633b05e5a83edb533735c5269de93369ecff2786d68bd801b891d89c
Instruction Fuzzy Hash: 96316D71904205EBCF10DFA4DD85ABABBB8EF44711F2441A5FA04AB256DF319A10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B56442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B5645A
GetDC.USER32(00000000), ref: 00B56462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B5646D
ReleaseDC.USER32(00000000,00000000), ref: 00B56479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B564B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B564C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B59299,?,?,000000FF,00000000,?,000000FF,?), ref: 00B56500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B56520

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 6871f24e16316cd5729754bb8a9edd779d4af24808dc984623e1b34fd4088949
Instruction ID: bcdb66b7037916f7e4c152bb5393e38c217b64c73f934884d436e25eba5459e8
Opcode Fuzzy Hash: 6871f24e16316cd5729754bb8a9edd779d4af24808dc984623e1b34fd4088949
Instruction Fuzzy Hash: 71315A72241214AFEB118F50DC8AFBB7FA9EB19762F0440A5FE089B291DA759841CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00B2C087
_memcmp.LIBCMT ref: 00B2C0A9
_memcmp.LIBCMT ref: 00B2C0C1
_memcmp.LIBCMT ref: 00B2C0D4
_memcmp.LIBCMT ref: 00B2C0EE
_memcmp.LIBCMT ref: 00B2C101
_memcmp.LIBCMT ref: 00B2C119
_memcmp.LIBCMT ref: 00B2C134

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 6d621e1e99a88c883a2630259596f1575789ae1319e34cba6264a8a773b0385f
Instruction ID: c1b57d418ba97ec6edf862ea34ea9a25ab1cc614db14f94ebc4eee1bebb88e4c
Opcode Fuzzy Hash: 6d621e1e99a88c883a2630259596f1575789ae1319e34cba6264a8a773b0385f
Instruction Fuzzy Hash: 2921F971740629F7E254A661AD83FBF3BDCEF20799B0400A0FE0DE62D2E755DD2281A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B3ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

Part of subcall function 00AEFEC6: _wcscpy.LIBCMT ref: 00AEFEE9

_wcstok.LIBCMT ref: 00B3EEFF
_wcscpy.LIBCMT ref: 00B3EF8E
_memset.LIBCMT ref: 00B3EFC1

Strings

X, xrefs: 00B3EFFE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 9d6276467a8e541f3d6be20c6054b098d2b6c02672ac4f28b16c3bb04055a90b
Instruction ID: 400dc5d1d371a5e4ea29cd176e63765f23659c7f77506678c7a40ea7a209806e
Opcode Fuzzy Hash: 9d6276467a8e541f3d6be20c6054b098d2b6c02672ac4f28b16c3bb04055a90b
Instruction Fuzzy Hash: 00C14C715087019FC724EF24D985A6EB7E4EF84310F14496EF89A9B3A2DB70ED45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B46E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B46F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B46F35
WSAGetLastError.WSOCK32(00000000), ref: 00B46F48
htons.WSOCK32(?,?,?,00000000,?), ref: 00B46FFE
inet_ntoa.WSOCK32(?), ref: 00B46FBB

Part of subcall function 00B2AE14: _strlen.LIBCMT ref: 00B2AE1E
Part of subcall function 00B2AE14: _memmove.LIBCMT ref: 00B2AE40

_strlen.LIBCMT ref: 00B47058
_memmove.LIBCMT ref: 00B470C1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 3ec2932f7dcd12a2c6940baa9cd68d18a6cee8096d5fde725651a3a522d2f906
Instruction ID: 743cff854c702ccfa1cdaf3be472e027410fdb5a1f55815a35cf16e71b205b2e
Opcode Fuzzy Hash: 3ec2932f7dcd12a2c6940baa9cd68d18a6cee8096d5fde725651a3a522d2f906
Instruction Fuzzy Hash: 0081BB71548300ABD710EB24CC86F6BB7E9EF88714F10495AB5569B3A2DF70EE05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39053bc5b71605579bb244f78eb770a0de902da97b58e38e07a7f1c9010dc79e
Instruction ID: 93b1835d74f84ecddc1588cd040f86816ff73b2a5f3ae76a4e9014072e797910
Opcode Fuzzy Hash: 39053bc5b71605579bb244f78eb770a0de902da97b58e38e07a7f1c9010dc79e
Instruction Fuzzy Hash: E2714D70900109FFCB049F98CD89EBEBB79FF85314F14815AF916AB291C734AA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01485E80), ref: 00B5B6A5
IsWindowEnabled.USER32(01485E80), ref: 00B5B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00B5B795
SendMessageW.USER32(01485E80,000000B0,?,?), ref: 00B5B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00B5B809
GetWindowLongW.USER32(01485E80,000000EC), ref: 00B5B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B5B843

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 75753972c5bb8105b436144798a86df481600a0809c7f25eb197c5d7d916a0ef
Instruction ID: f218e1dd72dad9a6c98ed7477a53087bee7e4be4ddeb1fce49c50ce08d8894f8
Opcode Fuzzy Hash: 75753972c5bb8105b436144798a86df481600a0809c7f25eb197c5d7d916a0ef
Instruction Fuzzy Hash: 6A716B34600204AFEB249F64C8D4FBABBF9EF49342F1444E9ED56972A1CB31AD49DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B4F75C
_memset.LIBCMT ref: 00B4F825
ShellExecuteExW.SHELL32(?), ref: 00B4F86A

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

Part of subcall function 00AEFEC6: _wcscpy.LIBCMT ref: 00AEFEE9

GetProcessId.KERNEL32(00000000), ref: 00B4F8E1
CloseHandle.KERNEL32(00000000), ref: 00B4F910

Strings

@, xrefs: 00B4F839

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: fd9e9dc00594aefd6e7cde6d9c09b4dbc3892fe1f6f7082d7479f16a836cd76c
Instruction ID: 1e4509e0456eb7bbde01c73d0d216da5d0e25f4a37bd86765883401436b4dc44
Opcode Fuzzy Hash: fd9e9dc00594aefd6e7cde6d9c09b4dbc3892fe1f6f7082d7479f16a836cd76c
Instruction Fuzzy Hash: C1617375A00619DFCF14DF54C5919AEBBF5FF48310B1484AAE856AB361CB30EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B3145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B3149C
GetKeyboardState.USER32(?), ref: 00B314B1
SetKeyboardState.USER32(?), ref: 00B31512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B31540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B3155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B315A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B315C8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 56befceeab217e8242616f554829ab01ae20e871ab5ee06ec4f9cf54770e56f9
Instruction ID: 0e930c358ae54bdcbfc00f27dac321e00d6340d6f76408192fd0d8435d853275
Opcode Fuzzy Hash: 56befceeab217e8242616f554829ab01ae20e871ab5ee06ec4f9cf54770e56f9
Instruction Fuzzy Hash: 8951F2A06047D53EFB32476C8C45BBABEED9B46304F2C48C9E1D6568C2C694EC94DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B31276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B312B5
GetKeyboardState.USER32(?), ref: 00B312CA
SetKeyboardState.USER32(?), ref: 00B3132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B31357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B31374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B313B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B313D9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 97e5c0fd70a8cab6101f668295a0eb7e3a8b91f62006adb84df6221af39bb4df
Instruction ID: f853529d32cdddbaaeaafcb485e52b3e773ec070e26cb61c966a1fff65757f04
Opcode Fuzzy Hash: 97e5c0fd70a8cab6101f668295a0eb7e3a8b91f62006adb84df6221af39bb4df
Instruction Fuzzy Hash: 815112A05447D57DFB3283288C41BBABFED9F06300F288CC9E1D4568C2D794AC98D764

Uniqueness

Uniqueness Score: -1.00%

Function 00B3589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B358AC
_wcsncpy.LIBCMT ref: 00B358E1
_wcsncpy.LIBCMT ref: 00B35913
_wcsncpy.LIBCMT ref: 00B35946
_wcsncpy.LIBCMT ref: 00B35988
_wcsncpy.LIBCMT ref: 00B359C2
_wcsncpy.LIBCMT ref: 00B359F1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: d9072e76b8ee3ca4081d1d046765f1d861b0765605abd4c4962bcf62ba78e396
Instruction ID: bc29a20e02bb1989e84b884cda8a97865359274839303e2e3f8e7ae2906392e7
Opcode Fuzzy Hash: d9072e76b8ee3ca4081d1d046765f1d861b0765605abd4c4962bcf62ba78e396
Instruction Fuzzy Hash: 1141836AC2161C76CB20FBF4C986ADFB7AC9F04310F608566F618E3121E634E715C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00B338AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B348AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B338D3,?), ref: 00B348C7

Part of subcall function 00B348AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B338D3,?), ref: 00B348E0

lstrcmpiW.KERNEL32(?,?), ref: 00B338F3
_wcscmp.LIBCMT ref: 00B3390F
MoveFileW.KERNEL32(?,?), ref: 00B33927
_wcscat.LIBCMT ref: 00B3396F
SHFileOperationW.SHELL32(?), ref: 00B339DB

Strings

\*.*, xrefs: 00B33969

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 1ca962fd78a1ce6f8ae3f6159ee17abb1d718859da478bd56348e9827671602c
Instruction ID: 2fb759cd935cc0ae09f5e84208d6fb7055d817be71074c5e4618599d3910eddc
Opcode Fuzzy Hash: 1ca962fd78a1ce6f8ae3f6159ee17abb1d718859da478bd56348e9827671602c
Instruction Fuzzy Hash: 0B4193715083449EC751EF64C481AEFB7E8EF89740F64096EB48AC3151EB74D688C752

Uniqueness

Uniqueness Score: -1.00%

Function 00B57500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B57519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B575C0
IsMenu.USER32(?), ref: 00B575D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B57620
DrawMenuBar.USER32 ref: 00B57633

Strings

0, xrefs: 00B5750D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: dd6f3b38e15725465808839ddb28e50221a0e47462af95c42b1319101d49ca13
Instruction ID: 5eabcb61d3c3751b2dc64e2cb766490caeaabe169e2030103fecade193ddd8f8
Opcode Fuzzy Hash: dd6f3b38e15725465808839ddb28e50221a0e47462af95c42b1319101d49ca13
Instruction Fuzzy Hash: A7412975A04609EFDB10DF54E984FAABBF8FB08351F0481AAED1597250DB30AD54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B5122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00B5125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B51286
FreeLibrary.KERNEL32(00000000), ref: 00B5133D

Part of subcall function 00B5122D: RegCloseKey.ADVAPI32(?), ref: 00B512A3
Part of subcall function 00B5122D: FreeLibrary.KERNEL32(?), ref: 00B512F5
Part of subcall function 00B5122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00B51318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B512E0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 99f9d44f1f6c53eda1ef108bc462aa2736952fc60a656c6b77134cdc1a1d9a44
Instruction ID: f6d788d8c6f81fde75dd9fbfb34cde7cbb4f19611b71f3ce24a168157ee910b8
Opcode Fuzzy Hash: 99f9d44f1f6c53eda1ef108bc462aa2736952fc60a656c6b77134cdc1a1d9a44
Instruction Fuzzy Hash: 96313CB1901209BFDB149F94DC99FFFB7BCEB08301F0405E9E911E3151DA749E499AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B5653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B5655B
GetWindowLongW.USER32(01485E80,000000F0), ref: 00B5658E
GetWindowLongW.USER32(01485E80,000000F0), ref: 00B565C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00B565F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00B5661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00B56630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B5664A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 89a6fe8206bb437952d18b3540f4d81cca194ac9ea1a6fcf9859255f744ed7ca
Instruction ID: 19295abd497d6e044f2aa8f13af1038cb59f769e2fff0fae093f7e11492c33d1
Opcode Fuzzy Hash: 89a6fe8206bb437952d18b3540f4d81cca194ac9ea1a6fcf9859255f744ed7ca
Instruction Fuzzy Hash: EF310230644215AFEB208F18EC84F653BE1FB5A352F9801EAF901CB2B5DB71AC48DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B46486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B480A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B480CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B464D9
WSAGetLastError.WSOCK32(00000000), ref: 00B464E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B46521
connect.WSOCK32(00000000,?,00000010), ref: 00B4652A
WSAGetLastError.WSOCK32 ref: 00B46534
closesocket.WSOCK32(00000000), ref: 00B4655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B46576

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: ef8fe21169b220e5e75ce64583ba76afeccae1b32e2682b7c0d9dc018a0540c2
Instruction ID: a7779a0a0f813b70185b3322c698cce8d48203779c6e2c0f110c4b18c473c1c0
Opcode Fuzzy Hash: ef8fe21169b220e5e75ce64583ba76afeccae1b32e2682b7c0d9dc018a0540c2
Instruction Fuzzy Hash: 09319031600218ABDF10AF24CC85BBE7BECEB45711F0040A9F90A97391DB74AE04DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B2E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B2E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B2E120
SysAllocString.OLEAUT32(00000000), ref: 00B2E123
SysAllocString.OLEAUT32 ref: 00B2E144
SysFreeString.OLEAUT32 ref: 00B2E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00B2E167
SysAllocString.OLEAUT32(?), ref: 00B2E175

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2f757b449f9c56b7d30523fcd51d224db79cc827378a1a4d52d6827af4eea444
Instruction ID: b83eeeda51737d7970c75b744d55f585ba64e46360d1064a0d9d856f3212629e
Opcode Fuzzy Hash: 2f757b449f9c56b7d30523fcd51d224db79cc827378a1a4d52d6827af4eea444
Instruction Fuzzy Hash: 9D21A731200219AFDB109FA9DC89DBBB7ECEB09761B008175FA18DB2A0DB74DC418B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B5783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AD1D73
Part of subcall function 00AD1D35: GetStockObject.GDI32(00000011), ref: 00AD1D87
Part of subcall function 00AD1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AD1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B578A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B578AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B578B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B578C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B578D4

Strings

Msctls_Progress32, xrefs: 00B57872

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 79a2a2c732c0f6a16f598c611cc0ef8886128f90a254a0b7a40fba8037970e3a
Instruction ID: 081b9c8eb0d4a2450003411966223ab3547f2570fb68c2c953015a9b9d43b8aa
Opcode Fuzzy Hash: 79a2a2c732c0f6a16f598c611cc0ef8886128f90a254a0b7a40fba8037970e3a
Instruction Fuzzy Hash: DF1186B1650219BFEF159F61CC85EE77F5DEF08758F014155FA04A60A0CB719C21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AF41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00AF4292,?), ref: 00AF41E3
GetProcAddress.KERNEL32(00000000), ref: 00AF41EA
EncodePointer.KERNEL32(00000000), ref: 00AF41F6
DecodePointer.KERNEL32(00000001,00AF4292,?), ref: 00AF4213

Strings

RoInitialize, xrefs: 00AF41D2
combase.dll, xrefs: 00AF41DE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 26adc945e0e72174b576fa01ac4d59c4fb9c20bef9a8d507933471035cb4063b
Instruction ID: a5a9d7808afe5aa3ff63aa58286a157483de69b5a81e79a10f2d9147896f2c52
Opcode Fuzzy Hash: 26adc945e0e72174b576fa01ac4d59c4fb9c20bef9a8d507933471035cb4063b
Instruction Fuzzy Hash: 90E01AB0690711AEFB206BB0ED09F257EA4BB24743F1044B5B512E70F0DFB540928F14

Uniqueness

Uniqueness Score: -1.00%

Function 00AF429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00AF41B8), ref: 00AF42B8
GetProcAddress.KERNEL32(00000000), ref: 00AF42BF
EncodePointer.KERNEL32(00000000), ref: 00AF42CA
DecodePointer.KERNEL32(00AF41B8), ref: 00AF42E5

Strings

combase.dll, xrefs: 00AF42B3
RoUninitialize, xrefs: 00AF42A7

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: a7281ed2fa95f557f406b1ea75cb7f81e399873fc27a54dae7a0930d107cd23b
Instruction ID: 14a31a908f76f53f714fee2fbac523ddb8a02a217783641c538578479016e533
Opcode Fuzzy Hash: a7281ed2fa95f557f406b1ea75cb7f81e399873fc27a54dae7a0930d107cd23b
Instruction Fuzzy Hash: 94E0B678581712ABEB10ABA0EE0DF667EA4BB24787F1040B6F105F30B0CFB54541CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00B3675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B368AD
_memmove.LIBCMT ref: 00B367E8

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

_memmove.LIBCMT ref: 00B3685B
_memmove.LIBCMT ref: 00B36942
_memmove.LIBCMT ref: 00B3695B
_memmove.LIBCMT ref: 00B36977

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 93b3fe1bf09b770244ec23dce923942e0d514e4956ba1ddd2cbb217d59e0d148
Instruction ID: 19dcd26b6cc492090040327c7dc479c070cc752a1db90c01abdf612ec3c0f15d
Opcode Fuzzy Hash: 93b3fe1bf09b770244ec23dce923942e0d514e4956ba1ddd2cbb217d59e0d148
Instruction Fuzzy Hash: 2161AD3050065AABCF11EF60CE92FFE77A4AF48308F14859AF95A5B292DB34ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B5046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B50038,?,?), ref: 00B510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B50548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B50588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00B505AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B505D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B50617
RegCloseKey.ADVAPI32(00000000), ref: 00B50624

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 71d12f15b552e5b2ccfc5fec12b6bd093b859767028ac4700a6a764b60e9c759
Instruction ID: 3d5ba19e92b2f1435b8a24381e603b65eee88827ac699232ccbf72de03497fab
Opcode Fuzzy Hash: 71d12f15b552e5b2ccfc5fec12b6bd093b859767028ac4700a6a764b60e9c759
Instruction Fuzzy Hash: 47514931118201AFC714EF64D985E6FBBE8FF88315F04499EF956872A1EB31E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B55A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B55A82
GetMenuItemCount.USER32(00000000), ref: 00B55AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B55AE1
GetMenuItemID.USER32(?,?), ref: 00B55B50
GetSubMenu.USER32(?,?), ref: 00B55B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00B55BAF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 3e92d6264b2362795147fc48e45c7bf018105b3019c17b1676962431cb7b28b8
Instruction ID: 6ad137814004cd9170a3a8bf21e007299585419a1a6c00bb74d9f4d908b57b9c
Opcode Fuzzy Hash: 3e92d6264b2362795147fc48e45c7bf018105b3019c17b1676962431cb7b28b8
Instruction Fuzzy Hash: 37515C35A00615EFCF25AFA4C995AAEB7F4EF48312F1044E9FD02A7351CB70AE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B2F3F7
VariantClear.OLEAUT32(00000013), ref: 00B2F469
VariantClear.OLEAUT32(00000000), ref: 00B2F4C4
_memmove.LIBCMT ref: 00B2F4EE
VariantClear.OLEAUT32(?), ref: 00B2F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B2F569

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: f56e2660d2384d28d6b2a196f74d0a8eff36e0bcfdfdbc7843e75588606e4e59
Instruction ID: e338612693a3f5812794b714700458bac877a0f0f36a391c605c2745049ba5a3
Opcode Fuzzy Hash: f56e2660d2384d28d6b2a196f74d0a8eff36e0bcfdfdbc7843e75588606e4e59
Instruction Fuzzy Hash: 965149B5A0021AEFCB14DF58D884AAAB7F8FF4C354B1585A9E959DB310D730E911CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B326F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B32747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B32792
IsMenu.USER32(00000000), ref: 00B327B2
CreatePopupMenu.USER32 ref: 00B327E6
GetMenuItemCount.USER32(000000FF), ref: 00B32844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00B32875

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 655b376ae6427bb54eee982594ab1187f334a2bde56985c2c896a58a15195185
Instruction ID: 79a5898ac94aba774e62c46984d620f5d3505d9462c45ce7e162d7beaf91e0ac
Opcode Fuzzy Hash: 655b376ae6427bb54eee982594ab1187f334a2bde56985c2c896a58a15195185
Instruction Fuzzy Hash: 3F519A70A0030AEBDF25CF68D988BAEBBF5EF44314F2042A9E8119B291E7709945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00AD179A
GetWindowRect.USER32(?,?), ref: 00AD17FE
ScreenToClient.USER32(?,?), ref: 00AD181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AD182C
EndPaint.USER32(?,?), ref: 00AD1876

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 816e2526870b0dcdaef4c564d9b497c094d0401171e06e81e9dcdb65f4a7247a
Instruction ID: 2b6b8ab10bdd5297f8d1c94247734e53ef076beb916a752f8880927a654319a8
Opcode Fuzzy Hash: 816e2526870b0dcdaef4c564d9b497c094d0401171e06e81e9dcdb65f4a7247a
Instruction Fuzzy Hash: 74418B71204301AFDB10DF25CC84FBA7BF8EB49724F1406AAF9A6872A1CB319845DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00B967B0,00000000,01485E80,?,?,00B967B0,?,00B5B862,?,?), ref: 00B5B9CC
EnableWindow.USER32(00000000,00000000), ref: 00B5B9F0
ShowWindow.USER32(00B967B0,00000000,01485E80,?,?,00B967B0,?,00B5B862,?,?), ref: 00B5BA50
ShowWindow.USER32(00000000,00000004,?,00B5B862,?,?), ref: 00B5BA62
EnableWindow.USER32(00000000,00000001), ref: 00B5BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00B5BAA9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 42dc10083cb62d55c9333a0d142826e8a30dc682aadbf92c024c9bee7bc62c06
Instruction ID: b7ccf8f7d2321ffc37d868ab594424c398703f546371a055c32f69a42fa647ba
Opcode Fuzzy Hash: 42dc10083cb62d55c9333a0d142826e8a30dc682aadbf92c024c9bee7bc62c06
Instruction Fuzzy Hash: AD413034600285AFDB26CF54C489FA57BE1FB05316F1842F9FE488F6A2CB31A849CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B473B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00B45134,?,?,00000000,00000001), ref: 00B473BF

Part of subcall function 00B43C94: GetWindowRect.USER32(?,?), ref: 00B43CA7

GetDesktopWindow.USER32 ref: 00B473E9
GetWindowRect.USER32(00000000), ref: 00B473F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00B47422

Part of subcall function 00B354E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B3555E

GetCursorPos.USER32(?), ref: 00B4744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B474AC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 4fc2763e89b67adf5d5b793a8edd90602bd8704575a65037ae0055276967660e
Instruction ID: 711a18e2c25bba06574868c8422e98979662ade1ddfea0aeeca1fdb4bf9ecda6
Opcode Fuzzy Hash: 4fc2763e89b67adf5d5b793a8edd90602bd8704575a65037ae0055276967660e
Instruction Fuzzy Hash: 2731D572508316AFD720DF54D849FABBBE9FF88314F100959F58997291DB30EA48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B28D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B285F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B28608
Part of subcall function 00B285F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B28612
Part of subcall function 00B285F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B28621
Part of subcall function 00B285F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B28628
Part of subcall function 00B285F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B2863E

GetLengthSid.ADVAPI32(?,00000000,00B28977), ref: 00B28DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B28DB8
HeapAlloc.KERNEL32(00000000), ref: 00B28DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B28DD8
GetProcessHeap.KERNEL32(00000000,00000000,00B28977), ref: 00B28DEC
HeapFree.KERNEL32(00000000), ref: 00B28DF3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 05dc8959a540042b69fbbd49bd5fe807673ec48a31de57098d397fcd5c5e99c2
Instruction ID: dab96a396a9c374acd37b9a634b327cd98f208fb0d7b54b1d065f347e1dd2753
Opcode Fuzzy Hash: 05dc8959a540042b69fbbd49bd5fe807673ec48a31de57098d397fcd5c5e99c2
Instruction Fuzzy Hash: A211E131502615FFDF109F64EC08BBEB7A9EF55356F1480ADE849A3250CF31A909CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B28AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B28B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00B28B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B28B40
CloseHandle.KERNEL32(00000004), ref: 00B28B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B28B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B28B8E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 86d7f63f23f3747dd125c1c9921ec1e752dcee092a2e977dd4398c21089646ff
Instruction ID: ac205bc83c8e42d9db4e2b97e5f0192ac560faddc7f5d28683db74dda1d1f687
Opcode Fuzzy Hash: 86d7f63f23f3747dd125c1c9921ec1e752dcee092a2e977dd4398c21089646ff
Instruction Fuzzy Hash: AA1130B250121EABDF018F94ED49FEE7BE9EF09305F0440A9FE04A2160CB769D61DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00AD12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD134D
Part of subcall function 00AD12F3: SelectObject.GDI32(?,00000000), ref: 00AD135C
Part of subcall function 00AD12F3: BeginPath.GDI32(?), ref: 00AD1373
Part of subcall function 00AD12F3: SelectObject.GDI32(?,00000000), ref: 00AD139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00B5C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00B5C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B5C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00B5C1F6
EndPath.GDI32(00000000), ref: 00B5C206
StrokePath.GDI32(00000000), ref: 00B5C216

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 375e84ebd6475b67d16454e99895c077dd2e00d1ae9c70211fb38a974a3ec5d1
Instruction ID: 5e3ea7d8422e13223b805b9e5afac8e9a9791b763e89c483a89ad116f8991049
Opcode Fuzzy Hash: 375e84ebd6475b67d16454e99895c077dd2e00d1ae9c70211fb38a974a3ec5d1
Instruction Fuzzy Hash: 42111E7640024DBFDF129F90DC88FEA7FADEB04355F0480A2B918971A1DB729D55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AF03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AF03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AF03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AF03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AF03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AF03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AF0401

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 52b3d15654458a6a7384a0eb9db5664c6bdfefe397f9222fc4e9dab4658812d2
Instruction ID: c68f5db086b649e29c88f8a55166a1ae65d55e27b7eaeb4f35c2e76190394b58
Opcode Fuzzy Hash: 52b3d15654458a6a7384a0eb9db5664c6bdfefe397f9222fc4e9dab4658812d2
Instruction Fuzzy Hash: 36016CB090175A7DE3009F5A8C85B52FFE8FF19354F00415BA15C47941C7F5A864CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00B3568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B3569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B356B1
GetWindowThreadProcessId.USER32(?,?), ref: 00B356C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B356CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B356D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B356E0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a12e4ef33d684d5cd462027ed1537dc21352d15b88708d554cc707daf475c2f6
Instruction ID: 52400ff755fc2aa74a4b8c79f07b479a8423a3215876bfefd5e6f60c8f867db3
Opcode Fuzzy Hash: a12e4ef33d684d5cd462027ed1537dc21352d15b88708d554cc707daf475c2f6
Instruction Fuzzy Hash: 0FF01231141659BBE7215B929C0DFBBBB7CEBC6B12F0001A9FA04D20509AA11A01C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00B374D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00B374E5
EnterCriticalSection.KERNEL32(?,?,00AE1044,?,?), ref: 00B374F6
TerminateThread.KERNEL32(00000000,000001F6,?,00AE1044,?,?), ref: 00B37503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00AE1044,?,?), ref: 00B37510

Part of subcall function 00B36ED7: CloseHandle.KERNEL32(00000000,?,00B3751D,?,00AE1044,?,?), ref: 00B36EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00B37523
LeaveCriticalSection.KERNEL32(?,?,00AE1044,?,?), ref: 00B3752A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 5096b0c0753034d06380cbc253ad048e47d0c9b10bb4b0bfde4da211246a62ad
Instruction ID: 9da6af0c52b3dd1e72dbe6513c828f83ceb59c77f5b20613a71d295d2eed2be8
Opcode Fuzzy Hash: 5096b0c0753034d06380cbc253ad048e47d0c9b10bb4b0bfde4da211246a62ad
Instruction Fuzzy Hash: 25F03ABA141713ABEB112B64EC8CBEBB76AEF45303F1105B1F202A24A0CFB65801CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00B28E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B28E7F
UnloadUserProfile.USERENV(?,?), ref: 00B28E8B
CloseHandle.KERNEL32(?), ref: 00B28E94
CloseHandle.KERNEL32(?), ref: 00B28E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B28EA5
HeapFree.KERNEL32(00000000), ref: 00B28EAC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 8cbf27de42f00a2f6f0d65497703c0bfcb92285f161b795be17e885ebfafb15f
Instruction ID: f765d12f72109b67adfe70db2359d36a76d6242b742638e6b198cf939bb7d92f
Opcode Fuzzy Hash: 8cbf27de42f00a2f6f0d65497703c0bfcb92285f161b795be17e885ebfafb15f
Instruction Fuzzy Hash: 63E0C236004602FBDA012FE1EC0CA2AFB69FB89323B108270F22992470CF72A421DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B48902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B48928
CharUpperBuffW.USER32(?,?), ref: 00B48A37
VariantClear.OLEAUT32(?), ref: 00B48BAF

Part of subcall function 00B37804: VariantInit.OLEAUT32(00000000), ref: 00B37844
Part of subcall function 00B37804: VariantCopy.OLEAUT32(00000000,?), ref: 00B3784D
Part of subcall function 00B37804: VariantClear.OLEAUT32(00000000), ref: 00B37859

Strings

AUTOIT.ERROR, xrefs: 00B48A3D
Incorrect Parameter format, xrefs: 00B48960, 00B48B22

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a3e69632cc3fd3f32332b4d92548b75cddd0e8cfaf6f77a8db03ce4568357e3b
Instruction ID: 1773ed9ba077b01d6472377a54aa4131c5b3fa6f46163e09b5aa38f3380f7b13
Opcode Fuzzy Hash: a3e69632cc3fd3f32332b4d92548b75cddd0e8cfaf6f77a8db03ce4568357e3b
Instruction Fuzzy Hash: 70917B716087019FC710EF24C58496BBBF4EF88744F0489AEF89A8B361DB31EA45DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B32F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEFEC6: _wcscpy.LIBCMT ref: 00AEFEE9

_memset.LIBCMT ref: 00B33077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B330A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B33159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B33187

Strings

0, xrefs: 00B33063

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 44f3b0eb681b0e7355c01dc34ae238e6119852324f0284b59fe4371b98912d2a
Instruction ID: 341faf894aa34a05203335d04f810984e6f7231c8dd657ad9b91b30fbbe823f4
Opcode Fuzzy Hash: 44f3b0eb681b0e7355c01dc34ae238e6119852324f0284b59fe4371b98912d2a
Instruction Fuzzy Hash: 2751E6316083009FD7299F28D985B6BBBE4EF45B50F240AAEF885E3191DB74CE44C792

Uniqueness

Uniqueness Score: -1.00%

Function 00B2DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B2DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B2DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B2DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B2DB8E

Strings

DllGetClassObject, xrefs: 00B2DB01

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 0e1a392400fba61075da5a48dc1017a084ed34c55dbd605440480b2a59106a67
Instruction ID: cf4e5664a7b7a2c272357f8b317b31d29b54af0d49946d5e55fad7a9731edff8
Opcode Fuzzy Hash: 0e1a392400fba61075da5a48dc1017a084ed34c55dbd605440480b2a59106a67
Instruction Fuzzy Hash: 6A418FB1600218EFDB15CF64D888BAABBE9EF48310F1580E9AD09DF255D7B1D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B32C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B32CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B32CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00B32D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B96890,00000000), ref: 00B32D5A

Strings

0, xrefs: 00B32CA4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 7ef732d99f518e45bc242625bcede9d0e9795e12871aeccdd28437d51a760243
Instruction ID: aa298e65e8b31f54e786baa9aef71cd37c3e3119448ffa37ad077f5236738b3e
Opcode Fuzzy Hash: 7ef732d99f518e45bc242625bcede9d0e9795e12871aeccdd28437d51a760243
Instruction Fuzzy Hash: E84184712043029FDB24DF28D885B5BB7E4FF85720F2446AEF96597291DB70E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B4DAD9

Part of subcall function 00AD79AB: _memmove.LIBCMT ref: 00AD79F9

Strings

stdcall, xrefs: 00B4DB5B
winapi, xrefs: 00B4DB4A
cdecl, xrefs: 00B4DB30
none, xrefs: 00B4DBB4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 7d94ed6ff21a61aaf8108e169c212f7a364ab5ad51bdeeaf52b44345e77866ca
Instruction ID: 5eb9ccabba1008f1f6ed19c0bbbef0730821fdbda9095bdb73eb7635811948c1
Opcode Fuzzy Hash: 7d94ed6ff21a61aaf8108e169c212f7a364ab5ad51bdeeaf52b44345e77866ca
Instruction Fuzzy Hash: 9531657150061A9FCF14EF64C9819BEB3F4FF05710B1086AAE876A77A1DB71AA05DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B29372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B293F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B29409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B29439

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Strings

ListBox, xrefs: 00B293B5
ComboBox, xrefs: 00B29380

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 7f0e86d0ed8584a6b4e9648441e535f46954b76b1a54d78b641b1251fb6662f9
Instruction ID: e36b4f014d6d401f5f2b52cca99b42dccd0871d71fccbd164e43fb4e79ef130c
Opcode Fuzzy Hash: 7f0e86d0ed8584a6b4e9648441e535f46954b76b1a54d78b641b1251fb6662f9
Instruction Fuzzy Hash: F2219471900214BADB28ABB4EC85DFFB7A8DF45350F1441AAF92A972E1DF35490AD610

Uniqueness

Uniqueness Score: -1.00%

Function 00B41B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B41B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B41B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B41B96
InternetCloseHandle.WININET(00000000), ref: 00B41BDD

Part of subcall function 00B42777: GetLastError.KERNEL32(?,?,00B41B0B,00000000,00000000,00000001), ref: 00B4278C
Part of subcall function 00B42777: SetEvent.KERNEL32(?,?,00B41B0B,00000000,00000000,00000001), ref: 00B427A1

Strings

, xrefs: 00B41B87

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: e23a8db9cfdea0457d386e4b8bdfd6c1513578e2da2b1040aad0d165ef9c5bb8
Instruction ID: 40054dd1f52ffa5d47f130bf7da8cdddfb6e857eb10b93b7bca902554732f397
Opcode Fuzzy Hash: e23a8db9cfdea0457d386e4b8bdfd6c1513578e2da2b1040aad0d165ef9c5bb8
Instruction Fuzzy Hash: 82219FB1900308BFEB119F689CC5EBF76ECEB49744F1045AAF545A7240EB209E45A761

Uniqueness

Uniqueness Score: -1.00%

Function 00B56656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AD1D73
Part of subcall function 00AD1D35: GetStockObject.GDI32(00000011), ref: 00AD1D87
Part of subcall function 00AD1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AD1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B566D0
LoadLibraryW.KERNEL32(?), ref: 00B566D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B566EC
DestroyWindow.USER32(?), ref: 00B566F4

Strings

SysAnimate32, xrefs: 00B566AB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: af77a6411191a64264c5fe87d5d4aa26c144519f2eb7cde8394bd78a2837eb7a
Instruction ID: 21eb3bab3268f6112ca6013f8b41f97a6e59eb493b16554bc69cabf39d9d2c75
Opcode Fuzzy Hash: af77a6411191a64264c5fe87d5d4aa26c144519f2eb7cde8394bd78a2837eb7a
Instruction Fuzzy Hash: DD21CD71200206ABEF108F64EC80FBB77EDEB1932AF9002A9FD11931A0CB71CC459B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B3703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B3705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B37091
GetStdHandle.KERNEL32(0000000C), ref: 00B370A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00B370DD

Strings

nul, xrefs: 00B370D8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 03f6f7b1b6636da755d4fa3230d9deac4eb48a95bea0c2ccc178989d5379f691
Instruction ID: 87574477f53eae5aa568c81d2483ed917e77914089739b52a6ffe9408542586f
Opcode Fuzzy Hash: 03f6f7b1b6636da755d4fa3230d9deac4eb48a95bea0c2ccc178989d5379f691
Instruction Fuzzy Hash: BA214FB454430AABDB349F68D845A9AB7E8EF44720F304699F8A1D72D0DF7198508B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B3712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B3715D
GetStdHandle.KERNEL32(000000F6), ref: 00B3716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00B371A8

Strings

nul, xrefs: 00B371A3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a743c05476c9f5d93da59fff510913f415a948b809c7477a7d96c15119cb1a64
Instruction ID: 1de84d56c2bd2f95ebbd217a12f8909bb043485b3d14601e90b0f1760d99f8b9
Opcode Fuzzy Hash: a743c05476c9f5d93da59fff510913f415a948b809c7477a7d96c15119cb1a64
Instruction Fuzzy Hash: A821A4B6544706ABDB309F689C44BAAB7E8EF55720F300699FCA0E72D0DF709841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B3AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B3AF13
__swprintf.LIBCMT ref: 00B3AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00B5F910), ref: 00B3AF6A

Strings

%lu, xrefs: 00B3AF26

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 3ff7fb1c8b0615cc8244d9f8e4a7909eb7198f1d22c863a6102a377d378400b8
Instruction ID: 430ef29ca3de88f00e19510e82aefae45691d617a3130dec589a4b758ac2b58f
Opcode Fuzzy Hash: 3ff7fb1c8b0615cc8244d9f8e4a7909eb7198f1d22c863a6102a377d378400b8
Instruction Fuzzy Hash: CA214731600209AFCB10EF54C985EAEBBF8EF49704B1040A9F905E7361DB71EA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B2A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

Part of subcall function 00B2A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B2A399
Part of subcall function 00B2A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B2A3AC
Part of subcall function 00B2A37C: GetCurrentThreadId.KERNEL32 ref: 00B2A3B3
Part of subcall function 00B2A37C: AttachThreadInput.USER32(00000000), ref: 00B2A3BA

GetFocus.USER32 ref: 00B2A554

Part of subcall function 00B2A3C5: GetParent.USER32(?), ref: 00B2A3D3

GetClassNameW.USER32(?,?,00000100), ref: 00B2A59D
EnumChildWindows.USER32(?,00B2A615), ref: 00B2A5C5
__swprintf.LIBCMT ref: 00B2A5DF

Strings

%s%d, xrefs: 00B2A5D9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 04f3d15e19e202522d6510132c84077c3977540a60cdc8d094552dc904e71842
Instruction ID: 1cb0b3f5bc8df7d1f637b2c3bbf48eb0d5f9d1949fb8a5937d579d0ebf95bd17
Opcode Fuzzy Hash: 04f3d15e19e202522d6510132c84077c3977540a60cdc8d094552dc904e71842
Instruction Fuzzy Hash: FA11AF71600219ABDF11BF60EC85FFA77B9AF48701F0440F6B90CAA152DB7459458B75

Uniqueness

Uniqueness Score: -1.00%

Function 00B32017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B32048

Strings

REMOVE, xrefs: 00B3204E
KEYS, xrefs: 00B3205F
APPEND, xrefs: 00B32081
EXISTS, xrefs: 00B32070

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 95922dcd3fb4e87d215ef2f231a77ff7693eebce71166a70098ee0659f2b4ca3
Instruction ID: b1616a6a5c619e75a82a13a389abb43883ddcde3a8dfd3cd06b50b145f358c9f
Opcode Fuzzy Hash: 95922dcd3fb4e87d215ef2f231a77ff7693eebce71166a70098ee0659f2b4ca3
Instruction Fuzzy Hash: 6C115E319001098FCF14EFA4D9919FEB7F4FF16304F1084A9E95567262EB32590ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B4EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B4EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00B4F07E
CloseHandle.KERNEL32(?), ref: 00B4F0FF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 65f083f5ec7ad91d8c6e8140bebf290ba8232a8220004bc46340d9a0f6055d74
Instruction ID: 1f4c3db1639fff9804cd92348b2c3ec9973332d8f33d16f19dbb6786cf09886f
Opcode Fuzzy Hash: 65f083f5ec7ad91d8c6e8140bebf290ba8232a8220004bc46340d9a0f6055d74
Instruction Fuzzy Hash: 6C813E716043119FE720EF28C986B2AB7E5EF88710F14885EF59ADB392DB70ED418B51

Uniqueness

Uniqueness Score: -1.00%

Function 00B502C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B510A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B50038,?,?), ref: 00B510BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B50388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B503C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B5040E
RegCloseKey.ADVAPI32(?,?), ref: 00B5043A
RegCloseKey.ADVAPI32(00000000), ref: 00B50447

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 952d498c48278b6a26e143dd098444ac38fe8771ef7a1b369b36565b48355c1d
Instruction ID: 02150745aa6a5350a17c2d971286d8995df643d0d4c333b7edb30babb844576b
Opcode Fuzzy Hash: 952d498c48278b6a26e143dd098444ac38fe8771ef7a1b369b36565b48355c1d
Instruction Fuzzy Hash: 6F514E31114205AFD704EF64D981F6EB7E8FF88305F04899EB996872A1DB30E908CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B4DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00B4DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B4DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00B4DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B4DD35

Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B37B20,?,?,00000000), ref: 00AD5B8C
Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B37B20,?,?,00000000,?,?), ref: 00AD5BB0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: cbc6bba0d189d20aab463833b7d268cb2ad78e3e96626efdacf7e1a5dc026d97
Instruction ID: 3af537bff542ce901cef5afd92a1e72c1e0ba9d6bdccba73bdf23bbdc727380c
Opcode Fuzzy Hash: cbc6bba0d189d20aab463833b7d268cb2ad78e3e96626efdacf7e1a5dc026d97
Instruction Fuzzy Hash: 2A511A35A00615EFCB00EF68C5849ADB7F4FF59310B1480AAE816AB322DB30EE45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B3E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00B3E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B3E8F2

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B3E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B3E91F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 49dc7efca35396b7b189212187ee26f9aca7cfb75d5635da02bc5f3cd5e5f7fd
Instruction ID: 4700900d6ec98030fa054fe85f4372a4092efbad6b04b3512a23b96e0142fa8d
Opcode Fuzzy Hash: 49dc7efca35396b7b189212187ee26f9aca7cfb75d5635da02bc5f3cd5e5f7fd
Instruction Fuzzy Hash: 0E510E35A00215EFCB05EF64C991AAEBBF5EF08310F148099F94AAB361CB31ED51DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B5A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b641529e9586a7e149ae61a5ca7046a805fa2e46c8c3f57f72ff928317eecf1
Instruction ID: da4bb7a03e37ecda2b2d55ef2d8032072c1cefa988fcc01f4733c51c5ea3440c
Opcode Fuzzy Hash: 1b641529e9586a7e149ae61a5ca7046a805fa2e46c8c3f57f72ff928317eecf1
Instruction Fuzzy Hash: 0341E035900204ABD720DB68DC88FA9BBE8EB09312F1402E5FC55B72E0DB70AE49CA55

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AD2357
ScreenToClient.USER32(00B967B0,?), ref: 00AD2374
GetAsyncKeyState.USER32(00000001), ref: 00AD2399
GetAsyncKeyState.USER32(00000002), ref: 00AD23A7

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 2a3dc4134aab41b23a0221f9294462b1bc80bdae53612590ee80305bb3582619
Instruction ID: 478b6d30a67636c7be41e5e61f068bf8959b5853e1194f850a943ac1b871f7c1
Opcode Fuzzy Hash: 2a3dc4134aab41b23a0221f9294462b1bc80bdae53612590ee80305bb3582619
Instruction Fuzzy Hash: E7417C35504219FBDF159F68C844BE9BFB4FB15360F20439AF829A62A0C734AD94DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B26920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00B269A9
TranslateMessage.USER32(?), ref: 00B269D2
DispatchMessageW.USER32(?), ref: 00B269DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B269EB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 45b2ddcc06ea8864bdc736391a518b82e4ed34b512b30bbf49a8fc811a317618
Instruction ID: 4d1fade28f0de5c70dd0aad61c6706101f9a85eac2163c21e9081e0709e04af4
Opcode Fuzzy Hash: 45b2ddcc06ea8864bdc736391a518b82e4ed34b512b30bbf49a8fc811a317618
Instruction Fuzzy Hash: 87318371900266AADB20CF74AC84BB6BBECEB1A304F1441E6E429D31A1DF75D8C5D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B28F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B28F12
PostMessageW.USER32(?,00000201,00000001), ref: 00B28FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00B28FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00B28FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00B28FDA

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5fdc8fcf5288aefb12bb400e41cc7cb419d5e82d5bbefe189f8ccd8c5d9f7c41
Instruction ID: b9cf33d7e8bd126e80365edf96956abc3ccd672e00ba8e49001aaeee2f590e21
Opcode Fuzzy Hash: 5fdc8fcf5288aefb12bb400e41cc7cb419d5e82d5bbefe189f8ccd8c5d9f7c41
Instruction Fuzzy Hash: DA31C771501219EFDF14CF68EA4CAAE7BB6EB04315F104665F929E71D0C7709914DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B2B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B2B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B2B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B2B742
_wcsstr.LIBCMT ref: 00B2B74C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 54f9cdf318318dd8a3c78d24155c00d83d351e1d4cd7539b01477717900ef739
Instruction ID: 775f5ccfa6e0549054d3a541a03e9f6b3bd1fb42d218a1b987ebebdfa2207df7
Opcode Fuzzy Hash: 54f9cdf318318dd8a3c78d24155c00d83d351e1d4cd7539b01477717900ef739
Instruction Fuzzy Hash: 3F210732204215BAEB255B79AD49E7BBBE8DF49710F0040B9F909CA1A1EF61DC40D260

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

GetWindowLongW.USER32(?,000000F0), ref: 00B5B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00B5B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B5B489
GetSystemMetrics.USER32(00000004), ref: 00B5B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00B41184,00000000), ref: 00B5B4D0

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 5cf80bc629cc71a7f8794578fd82da1a1227118b0fe133657c8efbb61a5306ba
Instruction ID: acda3cfa48800fac44b716d784f2f3fecc7968434bb9a223817c75a8ef7fe9da
Opcode Fuzzy Hash: 5cf80bc629cc71a7f8794578fd82da1a1227118b0fe133657c8efbb61a5306ba
Instruction Fuzzy Hash: 57217E31510216AFDB209F389C84F6A77A4EB05722F1146B9ED26C72E1EB309814DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B297E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B29802

Part of subcall function 00AD7D2C: _memmove.LIBCMT ref: 00AD7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B29834
__itow.LIBCMT ref: 00B2984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B29874
__itow.LIBCMT ref: 00B29885

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 38a0a7f0b3c3bd29898ae9c4a8513a1d4b31ea545fe7b68e1dcc863ebe5a526a
Instruction ID: cd37842d68a85cbb826dfbc51da5a5a12ee638628ea238312b979e2c82319745
Opcode Fuzzy Hash: 38a0a7f0b3c3bd29898ae9c4a8513a1d4b31ea545fe7b68e1dcc863ebe5a526a
Instruction Fuzzy Hash: 2321C571B00218ABDB10AA659C86EFE7BE9EF4A750F0800A5FD0DDF251EA709D45C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD134D
SelectObject.GDI32(?,00000000), ref: 00AD135C
BeginPath.GDI32(?), ref: 00AD1373
SelectObject.GDI32(?,00000000), ref: 00AD139C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2b19e3af8e6436854d6429c71aea424302c96151d89045e57a2e23b1cc13cd21
Instruction ID: 15ac9c17b237aee11f60b5211dd6df23888802e8ab057d7db615712ea4489300
Opcode Fuzzy Hash: 2b19e3af8e6436854d6429c71aea424302c96151d89045e57a2e23b1cc13cd21
Instruction Fuzzy Hash: 5F215070800309EFDB119F25DE487A97BF9FB10362F188267F8119B2B0DB719991DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00B2C176
_memcmp.LIBCMT ref: 00B2C194
_memcmp.LIBCMT ref: 00B2C1A7
_memcmp.LIBCMT ref: 00B2C1BF
_memcmp.LIBCMT ref: 00B2C1D7

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 79c7f0cdd9002ccf6ece160bc259dc62f035beeab322b5e92e2fe74c361017a7
Instruction ID: fa35c2668a2e85b0561bc6b8d7c6026914b3c9441a8d13f872efd0b1dd1e4473
Opcode Fuzzy Hash: 79c7f0cdd9002ccf6ece160bc259dc62f035beeab322b5e92e2fe74c361017a7
Instruction Fuzzy Hash: E701B9716045297BF204A6206D43F7F7BDCDF21399F044161FE08E6293E765DE2282E4

Uniqueness

Uniqueness Score: -1.00%

Function 00B34D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B34D5C
__beginthreadex.LIBCMT ref: 00B34D7A
MessageBoxW.USER32(?,?,?,?), ref: 00B34D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B34DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B34DAC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 8c122944f3a4b69ebf39bdaf826a5342e1dac1d00981a7510c66da41805a6eec
Instruction ID: 44427068c4ebae1db42a234f5224eda64c363f7eced0f9b060078cd7957d1edb
Opcode Fuzzy Hash: 8c122944f3a4b69ebf39bdaf826a5342e1dac1d00981a7510c66da41805a6eec
Instruction Fuzzy Hash: A2110872904209BBC7119BB89C04AAB7FECEB45321F2442AAF914D3260DB759D0087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B28766
GetLastError.KERNEL32(?,00B2822A,?,?,?), ref: 00B28770
GetProcessHeap.KERNEL32(00000008,?,?,00B2822A,?,?,?), ref: 00B2877F
HeapAlloc.KERNEL32(00000000,?,00B2822A,?,?,?), ref: 00B28786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2879D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 7ef76664aa2ab0b44978ff6167c2514b5964ad5fd28bda45b7db95f8e8a2599c
Instruction ID: 8b2fd2b7addeb6393c716caaa216d85d409c9c7748eeb406a2bda7d85401b73d
Opcode Fuzzy Hash: 7ef76664aa2ab0b44978ff6167c2514b5964ad5fd28bda45b7db95f8e8a2599c
Instruction Fuzzy Hash: 84014F71601215EFDB104FA5EC48DABBBACEF8535672004A9F949C3160DE718C10CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00B354E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B35502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B35510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B35518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B35522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B3555E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: b413016003b632314c29793f2de5184de9d7646738e1a3c1d7a7ca9bf3549b05
Instruction ID: 521495f7118b779155adbbb3c28985d720a52a455ecda6190c8be8ce27713071
Opcode Fuzzy Hash: b413016003b632314c29793f2de5184de9d7646738e1a3c1d7a7ca9bf3549b05
Instruction Fuzzy Hash: 1D010C35D11A19DBCF10ABE4E8886EDFBB9FB19712F110496E501B2140DB31955487A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B27652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?,?,00B2799D), ref: 00B2766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?), ref: 00B2768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?), ref: 00B27698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?), ref: 00B276A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B2758C,80070057,?,?), ref: 00B276B4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 1c500d42c57fbea4bbe2aca385a4f9152b11d22469088f5fd64eade8f3030a9e
Instruction ID: 2055c54cf52533c27ec11492934f3b7281b57d197113a9af876f42c5dba48028
Opcode Fuzzy Hash: 1c500d42c57fbea4bbe2aca385a4f9152b11d22469088f5fd64eade8f3030a9e
Instruction Fuzzy Hash: 1401B172601725ABDB119F58EC44BAABBEDEB48752F1040A8FD08D3211EF31DD0187A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B285F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B28608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B28612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B28621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B28628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B2863E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4935675dab7ea879be935cfcc65af1c8f79c6dca6d29f455eb77dc98fa7e03ae
Instruction ID: 7ed0a1c8731d81e028af7495bc1bf67a2a39429360f50365ba63c15aa6acc910
Opcode Fuzzy Hash: 4935675dab7ea879be935cfcc65af1c8f79c6dca6d29f455eb77dc98fa7e03ae
Instruction Fuzzy Hash: 72F08C34202316AFEB210FA4EC8DF7B7BACEF89755B0400A5F90983190CEA09C41DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00B28652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B28669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B28673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B28682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B28689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B2869F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1849e8c1f12324ca5510f4976d3c498c25a41479786129a10e256f460b4ea90f
Instruction ID: 52bd12ed66e0b2af72012db1705a227a0c70cfeb266e06426db195ca0dfd6ead
Opcode Fuzzy Hash: 1849e8c1f12324ca5510f4976d3c498c25a41479786129a10e256f460b4ea90f
Instruction Fuzzy Hash: 32F0AF70202315AFEB121FA4EC88FBB7BADEF89756B1400A5F909C3190CEA09801DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B2C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B2C6D1
MessageBeep.USER32(00000000), ref: 00B2C6E9
KillTimer.USER32(?,0000040A), ref: 00B2C705
EndDialog.USER32(?,00000001), ref: 00B2C71F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 96d60268398a8240a20bc2a7bc1cead3059c85e8e8d9443e688c564f7da7da4d
Instruction ID: e04fe54385b9b36f1cc6438fbd3b20fc5bf8916098cd94a3cab54735d782d3ac
Opcode Fuzzy Hash: 96d60268398a8240a20bc2a7bc1cead3059c85e8e8d9443e688c564f7da7da4d
Instruction Fuzzy Hash: 8D01443050071597EB216B20ED9EFAABBB8FB04706F0005A9B546A24E1DBE06D54CE41

Uniqueness

Uniqueness Score: -1.00%

Function 00AD13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00AD13BF
StrokeAndFillPath.GDI32(?,?,00B0BAD8,00000000,?), ref: 00AD13DB
SelectObject.GDI32(?,00000000), ref: 00AD13EE
DeleteObject.GDI32 ref: 00AD1401
StrokePath.GDI32(?), ref: 00AD141C

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 11b713ce674b601a923d577ddf124c863be0c4c6b56f538d8a190d5611f35092
Instruction ID: f043b6418bd239bdafa9f7d8f6fe89dfa03c5d1b55710988b1a41286293e9754
Opcode Fuzzy Hash: 11b713ce674b601a923d577ddf124c863be0c4c6b56f538d8a190d5611f35092
Instruction Fuzzy Hash: A6F0E7B0004709EBDB155F26EE8CB687FA5AB11326F08C267E42A8A1F1CB318995DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B3C69D
CoCreateInstance.OLE32(00B62D6C,00000000,00000001,00B62BDC,?), ref: 00B3C6B5

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

CoUninitialize.OLE32 ref: 00B3C922

Strings

.lnk, xrefs: 00B3C631, 00B3C659, 00B3C663

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: e60409dd898ed95230ce7abe425c8b827d1705a7679cc5ed93fb71fb95abc980
Instruction ID: e85b2d6d81893bdb4bb1850a310b14a054aec48e21aa6b3fbacf8e11498a88cf
Opcode Fuzzy Hash: e60409dd898ed95230ce7abe425c8b827d1705a7679cc5ed93fb71fb95abc980
Instruction Fuzzy Hash: F7A12D71104205AFD700EF64C981EAFB7E8FF98744F00495DF1569B2A2EB70EA49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00AF0FF6: std::exception::exception.LIBCMT ref: 00AF102C
Part of subcall function 00AF0FF6: __CxxThrowException@8.LIBCMT ref: 00AF1041

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00AD7BB1: _memmove.LIBCMT ref: 00AD7C0B

__swprintf.LIBCMT ref: 00AE302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00AE2EC6

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 71de4934bb969d2d447d1295cf1bd4b8128d9d65fe75553f5e5af02880f505b5
Instruction ID: 6565177d1453cf89a660bb5f18a9bbc10078ba6d90f2fb4c93140082d84e1702
Opcode Fuzzy Hash: 71de4934bb969d2d447d1295cf1bd4b8128d9d65fe75553f5e5af02880f505b5
Instruction Fuzzy Hash: AD918F725083419FCB18EF24DA95C6EB7F8EF85740F40495EF482972A1EB20EE45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B3BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AD48A1,?,?,00AD37C0,?), ref: 00AD48CE

CoInitialize.OLE32(00000000), ref: 00B3BC26
CoCreateInstance.OLE32(00B62D6C,00000000,00000001,00B62BDC,?), ref: 00B3BC3F
CoUninitialize.OLE32 ref: 00B3BC5C

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

Strings

.lnk, xrefs: 00B3BC08, 00B3BC16

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: f205b33ad7563d6ccfabfbdd98bb3fb2a8725d8949fe90ee3567e77d19c28454
Instruction ID: c4678cd9688d658014061feee0fdb2049c767fd223b1db8d485e08e87f5b15b2
Opcode Fuzzy Hash: f205b33ad7563d6ccfabfbdd98bb3fb2a8725d8949fe90ee3567e77d19c28454
Instruction Fuzzy Hash: E7A15275604301AFCB10EF14C584E6ABBE5FF88314F148999F99A9B3A1CB31ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00AF52DD

Part of subcall function 00B00340: __87except.LIBCMT ref: 00B0037B

Strings

pow, xrefs: 00AF52B5, 00AF52D2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 9691c4085bcbe1a2a34bfe8464a2a181868bdf02d7b9c5532fa016b2aaff7fb5
Instruction ID: d4b55104e03db450407d32676ab854c536d92562dd8bf32c46cf5099b4456e41
Opcode Fuzzy Hash: 9691c4085bcbe1a2a34bfe8464a2a181868bdf02d7b9c5532fa016b2aaff7fb5
Instruction Fuzzy Hash: E4516A21E2DA0A87C7117778C9513BE2FE4EB00750F204A99F3D5862E9EF748CC49A4A

Uniqueness

Uniqueness Score: -1.00%

Function 00AF023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00AF0280
+, xrefs: 00AF0277

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: d63134579d0818ec0da8555243181cc9fedf37e5001c5177264aa7a1835a7409
Instruction ID: a4b3723b55e7097d5e930f3cc73cab288321245c0e96ad560510c37711b20896
Opcode Fuzzy Hash: d63134579d0818ec0da8555243181cc9fedf37e5001c5177264aa7a1835a7409
Instruction Fuzzy Hash: 7E51313550426ACFCF259F68D888EFE7BA4EF19310F1400A6F9959F2A1D7349C42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AE62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE63A8
_memmove.LIBCMT ref: 00AE6446
_memset.LIBCMT ref: 00AE646A

Strings

ERCP, xrefs: 00AE6313

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 60a2536a423983193db00c41c0d6ce3f7d4cbb0614f0ab77fd6b9ad91acc2e28
Instruction ID: b19cae0a3891bb02f1cf4c8af736f4fa943a54a660d1b132eddcbda6ad9d3164
Opcode Fuzzy Hash: 60a2536a423983193db00c41c0d6ce3f7d4cbb0614f0ab77fd6b9ad91acc2e28
Instruction Fuzzy Hash: FA51E671900359DFCB24DF65C981BAABBF4EF14354F2089AEE54ADB281E771E590CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B57BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B5F910,00000000,?,?,?,?), ref: 00B57C4E
GetWindowLongW.USER32 ref: 00B57C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B57C7B

Strings

SysTreeView32, xrefs: 00B57C20

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9c615bf9067ee3d5cb63ba9ee21bf7dead52a5ea49f36c52a7f0c632d166b9eb
Instruction ID: eb60bb98db6368c71c9f7f689d20b686fd3c34840b87be7699a2441148bb68c5
Opcode Fuzzy Hash: 9c615bf9067ee3d5cb63ba9ee21bf7dead52a5ea49f36c52a7f0c632d166b9eb
Instruction Fuzzy Hash: 4531BC31244206ABDB119F38EC45BEA77E9EF09325F2447A5FC76A32E0DB31E8549B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B57648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B576D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B576E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B57708

Strings

SysMonthCal32, xrefs: 00B5769B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5ac38e6e2af92afbfc82bd883e3b233225670ca7381dac186df780065b99e030
Instruction ID: 16c61a142a66c633009913f75e2d02217ec5eced1d85f773eb2243a48f508c2a
Opcode Fuzzy Hash: 5ac38e6e2af92afbfc82bd883e3b233225670ca7381dac186df780065b99e030
Instruction Fuzzy Hash: D521A132650219BBDF11CFA4DC46FEA3BA9EF48724F110294FE156B1D0DAB1AC54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B56F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B56FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B56FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B56FDF

Strings

Listbox, xrefs: 00B56F77

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 485c69c2d1f83e89c080bfe72b3e80d6d271c3f19391748c3cd1c55fc5ab6d42
Instruction ID: 85b83bcc5b4e55c6dae8569356efefe0e1de9d163090a3130bdf51fe3c01a9bf
Opcode Fuzzy Hash: 485c69c2d1f83e89c080bfe72b3e80d6d271c3f19391748c3cd1c55fc5ab6d42
Instruction Fuzzy Hash: 8121C532A10218BFDF118F54DC85FBB37AAEF89751F4181A4F9149B1A0CA71AC55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B579E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B579F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B57A03

Strings

msctls_trackbar32, xrefs: 00B579B8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: aa8126cb7dafac871fd26b5608489af232bd6617e04ef6573d153699bb8ad16a
Instruction ID: 22f8b74c764d2c5e04222edb5ef841efbb6e74ecb550deb39bc98839a21e35af
Opcode Fuzzy Hash: aa8126cb7dafac871fd26b5608489af232bd6617e04ef6573d153699bb8ad16a
Instruction Fuzzy Hash: 10110632294208BBEF109F70DC05FEB77E9EF89B65F010559FA41A60A0DB71E811CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AD4C2E), ref: 00AD4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AD4CB5

Strings

kernel32.dll, xrefs: 00AD4C9E
GetNativeSystemInfo, xrefs: 00AD4CAF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: f59ea2ae86704f873d5ecf1778065d5fe07f44d1414d0e9e743f169e4c63b0c8
Instruction ID: 8a2b1a48a912b86468fa9cbb1ec100abd6dbac93bf78c288aa2db9deb529c3d3
Opcode Fuzzy Hash: f59ea2ae86704f873d5ecf1778065d5fe07f44d1414d0e9e743f169e4c63b0c8
Instruction Fuzzy Hash: 06D01230510723CFD7205F31DA58716B6D5AF05752B1188BA9886D7260EA70D480CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AD4CE1,?), ref: 00AD4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AD4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AD4DAE
kernel32.dll, xrefs: 00AD4D9D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 9084abbcdd7f4c9e984e471d85e69ce1995171910efcf8dfdfb5b81ac240158c
Instruction ID: a097b07602f31abfdb0e0b4ad7c3a96fcc1541c80d91d0519c06703d94ee3409
Opcode Fuzzy Hash: 9084abbcdd7f4c9e984e471d85e69ce1995171910efcf8dfdfb5b81ac240158c
Instruction Fuzzy Hash: F3D01731550B13CFE720AF31D808B56B6E5AF09356B2188BAD8D6E7260EB70D880CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AD4D2E,?,00AD4F4F,?,00B962F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AD4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AD4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00AD4D7B
kernel32.dll, xrefs: 00AD4D6A

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: a9aad021cb92de3e93c4c7d740a5e211cc84eca36d0ef3054b48388ca2a77217
Instruction ID: b5527cbd48008266e6a426b860c2e06856f450ed4f391b3099cf1ce9f6d9ef37
Opcode Fuzzy Hash: a9aad021cb92de3e93c4c7d740a5e211cc84eca36d0ef3054b48388ca2a77217
Instruction Fuzzy Hash: 74D01730510B13CFD720AF31D808766B6E9AF19352B2188BA98D7E7260EA70D880CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00B51072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00B512C1), ref: 00B51080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B51092

Strings

RegDeleteKeyExW, xrefs: 00B5108C
advapi32.dll, xrefs: 00B5107B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b9f178d36dfb6654d4b5323d6652244a0577cac94d0fcf0ffdfe64098c32df31
Instruction ID: 730cf1bb682b5a68a950a7c7871cc257c9f7f7debbbf1bd7959b30c3b5934c03
Opcode Fuzzy Hash: b9f178d36dfb6654d4b5323d6652244a0577cac94d0fcf0ffdfe64098c32df31
Instruction Fuzzy Hash: C5D0EC31510713CFD7206F35D858B26B6E4EF05392B158CA9A885D71A0DB70C480CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B493F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00B49009,?,00B5F910), ref: 00B49403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B49415

Strings

GetModuleHandleExW, xrefs: 00B4940F
kernel32.dll, xrefs: 00B493FE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: b2e081eae7e05f5aa629197e57b06fe63da2e69c419598ebdf190dbd7c33b53e
Instruction ID: 9f5d1e51f4c93ebc09e7247820e033f6ee6b42f7040f11b325ff7678dbf1c51e
Opcode Fuzzy Hash: b2e081eae7e05f5aa629197e57b06fe63da2e69c419598ebdf190dbd7c33b53e
Instruction Fuzzy Hash: 37D01734510B13CFD720AF31DA0E727B6E5EF05352B11C8BAA896E7660EA70C980DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B11B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B11B42
__swprintf.LIBCMT ref: 00B11B73

Strings

WIN_XPe, xrefs: 00B11BB2
%.3d, xrefs: 00B11B4D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 2eeaabf3bc39eaf565e9fe83f7e36c61b79cfaa7ea1f14cc3cdffc6cee655ddd
Instruction ID: 0d28a360883239a824f1dee1e80f33aba8f6e3b86604f3e80e3cae6b8d5a03e3
Opcode Fuzzy Hash: 2eeaabf3bc39eaf565e9fe83f7e36c61b79cfaa7ea1f14cc3cdffc6cee655ddd
Instruction Fuzzy Hash: C6D012B1C0811DEACB049A949D849FBB3FCA704311F9009D3F602D2510F7359BC4DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00B276C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7704ac6b1928fd4c1fe257bcbde4cce3c9ab7f839a6102d08c0f205593ac125
Instruction ID: b117f389d052232a7f04636585dee9567989a9f2e3c1436a2c6e4372ade3541c
Opcode Fuzzy Hash: a7704ac6b1928fd4c1fe257bcbde4cce3c9ab7f839a6102d08c0f205593ac125
Instruction Fuzzy Hash: 66C14A75A44226EFCB14CF94D884AAEB7F5FF48710B1185D9E809EB261DB30ED81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B4E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B4E3D2
CharLowerBuffW.USER32(?,?), ref: 00B4E415

Part of subcall function 00B4DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B4DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00B4E615
_memmove.LIBCMT ref: 00B4E628

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 40b4d4ec0e248e65fa0ffb1e7284ed033ac240f2521ba25870ad31ad640b6734
Instruction ID: ea8282a3383eec8aaf0ccd7a202996cb7fecc0c5e294c27a214e211aef9b772d
Opcode Fuzzy Hash: 40b4d4ec0e248e65fa0ffb1e7284ed033ac240f2521ba25870ad31ad640b6734
Instruction Fuzzy Hash: 61C15E716083119FC714DF28C48096ABBE4FF89714F1489AEF9AA9B351D731EA45CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00B483A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B483D8
CoUninitialize.OLE32 ref: 00B483E3

Part of subcall function 00B2DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B2DAC5

VariantInit.OLEAUT32(?), ref: 00B483EE
VariantClear.OLEAUT32(?), ref: 00B486BF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 90da6129ab079bd950235344948639c4b153af4fea388d32960d6864fe901081
Instruction ID: 1d6d6c105765f8d5b3296848ab356991c251bda8ce9a13b49824bc8a77f61628
Opcode Fuzzy Hash: 90da6129ab079bd950235344948639c4b153af4fea388d32960d6864fe901081
Instruction Fuzzy Hash: DAA11675204711AFCB10DF24C591B2EB7E4BF88354F158489F99A9B3A2CB30EE04DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B27A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B62C7C,?), ref: 00B27C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B62C7C,?), ref: 00B27C4A
CLSIDFromProgID.OLE32(?,?,00000000,00B5FB80,000000FF,?,00000000,00000800,00000000,?,00B62C7C,?), ref: 00B27C6F
_memcmp.LIBCMT ref: 00B27C90

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 288059627e681824d1c0cab024757c3c085c01b5f0ffb08777b6440af9b58eba
Instruction ID: 6bf849e48b9590052111e33db63885e1de4391e2bd238b9e6350a62802b07a34
Opcode Fuzzy Hash: 288059627e681824d1c0cab024757c3c085c01b5f0ffb08777b6440af9b58eba
Instruction Fuzzy Hash: DA810C71A00119EFCB04DFA4D988EEEB7F9FF89315F204199E506AB250DB71AE05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B26DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B26E04
SysAllocString.OLEAUT32(00000000), ref: 00B26EAD
VariantCopy.OLEAUT32 ref: 00B26EDC
VariantClear.OLEAUT32(?), ref: 00B26F03

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: f5aef0602ef53fa0d64575e74ad0c55cd0ccc54a2e37cfdcce16a5d5ffa9b6d7
Instruction ID: 64a037044b7d4e759f838a988f12b555c7951e9d21a4a3a41758c27e80330f5f
Opcode Fuzzy Hash: f5aef0602ef53fa0d64575e74ad0c55cd0ccc54a2e37cfdcce16a5d5ffa9b6d7
Instruction Fuzzy Hash: 5F51B2306583129ADB30AF65F895A7BF3E5EF48310F20885FE59ECB291DF7098449B19

Uniqueness

Uniqueness Score: -1.00%

Function 00B59A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0148EA00,?), ref: 00B59AD2
ScreenToClient.USER32(00000002,00000002), ref: 00B59B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00B59B72

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a7f86e91c95d17960660c0c967198099cbc89849764ddb5485077b3aea498c9a
Instruction ID: 063e85633e954edf0c2217599a3ee62d3cebf9406893573c245b2adf33109c08
Opcode Fuzzy Hash: a7f86e91c95d17960660c0c967198099cbc89849764ddb5485077b3aea498c9a
Instruction Fuzzy Hash: A5510B34A00209EFDF14DF68D981AAE7BF5FB55361F1481AAFC159B2A0D730AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B46CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B46CE4
WSAGetLastError.WSOCK32(00000000), ref: 00B46CF4

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B46D58
WSAGetLastError.WSOCK32(00000000), ref: 00B46D64

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c1d387a985299addd2633a7d9b2bde68efaaf7886a9467f71926fb560eefb6ac
Instruction ID: ed27b2714baa29c5bc22076cf9d940642a331134e46ca31781e53d34d534dfbf
Opcode Fuzzy Hash: c1d387a985299addd2633a7d9b2bde68efaaf7886a9467f71926fb560eefb6ac
Instruction Fuzzy Hash: B441B475740210AFEB10AF24DD86F3A77E5EB08B10F448059FA5A9B3D2DB74DD008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00B5F910), ref: 00B467BA
_strlen.LIBCMT ref: 00B467EC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: cb3b35e729c7457240183ee1e51f81812951eadc5427a4254af7ce3b88fca56a
Instruction ID: 3d6a21856c4042d3c63ab26186b85a2f08984cb84ac4c3e6d906a54287a856c8
Opcode Fuzzy Hash: cb3b35e729c7457240183ee1e51f81812951eadc5427a4254af7ce3b88fca56a
Instruction Fuzzy Hash: 8E419031A00104AFCB14EBA4DDD5FBEB7E9EF59310F1481A6F81A9B292DB30AE01D751

Uniqueness

Uniqueness Score: -1.00%

Function 00B3BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B3BB09
GetLastError.KERNEL32(?,00000000), ref: 00B3BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B3BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B3BB80

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 11861d8937d1b8795a08e040284016f233f725c351d0eb86225142999a0453be
Instruction ID: 4bde15fcb7eb94168bae7135beb360061e158b04efd74a8f842a63ebd434a858
Opcode Fuzzy Hash: 11861d8937d1b8795a08e040284016f233f725c351d0eb86225142999a0453be
Instruction Fuzzy Hash: F2411539200A11EFCB10EF15C694A5ABBF1EF89310F199499F94A9B366CB34FD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B58AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B58B4D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 149b8aa38d8e1c631c6a92b61888f4dda7a0ef3d107bfe93d04371cf028af140
Instruction ID: 6ad9f39bae9392ebc1cf4745c6283f2c4884a572a5da976b1d60d93eb94e4aeb
Opcode Fuzzy Hash: 149b8aa38d8e1c631c6a92b61888f4dda7a0ef3d107bfe93d04371cf028af140
Instruction Fuzzy Hash: 3431D674600204BFEF209B18DC95FA937E9EB09352F1445D2FE51F72A0DE329948CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B5ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B5AE1A
GetWindowRect.USER32(?,?), ref: 00B5AE90
PtInRect.USER32(?,?,00B5C304), ref: 00B5AEA0
MessageBeep.USER32(00000000), ref: 00B5AF11

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9b95f511a83a1ee1146d99a354ea31ccb0b3c1de571173a49ff8ef10dc0fc84b
Instruction ID: 41dbf72c22f854f166e977ae37394349a9fd1af840955417d1ea7a752357f695
Opcode Fuzzy Hash: 9b95f511a83a1ee1146d99a354ea31ccb0b3c1de571173a49ff8ef10dc0fc84b
Instruction Fuzzy Hash: 2D418E70600219DFDB11DF58D885B69BBF5FB49342F2482EAE819EB251DB30A905CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B30FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00B31037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00B31053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00B310B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00B3110B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 79f98e8493d92caccc543964115bbf7e1bba6280b73a326e2caa138e4988392c
Instruction ID: d82a17eaee34bba2e1fbab2bff044b4969b5a24a42ce3f7bb840c683e8f2f52f
Opcode Fuzzy Hash: 79f98e8493d92caccc543964115bbf7e1bba6280b73a326e2caa138e4988392c
Instruction Fuzzy Hash: 4E313730E40688AEFF388A6D8C05BFABBEDEB48310F2846DAE580561D1C77489D49761

Uniqueness

Uniqueness Score: -1.00%

Function 00B31121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00B31176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B31192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B311F1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00B31243

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d98a263b30f2d1cd41fff19c4a3b151deb171efe8ccc94e086ef6a5d24681567
Instruction ID: 6b9a4705558411c5cb5dd3f49746ecd5288283ad9f9d1171b7b5cf14f31b1a1c
Opcode Fuzzy Hash: d98a263b30f2d1cd41fff19c4a3b151deb171efe8ccc94e086ef6a5d24681567
Instruction Fuzzy Hash: B1312830940B085AEF30DA6D8C147FABBFEEB49310F244BDAF580A21D1C7744D559761

Uniqueness

Uniqueness Score: -1.00%

Function 00B06415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B0644B
__isleadbyte_l.LIBCMT ref: 00B06479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00B064A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00B064DD

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 211ee7701cf59ec8161e7473615b49c0ac7e07c22053b8e400de31af88f2acea
Instruction ID: a21178f5d0f6597a23cb8479410c70e891cfcf1422443dfd90f35e8587a08142
Opcode Fuzzy Hash: 211ee7701cf59ec8161e7473615b49c0ac7e07c22053b8e400de31af88f2acea
Instruction Fuzzy Hash: CA31AB3160025AAFDB218F65C885BBE7FE9FF40320F1540A9F865972E1EB31D860DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B55175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B55189

Part of subcall function 00B3387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B33897
Part of subcall function 00B3387D: GetCurrentThreadId.KERNEL32 ref: 00B3389E
Part of subcall function 00B3387D: AttachThreadInput.USER32(00000000,?,00B352A7), ref: 00B338A5

GetCaretPos.USER32(?), ref: 00B5519A
ClientToScreen.USER32(00000000,?), ref: 00B551D5
GetForegroundWindow.USER32 ref: 00B551DB

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 9c71cc523339770658f01a092e5997049fcc9a2f93709a1744fc43bafd2f1903
Instruction ID: 367492ce3f00d8e804dd2cb6822f8768b9131819364e63ea0de7eff595b38f60
Opcode Fuzzy Hash: 9c71cc523339770658f01a092e5997049fcc9a2f93709a1744fc43bafd2f1903
Instruction Fuzzy Hash: 36313271900118AFDB00EFA5C985AEFB7FDEF58304F1040AAE416E7251EA759E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

GetCursorPos.USER32(?), ref: 00B5C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B0BBFB,?,?,?,?,?), ref: 00B5C7D7
GetCursorPos.USER32(?), ref: 00B5C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B0BBFB,?,?,?), ref: 00B5C85E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 28b740ca58e5d717d37cc6280cdc9e608e997d8eba4e12196f78366079453ab3
Instruction ID: a1cea4ccd20afc3712218182cc01c8152d95461ac06760170110200754af93aa
Opcode Fuzzy Hash: 28b740ca58e5d717d37cc6280cdc9e608e997d8eba4e12196f78366079453ab3
Instruction Fuzzy Hash: D7318C35600218AFCB159F58D8D8FBABFF6EB09351F0440EAF9058B261C7319D54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B28B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B28669
Part of subcall function 00B28652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B28673
Part of subcall function 00B28652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B28682
Part of subcall function 00B28652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B28689
Part of subcall function 00B28652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B2869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B28BEB
_memcmp.LIBCMT ref: 00B28C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B28C44
HeapFree.KERNEL32(00000000), ref: 00B28C4B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 1bb0d0cec1698603124b568e50f17f8c5d0de7e85e41c78ea9d114f425dac829
Instruction ID: 1d50030e93c752c90d4b45824d254951c8f36069e97d5fc9f0bff3111d7d44c1
Opcode Fuzzy Hash: 1bb0d0cec1698603124b568e50f17f8c5d0de7e85e41c78ea9d114f425dac829
Instruction Fuzzy Hash: 2621AC71E02219EFDB00DFA4D948BEEB7F8EF40355F184099E558A7240DB31AE06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00AF0BF2

Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B37B20,?,?,00000000), ref: 00AD5B8C
Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B37B20,?,?,00000000,?,?), ref: 00AD5BB0

_fprintf.LIBCMT ref: 00AF0C29
OutputDebugStringW.KERNEL32(?), ref: 00B26331

Part of subcall function 00AF4CDA: _flsall.LIBCMT ref: 00AF4CF3

__setmode.LIBCMT ref: 00AF0C5E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 917c67d11a665cfe926eaa76b00736e1087c574af20b7a3c452d86ee0c440f14
Instruction ID: e283a18c19762b9c14fa09160a09a0d59ad68f73aa83df87bf5c459faabd10ea
Opcode Fuzzy Hash: 917c67d11a665cfe926eaa76b00736e1087c574af20b7a3c452d86ee0c440f14
Instruction Fuzzy Hash: 00112432A0420C7ACB04B3F8AD86EBF7BA99F49320F14015AF305972A2DE615D828395

Uniqueness

Uniqueness Score: -1.00%

Function 00B41A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B41A97

Part of subcall function 00B41B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B41B40
Part of subcall function 00B41B21: InternetCloseHandle.WININET(00000000), ref: 00B41BDD

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: db79361f7ef026a9ca6bfce1c85d15b38f43839a72a69a63303a0da0446f5783
Instruction ID: 65a0d453dd085023c81fddc77a9c34924f58829973edb0c5038de1285ba64bda
Opcode Fuzzy Hash: db79361f7ef026a9ca6bfce1c85d15b38f43839a72a69a63303a0da0446f5783
Instruction Fuzzy Hash: FC21CF31600601BFDB129F648C40FBABBEDFF88701F10049AFA5197650EB31EA51BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00B2E1C4,?,?,?,00B2EFB7,00000000,000000EF,00000119,?,?), ref: 00B2F5BC
Part of subcall function 00B2F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00B2F5E2
Part of subcall function 00B2F5AD: lstrcmpiW.KERNEL32(00000000,?,00B2E1C4,?,?,?,00B2EFB7,00000000,000000EF,00000119,?,?), ref: 00B2F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00B2EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00B2E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00B2E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B2EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00B2E237

Strings

cdecl, xrefs: 00B2E22E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 88972ccee15ca439ba7a8f233d22aa0630f908546abf786674c9c8199470c496
Instruction ID: 632208995f1b55d874b6d1f95bad02a004d489dfd3810c22292877d6a9556669
Opcode Fuzzy Hash: 88972ccee15ca439ba7a8f233d22aa0630f908546abf786674c9c8199470c496
Instruction Fuzzy Hash: F211AC36200315EBCB25AF75E845A7A77F8FF84350B4040AAF91ACB2A0EF71D850C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B05332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B05351

Part of subcall function 00AF594C: __FF_MSGBANNER.LIBCMT ref: 00AF5963
Part of subcall function 00AF594C: __NMSG_WRITE.LIBCMT ref: 00AF596A
Part of subcall function 00AF594C: RtlAllocateHeap.NTDLL(01470000,00000000,00000001,00000000,?,?,?,00AF1013,?), ref: 00AF598F

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8a01737f784606249f252721cbda85da32828e354b57ed932e6e32464bd8125c
Instruction ID: 58c1d3a241d9231a6eb39f4027d4eb1d8843ad5b1c77780491739c77edf702f2
Opcode Fuzzy Hash: 8a01737f784606249f252721cbda85da32828e354b57ed932e6e32464bd8125c
Instruction Fuzzy Hash: CA11C432504A19AECF312FB0AD4577F7FD89F103E0B1044AAFA06975D0DF7589408B98

Uniqueness

Uniqueness Score: -1.00%

Function 00AD4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD4560

Part of subcall function 00AD410D: _memset.LIBCMT ref: 00AD418D
Part of subcall function 00AD410D: _wcscpy.LIBCMT ref: 00AD41E1
Part of subcall function 00AD410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AD41F1

KillTimer.USER32(?,00000001,?,?), ref: 00AD45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AD45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B0D6CE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 6380a08fa1a7771cdac85469e3ddc8d9023b017e5234e3972998e8e0a727fa9d
Instruction ID: 5acca0d8e6d4876323d73fb05b3afccd387842dfd1693493aff533ab5a8adc30
Opcode Fuzzy Hash: 6380a08fa1a7771cdac85469e3ddc8d9023b017e5234e3972998e8e0a727fa9d
Instruction Fuzzy Hash: F7218E70904784ABEB328B649899BE7BFEC9F05308F0400DEE69E57281CBB55E849B51

Uniqueness

Uniqueness Score: -1.00%

Function 00B4667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B37B20,?,?,00000000), ref: 00AD5B8C
Part of subcall function 00AD5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B37B20,?,?,00000000,?,?), ref: 00AD5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00B466AC
WSAGetLastError.WSOCK32(00000000), ref: 00B466B7
_memmove.LIBCMT ref: 00B466E4
inet_ntoa.WSOCK32(?), ref: 00B466EF

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 3d480965314cd8b0c7f7b9325ff31c826df4376ed821b8ec9ff45c34b7ed2ce3
Instruction ID: bfdfa256da1f1e589b1be2e5c604cc9454a09e9c6b280ac830616e7fc99ca231
Opcode Fuzzy Hash: 3d480965314cd8b0c7f7b9325ff31c826df4376ed821b8ec9ff45c34b7ed2ce3
Instruction Fuzzy Hash: 5D112E35900509AFCB04EFA4DE96DEEB7B8AF48311B1440A6F506A7261DF31AF04DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B29023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B29043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B29055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B2906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B29086

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d3067911f634292b63aa78a0012ba709810d33fa9ae89682f7960ec551d031a6
Instruction ID: 0622b0c453630ea543f9c61c801b872665a8b504384792f203a13e463c1f7654
Opcode Fuzzy Hash: d3067911f634292b63aa78a0012ba709810d33fa9ae89682f7960ec551d031a6
Instruction Fuzzy Hash: F7111C79901218FFEB11DFA5C985EAEBBB4FB48710F2040A5EA08B7250D6716E50DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AD1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00AD2612: GetWindowLongW.USER32(?,000000EB), ref: 00AD2623

DefDlgProcW.USER32(?,00000020,?), ref: 00AD12D8
GetClientRect.USER32(?,?), ref: 00B0B84B
GetCursorPos.USER32(?), ref: 00B0B855
ScreenToClient.USER32(?,?), ref: 00B0B860

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 32fe0d3bd7a9da93521ffdbeba53af2b0791a88a3a4bb87d80b89e56c47ce91d
Instruction ID: 02f86a66a92209c37006eec6a808cade862339ae6d28d2d0cefb69086a6d5958
Opcode Fuzzy Hash: 32fe0d3bd7a9da93521ffdbeba53af2b0791a88a3a4bb87d80b89e56c47ce91d
Instruction Fuzzy Hash: 50110A3590011ABFCB10EFA4D985EFEB7B9EB05301F1044A6F912E7251DB31BA52CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B31652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B301FD,?,00B31250,?,00008000), ref: 00B3166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00B301FD,?,00B31250,?,00008000), ref: 00B31694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B301FD,?,00B31250,?,00008000), ref: 00B3169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00B301FD,?,00B31250,?,00008000), ref: 00B316D1

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: ef32dcb0ab9f20d3c1a870eb6ebf4240b346e9e1af8841c8a5155200793ea1ac
Instruction ID: 78cb7b8cb8cc63c8fbb14ecb5ce0c5fb0934402800628c01d251f836bdcb7020
Opcode Fuzzy Hash: ef32dcb0ab9f20d3c1a870eb6ebf4240b346e9e1af8841c8a5155200793ea1ac
Instruction Fuzzy Hash: 54115A31C01A1DE7CF00AFE9D98AAFEBBB8FF09742F144495EA40B2240CB3055609B96

Uniqueness

Uniqueness Score: -1.00%

Function 00B07207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B0722B

Part of subcall function 00B07912: __fltout2.LIBCMT ref: 00B0793B

__cftog_l.LIBCMT ref: 00B07251
__cftoe_l.LIBCMT ref: 00B07283

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 6c5511d1637b2fb5143bc8670908f3f8709990b5f2f6b5625a122b1378250f4d
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: AE01803288414EBBCF525F84CC41CEE7FA2FF1A340B488595FA1858071CA37E9B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B5B59E
ScreenToClient.USER32(?,?), ref: 00B5B5B6
ScreenToClient.USER32(?,?), ref: 00B5B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B5B5F5

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e8f8bb3c9eb44f296bab75117f3bd4976419d1f4d99cd59f43de1c246f336449
Instruction ID: 712e5312a71067323ddf1f928cbdb946f8450efdb08bdadeae543beac3c6eba6
Opcode Fuzzy Hash: e8f8bb3c9eb44f296bab75117f3bd4976419d1f4d99cd59f43de1c246f336449
Instruction Fuzzy Hash: 5F1123B5D0024AAFDB41CF99D444AAEFBB5FB18311F1041A6E914A3220D775AA55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B5B8FE
_memset.LIBCMT ref: 00B5B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00B97F20,00B97F64), ref: 00B5B93C
CloseHandle.KERNEL32 ref: 00B5B94E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 4fee2086f28a5ada1f609b328c7bf80a3c2936a0a38a4114c260a6279a1f2b11
Instruction ID: 393d30eaab34d20517555f82f1e65361eddd3ba0a46a2e02c97aed9f78af5293
Opcode Fuzzy Hash: 4fee2086f28a5ada1f609b328c7bf80a3c2936a0a38a4114c260a6279a1f2b11
Instruction Fuzzy Hash: 38F05EB35943447BF7106761AD09FBB7ADCEB09355F0040B2BB08E61A2DF71890087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00B36E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00B36E88

Part of subcall function 00B3794E: _memset.LIBCMT ref: 00B37983

_memmove.LIBCMT ref: 00B36EAB
_memset.LIBCMT ref: 00B36EB8
LeaveCriticalSection.KERNEL32(?), ref: 00B36EC8

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 405ccf2f6f0a070aeb24cae0c9dfcb9daf6267c9dc96f8709bc70c7a538b05f4
Instruction ID: 8e60069471022338a1fbd56c071a6645381c1dd5a1e923da4ac944cb79aa9701
Opcode Fuzzy Hash: 405ccf2f6f0a070aeb24cae0c9dfcb9daf6267c9dc96f8709bc70c7a538b05f4
Instruction Fuzzy Hash: 94F0307A100204ABCF016F95DC85B5ABB69EF45321F1481A1FE085F216CB32A911CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AD12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD134D
Part of subcall function 00AD12F3: SelectObject.GDI32(?,00000000), ref: 00AD135C
Part of subcall function 00AD12F3: BeginPath.GDI32(?), ref: 00AD1373
Part of subcall function 00AD12F3: SelectObject.GDI32(?,00000000), ref: 00AD139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B5C030
LineTo.GDI32(00000000,?,?), ref: 00B5C03D
EndPath.GDI32(00000000), ref: 00B5C04D
StrokePath.GDI32(00000000), ref: 00B5C05B

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 987bcda0999025731385c499bcec380839c69c9376a8b6248444ece1647537a6
Instruction ID: d202cabadcd5c2ab883510357b9bd3a536bcbf5da8d690aa3ef8fae22262f226
Opcode Fuzzy Hash: 987bcda0999025731385c499bcec380839c69c9376a8b6248444ece1647537a6
Instruction Fuzzy Hash: 63F05E3100135ABBDB126F55AC0EFDE7F99AF15312F084092FA11620E28B765655CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00B2A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B2A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B2A3AC
GetCurrentThreadId.KERNEL32 ref: 00B2A3B3
AttachThreadInput.USER32(00000000), ref: 00B2A3BA

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 9f0b73e086f29ff78228f0ffb3a5a04cd3ea2c429c748b80968dab615cf13643
Instruction ID: a5635686e90136f9e8b35d68ab0bceedb947c3fce8f8a6f936ffbd3d7156eb97
Opcode Fuzzy Hash: 9f0b73e086f29ff78228f0ffb3a5a04cd3ea2c429c748b80968dab615cf13643
Instruction Fuzzy Hash: F2E0C931545339BBDB205BA2EC0DFE7BF5CEF167A2F0080A5F50996061CA718541DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AD2231
SetTextColor.GDI32(?,000000FF), ref: 00AD223B
SetBkMode.GDI32(?,00000001), ref: 00AD2250
GetStockObject.GDI32(00000005), ref: 00AD2258
GetWindowDC.USER32(?,00000000), ref: 00B0C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B0C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00B0C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00B0C112
GetPixel.GDI32(00000000,?,?), ref: 00B0C132
ReleaseDC.USER32(?,00000000), ref: 00B0C13D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 5241186b1f23ee38899b9f5d67fcd4140a85c0f29dadb972ab71da6ecf6dd026
Instruction ID: 60e51f744f979fc80da6e29a9329b332f8ef223e3247040890287aaed85c7246
Opcode Fuzzy Hash: 5241186b1f23ee38899b9f5d67fcd4140a85c0f29dadb972ab71da6ecf6dd026
Instruction Fuzzy Hash: ABE06D32100645EADB215F74FC0DBE8BF10EB15333F0083A6FAA9690E18B714980DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B28C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B28C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B2882E), ref: 00B28C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B2882E), ref: 00B28C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B2882E), ref: 00B28C7E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: cfd0fd37e30f01d45bf7c8cb8582cabf3cfa169ecc8723aa22001a6203208017
Instruction ID: 7c4d9755ccdb126dc2192764b9b177c65bd8060fb6f644c07e25ed36e8140b27
Opcode Fuzzy Hash: cfd0fd37e30f01d45bf7c8cb8582cabf3cfa169ecc8723aa22001a6203208017
Instruction Fuzzy Hash: 2CE04F76642322ABD7205FB07D0CB677BA8EF50793F0848A8B245CB080DE3484418B61

Uniqueness

Uniqueness Score: -1.00%

Function 00B12187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B12187
GetDC.USER32(00000000), ref: 00B12191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B121B1
ReleaseDC.USER32(?), ref: 00B121D2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: dd731edc7b1a906b3f892338911a583496a893e14cbaf2cb8928921852c5237c
Instruction ID: 42a64ce0d66755c082688adfa0172504ef69c51436d3989a59f5403d31f0e820
Opcode Fuzzy Hash: dd731edc7b1a906b3f892338911a583496a893e14cbaf2cb8928921852c5237c
Instruction Fuzzy Hash: 7DE0E575800216EFDB019F60C848BAEBBF1EB4C352F108466F95AE7260DB388142DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00B1219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B1219B
GetDC.USER32(00000000), ref: 00B121A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B121B1
ReleaseDC.USER32(?), ref: 00B121D2

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 4be724ff607d10077e1b88ecbcccf455d94b470922143404ddb7b6e56a3c2468
Instruction ID: 8e1ec4a7d438dfc8f4f9c77f0d894dce81e79293c1972d6a6385faaa83b325ce
Opcode Fuzzy Hash: 4be724ff607d10077e1b88ecbcccf455d94b470922143404ddb7b6e56a3c2468
Instruction Fuzzy Hash: 96E0E575800216AFCB019F60C8087AEBBB1AB4C352F108065F95AD7260DB389141DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00B2B981

Strings

AutoIt3GUI, xrefs: 00B2B8F9
Container, xrefs: 00B2B8FE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: d742aade1c0517ec809cdb8b5cfb031421f57bd297e13f9a6d99099241f50da2
Instruction ID: 9719f12aa98d088d65f552d6e0e87056060cabbc319b9423f040b61ca098164f
Opcode Fuzzy Hash: d742aade1c0517ec809cdb8b5cfb031421f57bd297e13f9a6d99099241f50da2
Instruction Fuzzy Hash: 9E914A746006119FDB24DF68D884E6ABBE9FF49710F1485AEF94ACB6A1DF70E840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEFEC6: _wcscpy.LIBCMT ref: 00AEFEE9

Part of subcall function 00AD9997: __itow.LIBCMT ref: 00AD99C2
Part of subcall function 00AD9997: __swprintf.LIBCMT ref: 00AD9A0C

__wcsnicmp.LIBCMT ref: 00B3B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00B3B361

Strings

LPT, xrefs: 00B3B292

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: d29f2e9d532052a3d32fc9161c11fb0533268641af306d6b92f019ef9f965a20
Instruction ID: 73a8d276c205be216adb85243dfccbaa794748152cce1c3f84a4078d23c6c668
Opcode Fuzzy Hash: d29f2e9d532052a3d32fc9161c11fb0533268641af306d6b92f019ef9f965a20
Instruction Fuzzy Hash: 6C617575A00215EFCB14DF94C995EAEB7F4EF08310F1141AAFA46AB351DB70AE44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00AE2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00AE2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00AE2AE1

Strings

@, xrefs: 00AE2AD5

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a439fdaf62f18bf572f26a6d49be57efcfd27e90cd06879e6c6b9c8e27c9987f
Instruction ID: 96fd2b783019254fdd1037eea33c9ec9896eb156527fe2d2522c09e8edb57c46
Opcode Fuzzy Hash: a439fdaf62f18bf572f26a6d49be57efcfd27e90cd06879e6c6b9c8e27c9987f
Instruction Fuzzy Hash: 905149724187449BD320AF10DC86BAFBBE8FF84314F42885DF1DA512A1DF308969CB16

Uniqueness

Uniqueness Score: -1.00%

Function 00B399BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00AD506B: __fread_nolock.LIBCMT ref: 00AD5089

_wcscmp.LIBCMT ref: 00B39AAE
_wcscmp.LIBCMT ref: 00B39AC1

Strings

FILE, xrefs: 00B399FA

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 82c228672ed44df52022630fcb9fa1cf32faa2d0311912595d7c0429cc6d4381
Instruction ID: 0ffd7ecaa8ffb8486a228e476ac09a7bd46c1732b287557fc6dd138c5670aafe
Opcode Fuzzy Hash: 82c228672ed44df52022630fcb9fa1cf32faa2d0311912595d7c0429cc6d4381
Instruction Fuzzy Hash: E641A871A00619BFDF209AA4DC85FEFBBFDDF45710F1004BAF901A7281D6B59A0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B42882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B42892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B428C8

Strings

|, xrefs: 00B42899

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 95f178eaa38f544ce09fc9367e4d82287b60fb8dacdb34dc09392f0870d94e93
Instruction ID: 0924f017982ecb377ead4b64459b861243c156e743c6efa63848d5bc9a8bcba3
Opcode Fuzzy Hash: 95f178eaa38f544ce09fc9367e4d82287b60fb8dacdb34dc09392f0870d94e93
Instruction Fuzzy Hash: 30313D71800119AFCF05EFA1CD85EEEBFB9FF08340F10406AF815A6265EB315A56EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B56CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B56D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B56DC2

Strings

static, xrefs: 00B56D22

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5aa98c2d166daaf3615705c87823142e00c3d0e68d52a89ea5e9d9d1dd08abe3
Instruction ID: be394864a3849a47e4e0cf5a25b1ae598366a3a3ebe43b7239c4f4c1af909573
Opcode Fuzzy Hash: 5aa98c2d166daaf3615705c87823142e00c3d0e68d52a89ea5e9d9d1dd08abe3
Instruction Fuzzy Hash: 82319E71200604AADB119F78CC80BFB77F9FF48721F5086A9FDA687190DA31AC95CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B32D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B32E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B32E3B

Strings

0, xrefs: 00B32DF9

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: be8e056bdcb8dd54e6511eaf21f6e81b5c30e607e613246d12551e8cf0c3d0df
Instruction ID: 070ab25271210bea6ce9f33b9b3efec239dc9358897e6bd684209be850571c9a
Opcode Fuzzy Hash: be8e056bdcb8dd54e6511eaf21f6e81b5c30e607e613246d12551e8cf0c3d0df
Instruction Fuzzy Hash: E931B931A00319EBEB248F58D986BAEBBF9FF05350F3444AAED85971A1D7709944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B56943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B569D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B569DB

Strings

Combobox, xrefs: 00B5699D

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: f8e7372c60b59cb7683790f1f787b70fd4c1ab66e78a10214b738a9a1412c924
Instruction ID: e803eef117fdde4e798ca902527461b0b13be3535671ee2a01174587d4f16514
Opcode Fuzzy Hash: f8e7372c60b59cb7683790f1f787b70fd4c1ab66e78a10214b738a9a1412c924
Instruction Fuzzy Hash: 7611E2713002086FEF119E64CC80FBB37AAEB893A5F5001A5FD58972A0D6719C5587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B56E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00AD1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AD1D73
Part of subcall function 00AD1D35: GetStockObject.GDI32(00000011), ref: 00AD1D87
Part of subcall function 00AD1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AD1D91

GetWindowRect.USER32(00000000,?), ref: 00B56EE0
GetSysColor.USER32(00000012), ref: 00B56EFA

Strings

static, xrefs: 00B56EBD

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1dfa52c9665fc76834f4a76243ea1c100b251862d4a19abe4af268a1e4a7fda4
Instruction ID: c51d1c8a4e70f1b303fb92400b2ea9ccaa52ae8dd60088dcf491e3b614a8579b
Opcode Fuzzy Hash: 1dfa52c9665fc76834f4a76243ea1c100b251862d4a19abe4af268a1e4a7fda4
Instruction Fuzzy Hash: 6D214772A1020AAFDB04DFA8DD45AFABBF8EB08315F0046A9FD55D3250E634E8659B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B56B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B56C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B56C20

Strings

edit, xrefs: 00B56BF5

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 8366e6856a1ad48f987018eb75625ca7f66c32162cf52bc6cde3951315178afb
Instruction ID: bc64799bf688791de56c6d94ae966b43ae884fe2f208391e8a7022e0087f9be5
Opcode Fuzzy Hash: 8366e6856a1ad48f987018eb75625ca7f66c32162cf52bc6cde3951315178afb
Instruction Fuzzy Hash: 05119D71100208ABEF108E649C42BBB37AAEB0437AF9047A4FD61D71E0C775DC989B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B32E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B32F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00B32F30

Strings

0, xrefs: 00B32F07

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7a4111c2d8893d19e762a764e31ba8f25d83a7adab19ac149261e31de0286c25
Instruction ID: 1eaa6717e6d699d7d45fe950b31394a71531ea896efffafcf8483ef34d5bb8e5
Opcode Fuzzy Hash: 7a4111c2d8893d19e762a764e31ba8f25d83a7adab19ac149261e31de0286c25
Instruction Fuzzy Hash: 4511C432941224ABDF21DB58DC85BA977F9EB05350F2440F6F854A72A0DBB0EE04C791

Uniqueness

Uniqueness Score: -1.00%

Function 00B424CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B42520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B42549

Strings

<local>, xrefs: 00B42511

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f781b8377bf9a780f1adb449ebc4b49b5bddec841faa934959a8bc8e935633a0
Instruction ID: 8c6f0c9fa1919a973b696009539d177f0e48517d3667f148b440702a035ad3e3
Opcode Fuzzy Hash: f781b8377bf9a780f1adb449ebc4b49b5bddec841faa934959a8bc8e935633a0
Instruction Fuzzy Hash: 7D11A070501225BADB249F518C99EBBFFE8FF26751F5081AAFA0547140D6B06A81FAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00B480A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00B480C8,?,00000000,?,?), ref: 00B48322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B480CB
htons.WSOCK32(00000000,?,00000000), ref: 00B48108

Strings

255.255.255.255, xrefs: 00B480E3

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e433f26238989dd841e53ae6da53672aa9ab6668024a98648c47e2563297013d
Instruction ID: 260f4c9709359caa3022a31f401a2dfc2443be0e6e536180a62228c32d2eca2b
Opcode Fuzzy Hash: e433f26238989dd841e53ae6da53672aa9ab6668024a98648c47e2563297013d
Instruction Fuzzy Hash: 6C11CE34600305ABDB20AF64CC86FBDB3A4EF08320F1085A7EA11A7291DB72A901D695

Uniqueness

Uniqueness Score: -1.00%

Function 00B292E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B29355

Strings

ListBox, xrefs: 00B2931F
ComboBox, xrefs: 00B292F4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e826014aa748d272a6536cb5f96110d38d3fe0230ae80d707b8dc8886336591a
Instruction ID: 61f0ecd3b12a55875886ffcfd9766f5b183fd45abdc8a9df7e140f8cbbf6287f
Opcode Fuzzy Hash: e826014aa748d272a6536cb5f96110d38d3fe0230ae80d707b8dc8886336591a
Instruction Fuzzy Hash: 84019271A05225AB8B05EB64DC91DFE77A9FF06320B14069AF836573E1DF315908C650

Uniqueness

Uniqueness Score: -1.00%

Function 00B291DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B2924D

Strings

ListBox, xrefs: 00B29217
ComboBox, xrefs: 00B291EC

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9f28f514ec417798a1e363e8a41f6c1ff926a587e25eadab4a70e9bfa2e1c141
Instruction ID: 50ed2a88072883f8d62f269e8000bc1ddc4ea626dab2126859a4eac8560c6af4
Opcode Fuzzy Hash: 9f28f514ec417798a1e363e8a41f6c1ff926a587e25eadab4a70e9bfa2e1c141
Instruction Fuzzy Hash: 1101D471A41225BBCB19EBA0D992EFF73E8DF05300F14019AB91A63291EE105E0CC261

Uniqueness

Uniqueness Score: -1.00%

Function 00B29264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD7F41: _memmove.LIBCMT ref: 00AD7F82

Part of subcall function 00B2B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00B2B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B292D0

Strings

ListBox, xrefs: 00B2929C
ComboBox, xrefs: 00B29271

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 2df3abccd6cc16a35938b0c2c34ca4b93a0fe397d11f8d10360c6bbdfe146bb1
Instruction ID: 25d9584cc830a684968013ed527572d800a701986d4c2752e909ffa397605d45
Opcode Fuzzy Hash: 2df3abccd6cc16a35938b0c2c34ca4b93a0fe397d11f8d10360c6bbdfe146bb1
Instruction Fuzzy Hash: E001A271A41229B7CF15EBA0D982EFF77EC9F15340F280196B81A63292DA215E0CD271

Uniqueness

Uniqueness Score: -1.00%

Function 00B351CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B351E8
_wcscmp.LIBCMT ref: 00B351FA

Strings

#32770, xrefs: 00B351F4

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 4c7c3fc1c001ef8077159fcb7dc9fddc0b910aac3c715766ffa42d3c6338c0d5
Instruction ID: c43ac789a0cad316b48cd8b753f39728e5ada93e4bc65f9c79790469f6c33ddf
Opcode Fuzzy Hash: 4c7c3fc1c001ef8077159fcb7dc9fddc0b910aac3c715766ffa42d3c6338c0d5
Instruction Fuzzy Hash: 0EE02232A0022D2AE720AA99AC09BA7F7ECEB45721F0000ABF910D3050E9609A048BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00B281BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B281CA

Part of subcall function 00AF3598: _doexit.LIBCMT ref: 00AF35A2

Strings

Error allocating memory., xrefs: 00B281C3
AutoIt, xrefs: 00B281BE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: cd87f3203a3ba3498a7714b447ceb38beca9a0eb7925ecb0ca9ef2306bd9ba58
Instruction ID: dbe2919772f2e0503b0c4b8e4af2276018e7ace6477e2fc51a30f1e572d89b10
Opcode Fuzzy Hash: cd87f3203a3ba3498a7714b447ceb38beca9a0eb7925ecb0ca9ef2306bd9ba58
Instruction Fuzzy Hash: 49D05B323C631C36D61432E86D07FDA75C88B19B52F044466BB09695E38ED5599182D9

Uniqueness

Uniqueness Score: -1.00%

Function 00B0B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B0B564: _memset.LIBCMT ref: 00B0B571

Part of subcall function 00AF0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00B0B540,?,?,?,00AD100A), ref: 00AF0B89

IsDebuggerPresent.KERNEL32(?,?,?,00AD100A), ref: 00B0B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AD100A), ref: 00B0B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B0B54E

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: efffdd2fafeda921104f8fdc656801c8219fc095dcc2b2ae37d81a1548098a18
Instruction ID: 5f6e2386053e133ac3cb05c1a2953dfe2e5057a8d22542761b5a3d9627e4376c
Opcode Fuzzy Hash: efffdd2fafeda921104f8fdc656801c8219fc095dcc2b2ae37d81a1548098a18
Instruction Fuzzy Hash: 18E06DB06007118FD720DF28E914B56BBE0AB14745F00C9EDE456C37A1EBB4D404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B55BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B55BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B55C08

Part of subcall function 00B354E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B3555E

Strings

Shell_TrayWnd, xrefs: 00B55BEE

Memory Dump Source

Source File: 00000000.00000002.2155972236.0000000000AD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000000.00000002.2155945406.0000000000AD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156025250.0000000000B85000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156203257.0000000000B8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2156244856.0000000000B98000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_Payment.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6800b88e6fdb6d93723f0b5a9fa37443aec5b18696ca4670630ae220174e57b9
Instruction ID: e74116d9577ad6b29fc02e52eb150fc0d437df907f148d636cb6bd4c0fd10348
Opcode Fuzzy Hash: 6800b88e6fdb6d93723f0b5a9fa37443aec5b18696ca4670630ae220174e57b9
Instruction Fuzzy Hash: 4DD0C931398312B7E778BB70AC4FFA7AA54AB15B52F1408A5B745AB1E0D9E45840C650

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut29F3.tmp

C:\Users\user\AppData\Local\Temp\aut2A9F.tmp

C:\Users\user\AppData\Local\Temp\outbluffed

C:\Users\user\AppData\Local\Temp\pensum

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
Payment.exe

Function 00AD3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00AD4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00AD4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00B393DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00AD3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00AD3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00AD71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00AD3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00AD3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00AD3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 02142640 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00AD39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 02142410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
fileCOMMON

Function 00AD410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00AF564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre