Edit tour

Windows Analysis Report
avz.exe

Overview

General Information

Sample name:	avz.exe
Analysis ID:	1436352
MD5:	59e8187b34416258ae6ab3cdf4ee6628
SHA1:	38378107dec5f543448a80134219a61dd37fab80
SHA256:	cbfadfb4f37c0e70827f4b5349d20827079aa86aa24c0b10c921aa06681f4757
Tags:	Detectionverificationexe
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

May modify the system service descriptor table (often done to hook functions)

AV process strings found (often used to terminate AV products)

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Enables debug privileges

Enables driver privileges

Found large amount of non-executed APIs

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

avz.exe (PID: 7728 cmdline: "C:\Users\user\Desktop\avz.exe" MD5: 59E8187B34416258AE6AB3CDF4EE6628)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.avz.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: avz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0040E718 FindFirstFileW,FindClose,	0_2_0040E718
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0040E14C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_0040E14C
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00424B74 FindFirstFileW,FindClose,	0_2_00424B74
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00424D58 FindFirstFileW,FindClose,	0_2_00424D58

Source: C:\Users\user\Desktop\avz.exe

Code function: 0_2_00422AAC GetLogicalDriveStringsW,QueryDosDeviceW,

0_2_00422AAC

Source: avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://whitelist.kaspersky.com/application?MD5=
Source: avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.kaspersky.ru/
Source: avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.z-oleg.com/secur/avz/report.php
Source: avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.z-oleg.com/secur/avz_up5/
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://z-oleg.com/secur/avz/
Source: avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://z-oleg.com/secur/avz/uploadvir.php
Source: avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://z-oleg.com/secur/avz_doc/
Source: avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nova.rambler.ru/search?query=
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nova.rambler.ru/search?query=U
Source: avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.ru/search?hl=ru&q=
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.ru/search?hl=ru&q=U
Source: avz.exe	String found in binary or memory: https://www.kaspersky.com/
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.kaspersky.com/U
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.kaspersky.com/https://www.kaspersky.ru/U
Source: avz.exe	String found in binary or memory: https://www.kaspersky.ru/
Source: avz.exe	String found in binary or memory: https://www.z-oleg.com/secur/avz/report.php
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.z-oleg.com/secur/avz/report.phpU
Source: avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.z-oleg.com/secur/avz_up5/
Source: avz.exe	String found in binary or memory: https://z-oleg.com/secur/avz
Source: avz.exe	String found in binary or memory: https://z-oleg.com/secur/avz/upload_qr.php
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://z-oleg.com/secur/avz/upload_qr.phpU
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://z-oleg.com/secur/avzU
Source: avz.exe	String found in binary or memory: https://z-oleg.com/secur/avz_doc/
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://z-oleg.com/secur/avz_doc/U

Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_004412E8		0_2_004412E8
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0040CBA4		0_2_0040CBA4

Source: C:\Users\user\Desktop\avz.exe

Process token adjusted: Load Driver

Jump to behavior

Source: avz.exe	Static PE information: Resource name: RT_BITMAP type: 68K BCS executable
Source: avz.exe	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: avz.exe	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: avz.exe	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: avz.exe	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: avz.exe	Binary or memory string: OriginalFilename vs avz.exe
Source: avz.exe, 00000000.00000002.2859328721.000000000A533000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs avz.exe
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs avz.exe
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameU vs avz.exe

Source: avz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: avz.exe

Static PE information: Section: UPX1 ZLIB complexity 0.9887729595035105

Source: classification engine

Classification label: sus25.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\avz.exe

Code function: 0_2_00425874 GetDiskFreeSpaceW,

0_2_00425874

Source: C:\Users\user\Desktop\avz.exe

File created: C:\Users\user\Desktop\BASE

Jump to behavior

Source: Yara match	File source: 0.2.avz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\avz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\avz.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\avz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: avz.exe	String found in binary or memory: NATS-SEFI-ADD
Source: avz.exe	String found in binary or memory: NATS-DANO-ADD
Source: avz.exe	String found in binary or memory: </InstalledProg>
Source: avz.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: avz.exe	String found in binary or memory: jp-ocr-b-add
Source: avz.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: avz.exe	String found in binary or memory: jp-ocr-hand-add
Source: avz.exe	String found in binary or memory: ISO_6937-2-add
Source: avz.exe	String found in binary or memory: MAIN-START
Source: avz.exe	String found in binary or memory: switch></addop><mulop><switch><char text="*" add="op"/><char text="/" add="op"/><keyword text="DIV" add="op" addtext="div"/><keywo

Source: C:\Users\user\Desktop\avz.exe

File read: C:\Users\user\Desktop\avz.exe

Jump to behavior

Source: C:\Users\user\Desktop\avz.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Users\user\Desktop\avz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\avz.exe

Window found: window name: TComboBox

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: avz.exe

Static file information: File size 1572352 > 1048576

Source: avz.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x175e00

Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0043A25C push ecx; mov dword ptr [esp], ecx	0_2_0043A25F
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00430204 push 004302EFh; ret	0_2_004302E7
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0046835C push ecx; mov dword ptr [esp], edx	0_2_0046835D
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0046730C push ecx; mov dword ptr [esp], ecx	0_2_00467310
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0042A448 push 0042A4E1h; ret	0_2_0042A4D9
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0046343C push ecx; mov dword ptr [esp], ecx	0_2_00463440
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0041C4E8 push 0041C520h; ret	0_2_0041C518
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0041048C push 0041050Fh; ret	0_2_00410507
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466510 push ecx; mov dword ptr [esp], edx	0_2_00466511
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466520 push ecx; mov dword ptr [esp], edx	0_2_00466521
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00465530 push ecx; mov dword ptr [esp], ecx	0_2_00465534
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_008335F4 push ecx; mov dword ptr [esp], edx	0_2_008335F5
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466604 push ecx; mov dword ptr [esp], ecx	0_2_00466608
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_004686F8 push ecx; mov dword ptr [esp], edx	0_2_004686F9
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00464840 push ecx; mov dword ptr [esp], ecx	0_2_00464844
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00467828 push ecx; mov dword ptr [esp], edx	0_2_00467829
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00462888 push 004628DEh; ret	0_2_004628D6
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466978 push ecx; mov dword ptr [esp], edx	0_2_00466979
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466988 push ecx; mov dword ptr [esp], edx	0_2_00466989
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466A6C push ecx; mov dword ptr [esp], ecx	0_2_00466A70
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00465A2C push ecx; mov dword ptr [esp], eax	0_2_00465A2E
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0043EB78 push ecx; mov dword ptr [esp], eax	0_2_0043EB79
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00467B78 push ecx; mov dword ptr [esp], edx	0_2_00467B79
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0043DB14 push ecx; mov dword ptr [esp], eax	0_2_0043DB15
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00462C10 push ecx; mov dword ptr [esp], edx	0_2_00462C11
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00425C18 push ecx; mov dword ptr [esp], ecx	0_2_00425C1B
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00468D5C push ecx; mov dword ptr [esp], edx	0_2_00468D5D
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00465DF4 push ecx; mov dword ptr [esp], edx	0_2_00465DF5
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466DF0 push ecx; mov dword ptr [esp], edx	0_2_00466DF1
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00466ED4 push ecx; mov dword ptr [esp], ecx	0_2_00466ED8
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0043CED0 push 0043CF27h; ret	0_2_0043CF1F

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection

May modify the system service descriptor table (often done to hook functions)

Source: avz.exe	Binary or memory string: KeServiceDescriptorTable
Source: avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\avz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\avz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\avz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\avz.exe

API coverage: 9.0 %

Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0040E718 FindFirstFileW,FindClose,	0_2_0040E718
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_0040E14C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_0040E14C
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00424B74 FindFirstFileW,FindClose,	0_2_00424B74
Source: C:\Users\user\Desktop\avz.exe	Code function: 0_2_00424D58 FindFirstFileW,FindClose,	0_2_00424D58

Source: C:\Users\user\Desktop\avz.exe

Code function: 0_2_00422AAC GetLogicalDriveStringsW,QueryDosDeviceW,

0_2_00422AAC

Source: avz.exe, 00000000.00000002.2858364688.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}T
Source: avz.exe, 00000000.00000002.2858364688.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: avz.exe, 00000000.00000002.2858364688.0000000001B53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Pro
Source: avz.exe, 00000000.00000002.2858364688.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: avz.exe, 00000000.00000002.2858364688.0000000001AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\avz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\avz.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_0040E850
Source: C:\Users\user\Desktop\avz.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0040DCF0
Source: C:\Users\user\Desktop\avz.exe	Code function: GetLocaleInfoW,	0_2_00429DD8
Source: C:\Users\user\Desktop\avz.exe	Code function: GetLocaleInfoW,	0_2_00429E24

Source: C:\Users\user\Desktop\avz.exe

Code function: 0_2_00428164 GetLocalTime,

0_2_00428164

Source: C:\Users\user\Desktop\avz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: avz.exe, 00000000.00000002.2858603420.000000000546A000.00000004.00001000.00020000.00000000.sdmp, avz.exe, 00000000.00000002.2858364688.0000000001B10000.00000004.00000020.00020000.00000000.sdmp, avz.exe, 00000000.00000002.2858603420.0000000005478000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\avz.exe
Source: avz.exe, 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmp, avz.exe, 00000000.00000002.2858364688.0000000001B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avz.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 LSASS Driver	1 LSASS Driver	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Software Packing	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
avz.exe	8%	ReversingLabs
avz.exe	4%	Virustotal		Browse

Name	Source	Malicious	Reputation
https://www.z-oleg.com/secur/avz/report.phpU	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.kaspersky.com/https://www.kaspersky.ru/U	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
http://www.kaspersky.ru/	avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	false	high
http://z-oleg.com/secur/avz/uploadvir.php	avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	false	high
https://z-oleg.com/secur/avz_doc/	avz.exe	false	high
https://www.kaspersky.com/	avz.exe	false	high
http://whitelist.kaspersky.com/application?MD5=	avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
http://www.z-oleg.com/secur/avz_up5/	avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	false	high
https://nova.rambler.ru/search?query=U	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.kaspersky.com/U	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.google.ru/search?hl=ru&q=U	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.kaspersky.ru/	avz.exe	false	high
https://z-oleg.com/secur/avz/upload_qr.php	avz.exe	false	high
http://z-oleg.com/secur/avz_doc/	avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	false	high
https://z-oleg.com/secur/avzU	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.z-oleg.com/secur/avz_up5/	avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://z-oleg.com/secur/avz_doc/U	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
http://www.z-oleg.com/secur/avz/report.php	avz.exe, 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmp	false	high
http://z-oleg.com/secur/avz/	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://nova.rambler.ru/search?query=	avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://www.z-oleg.com/secur/avz/report.php	avz.exe	false	high
https://z-oleg.com/secur/avz	avz.exe	false	high
https://www.google.ru/search?hl=ru&q=	avz.exe, avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high
https://z-oleg.com/secur/avz/upload_qr.phpU	avz.exe, 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436352
Start date and time:	2024-05-04 15:04:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	avz.exe
Detection:	SUS
Classification:	sus25.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.889404299781525
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	avz.exe
File size:	1'572'352 bytes
MD5:	59e8187b34416258ae6ab3cdf4ee6628
SHA1:	38378107dec5f543448a80134219a61dd37fab80
SHA256:	cbfadfb4f37c0e70827f4b5349d20827079aa86aa24c0b10c921aa06681f4757
SHA512:	9e0cd06ee0b763fbdaf983b47733508b826c1cf1a0248330be262ec14d8c0fbc0b1013b3ada75481572e526a062cab272da2ece10c122ca541034657529ebb54
SSDEEP:	24576:gxC+MB3qWEQZsYhgjkzM1fNbPj+Vy/0T60P//cH0JDDtd2e9oStdWTmVoWUr4f5A:oRdKZs2wiVy8W0P8Udlt7li4kB
TLSH:	817523692A18C067D39828758F05D8FD1D593D6173883E0A33D3BDDFBF696962B420B2
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	995109959b4f0504

Static PE Info

General

Entrypoint:	0x99e9d0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x662321FC [Sat Apr 20 02:01:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	70c9d82a50a5b5542c5c4c83152ea81b

Entrypoint Preview

Instruction
pushad
mov esi, 00829000h
lea edi, dword ptr [esi-00428000h]
mov dword ptr [edi+004B4C3Ch], 6D35F187h
push edi
or ebp, FFFFFFFFh
jmp 00007F4E91321A90h
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4E91321A6Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F4E91321A8Dh
jne 00007F4E91321AAAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4E91321AA1h
dec eax
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F4E91321A56h
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F4E91321AD4h
xor ecx, ecx
sub eax, 03h
jc 00007F4E91321A93h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F4E91321AF7h
sar eax, 1
mov ebp, eax
jmp 00007F4E91321A8Dh
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4E91321A4Eh
inc ecx
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4E91321A40h
add ebx, ebx
jne 00007F4E91321A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F4E91321A71h
jne 00007F4E91321A8Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F4E91321A66h
add ecx, 02h
cmp ebp, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4e7000	0x95	UPX1
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a8700	0x354	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59f000	0x9700	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x59eb88	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4e6000	0xb1e	UPX1
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x428000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x429000	0x176000	0x175e00	986697aac5f2c961e9296db7079873ab	False	0.9887729595035105	data	7.922141861509734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59f000	0xa000	0x9c00	1db7c7ad4fe3caff159d67448a4c1014	False	0.21501903044871795	data	3.623768923715147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x552c70	0x134	data			1.0357142857142858
RT_CURSOR	0x552da4	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x552ed8	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x55300c	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x553140	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x553274	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x5533a8	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x5534dc	0x134	data			1.0357142857142858
RT_CURSOR	0x553610	0x134	data	English	United States	1.0357142857142858
RT_BITMAP	0x553744	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x553914	0x1e4	data	English	United States	1.0227272727272727
RT_BITMAP	0x553af8	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x553cc8	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x553e98	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x554068	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x554238	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x554408	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x5545d8	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x5547a8	0x1d0	data	English	United States	1.0237068965517242
RT_BITMAP	0x554978	0x2a4	data			1.0162721893491125
RT_BITMAP	0x554c1c	0xc0	data	English	United States	1.0572916666666667
RT_BITMAP	0x554cdc	0x128	OpenPGP Public Key			1.037162162162162
RT_BITMAP	0x554e04	0x7b8	data			1.0055668016194332
RT_BITMAP	0x5555bc	0xe0	data	English	United States	1.0491071428571428
RT_BITMAP	0x55569c	0xe0	data	English	United States	1.0491071428571428
RT_BITMAP	0x55577c	0x5c	data	English	United States	1.1195652173913044
RT_BITMAP	0x5557d8	0x5c	data	English	United States	1.1195652173913044
RT_BITMAP	0x555834	0x110	data			1.0404411764705883
RT_BITMAP	0x555944	0x110	data			1.0404411764705883
RT_BITMAP	0x555a54	0x110	data			1.0404411764705883
RT_BITMAP	0x555b64	0x5c	data			1.1195652173913044
RT_BITMAP	0x555bc0	0x5c	data			1.1195652173913044
RT_BITMAP	0x555c1c	0x110	data			1.0404411764705883
RT_BITMAP	0x555d2c	0x110	data			1.0404411764705883
RT_BITMAP	0x555e3c	0x110	data			1.0404411764705883
RT_BITMAP	0x555f4c	0x110	data			1.0404411764705883
RT_BITMAP	0x55605c	0xb0	data			1.0625
RT_BITMAP	0x55610c	0xb0	data			1.0625
RT_BITMAP	0x5561bc	0x5c	PGP Secret Sub-key -	English	United States	1.1195652173913044
RT_BITMAP	0x556218	0x5c	data	English	United States	1.1195652173913044
RT_BITMAP	0x556274	0x5c	data	English	United States	1.1195652173913044
RT_BITMAP	0x5562d0	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x556740	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x556bb0	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x557020	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x557490	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x557900	0x46e	68K BCS executable	English	United States	1.009700176366843
RT_BITMAP	0x557d70	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x5581e0	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x558650	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x558ac0	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x558f30	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x5593a0	0x46e	data	English	United States	1.009700176366843
RT_BITMAP	0x559810	0x128	data	Czech	Czech Republic	1.037162162162162
RT_BITMAP	0x559938	0x308	data			1.0141752577319587
RT_BITMAP	0x559c40	0xe0	data	English	United States	1.0491071428571428
RT_BITMAP	0x559d20	0xc8	data	Czech	Czech Republic	1.055
RT_BITMAP	0x559de8	0xc0	data	English	United States	1.0572916666666667
RT_BITMAP	0x559ea8	0xc0	data	English	United States	1.0572916666666667
RT_BITMAP	0x559f68	0xe0	data	English	United States	1.0491071428571428
RT_BITMAP	0x55a048	0xc0	data	English	United States	1.0572916666666667
RT_BITMAP	0x55a108	0x48	data			1.1527777777777777
RT_BITMAP	0x55a150	0x48	data			1.1527777777777777
RT_BITMAP	0x55a198	0xe0	data	English	United States	1.0491071428571428
RT_BITMAP	0x55a278	0x48	data			1.1527777777777777
RT_BITMAP	0x55a2c0	0x48	data			1.1527777777777777
RT_BITMAP	0x55a308	0xe8	data	English	United States	1.0474137931034482
RT_BITMAP	0x55a3f0	0xc0	data	English	United States	1.0572916666666667
RT_BITMAP	0x55a4b0	0xc8	data	Czech	Czech Republic	1.055
RT_BITMAP	0x55a578	0x2d0	data			1.0152777777777777
RT_BITMAP	0x55a848	0x98	data	English	United States	1.0723684210526316
RT_BITMAP	0x55a8e0	0x98	data	English	United States	1.0723684210526316
RT_BITMAP	0x55a978	0xe0	data	English	United States	1.0491071428571428
RT_ICON	0x5a1c74	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5067567567567568
RT_ICON	0x5a1da0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4819364161849711
RT_ICON	0x5a230c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2154255319148936
RT_ICON	0x5a2778	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3897849462365591
RT_ICON	0x5a2a64	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.4038808664259928
RT_ICON	0x5a3310	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.12218574108818012
RT_ICON	0x5a43bc	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.25914634146341464
RT_ICON	0x5a4a28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.2977078891257996
RT_ICON	0x5a58d4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08246887966804979
RT_DIALOG	0x560c40	0x52	data			1.1341463414634145
RT_DIALOG	0x560c94	0x52	data			1.1341463414634145
RT_STRING	0x560ce8	0x1bc	data			1.0247747747747749
RT_STRING	0x560ea4	0x228	data			1.019927536231884
RT_STRING	0x5610cc	0x3d4	data			1.0112244897959184
RT_STRING	0x5614a0	0x5b0	data			1.007554945054945
RT_STRING	0x561a50	0x3a8	data			1.0117521367521367
RT_STRING	0x561df8	0x46c	data			1.0097173144876326
RT_STRING	0x562264	0x43c	data			1.0101476014760147
RT_STRING	0x5626a0	0x488	data			1.0094827586206896
RT_STRING	0x562b28	0x390	data			1.0120614035087718
RT_STRING	0x562eb8	0x404	data			1.0107003891050583
RT_STRING	0x5632bc	0x440	data			1.010110294117647
RT_STRING	0x5636fc	0x34c	data			1.0130331753554502
RT_STRING	0x563a48	0x390	data			1.0120614035087718
RT_STRING	0x563dd8	0x288	data			1.0169753086419753
RT_STRING	0x564060	0x2b0	data			1.0159883720930232
RT_STRING	0x564310	0x1dc	data			1.023109243697479
RT_STRING	0x5644ec	0x118	data			1.0392857142857144
RT_STRING	0x564604	0x108	data			1.0416666666666667
RT_STRING	0x56470c	0x2b8	data			1.0158045977011494
RT_STRING	0x5649c4	0x38c	DOS executable (COM)			1.0121145374449338
RT_STRING	0x564d50	0x37c	data			1.0123318385650224
RT_STRING	0x5650cc	0x328	OpenPGP Secret Key			1.0136138613861385
RT_STRING	0x5653f4	0x1c0	data			1.0245535714285714
RT_STRING	0x5655b4	0x58c	OpenPGP Public Key			1.0077464788732395
RT_STRING	0x565b40	0x1dc	data			1.023109243697479
RT_STRING	0x565d1c	0x3e0	data			1.0110887096774193
RT_STRING	0x5660fc	0x3d8	data			1.011178861788618
RT_STRING	0x5664d4	0x33c	data			1.0132850241545894
RT_STRING	0x566810	0x43c	data			1.0101476014760147
RT_STRING	0x566c4c	0x58c	data			1.0077464788732395
RT_STRING	0x5671d8	0x46c	data			1.0097173144876326
RT_STRING	0x567644	0x2ec	DOS executable (COM)			1.0147058823529411
RT_STRING	0x567930	0x2b0	data			1.0159883720930232
RT_STRING	0x567be0	0x44c	data			1.01
RT_STRING	0x56802c	0x124	data			1.0376712328767124
RT_STRING	0x568150	0xd4	data			1.0518867924528301
RT_STRING	0x568224	0x288	data			1.0169753086419753
RT_STRING	0x5684ac	0x11c	data			1.0387323943661972
RT_STRING	0x5685c8	0x3d0	data			1.0112704918032787
RT_STRING	0x568998	0x414	DOS executable (COM, 0x8C-variant)			1.010536398467433
RT_STRING	0x568dac	0x428	data			1.0103383458646618
RT_STRING	0x5691d4	0x514	data			1.0084615384615385
RT_STRING	0x5696e8	0x280	data			1.0171875
RT_STRING	0x569968	0x3e0	data			1.0110887096774193
RT_STRING	0x569d48	0x4f8	data			1.0086477987421383
RT_STRING	0x56a240	0x38c	DOS executable (COM, 0x8C-variant)			1.0121145374449338
RT_STRING	0x56a5cc	0x374	data			1.012443438914027
RT_STRING	0x56a940	0x458	data			1.0098920863309353
RT_STRING	0x56ad98	0x10c	data			1.041044776119403
RT_STRING	0x56aea4	0xcc	data			1.053921568627451
RT_STRING	0x56af70	0x244	data			1.0189655172413794
RT_STRING	0x56b1b4	0x414	data			1.010536398467433
RT_STRING	0x56b5c8	0x358	data			1.0128504672897196
RT_STRING	0x56b920	0x310	data			1.0140306122448979
RT_STRING	0x56bc30	0x334	data			1.0134146341463415
RT_RCDATA	0x56bf64	0x10	data			1.5
RT_RCDATA	0x56bf74	0x1a60	data			0.9995556872037915
RT_RCDATA	0x56d9d4	0x2	Non-ISO extended-ASCII text, with no line terminators	English	United States	5.0
RT_RCDATA	0x56d9d8	0x2992	data			0.9907912046607781
RT_RCDATA	0x57036c	0xb72	data			1.0037542662116041
RT_RCDATA	0x570ee0	0xe38	data			1.003021978021978
RT_RCDATA	0x571d18	0x729	data			1.0060010911074742
RT_RCDATA	0x572444	0x52e	data			1.0082956259426847
RT_RCDATA	0x572974	0xc14	data			1.0035575679172057
RT_RCDATA	0x573588	0x2efe	data			0.9951787198669991
RT_RCDATA	0x576488	0x4b1	data			1.0091590341382182
RT_RCDATA	0x57693c	0xa0b	data			1.0042784908595876
RT_RCDATA	0x577348	0x4a0	data			1.0092905405405406
RT_RCDATA	0x5777e8	0x143a	data			1.0021243723445346
RT_RCDATA	0x578c24	0x2b3	data			1.015918958031838
RT_RCDATA	0x578ed8	0x74e6	data			0.9947871416159861
RT_RCDATA	0x5803c0	0x2a55	data			0.9935406477807511
RT_RCDATA	0x582e18	0x6bf	data			1.0063694267515924
RT_RCDATA	0x5834d8	0x113	data			1.04
RT_RCDATA	0x5835ec	0x494	data			1.0093856655290103
RT_RCDATA	0x583a80	0xd549	data			0.945385615648065
RT_RCDATA	0x590fcc	0x3c4	data			0.9813278008298755
RT_RCDATA	0x591390	0x161e	data			0.9927587424938185
RT_RCDATA	0x5929b0	0x45d	data			1.0098478066248882
RT_RCDATA	0x592e10	0xf07	OpenPGP Secret Key			0.9981804003119313
RT_RCDATA	0x593d18	0xfeb	data			0.9936196319018404
RT_RCDATA	0x594d04	0x12ef	data			0.9921600990303281
RT_RCDATA	0x595ff4	0xc32	data			0.9910313901345291
RT_RCDATA	0x596c28	0x39f	data			1.011866235167206
RT_RCDATA	0x596fc8	0xd72	OpenPGP Secret Key			0.9930273097036607
RT_RCDATA	0x597d3c	0x533	OpenPGP Secret Key			1.0082644628099173
RT_RCDATA	0x598270	0xef3	data			0.9918996603083355
RT_RCDATA	0x599164	0x491	data			0.8785286569717707
RT_RCDATA	0x5995f8	0x1ab	data			1.0257611241217799
RT_GROUP_CURSOR	0x5997a4	0x14	data			1.45
RT_GROUP_CURSOR	0x5997b8	0x14	data			1.45
RT_GROUP_CURSOR	0x5997cc	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x5997e0	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x5997f4	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x599808	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x59981c	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x599830	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x599844	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x5a7e80	0x84	data	English	United States	0.6439393939393939
RT_VERSION	0x5a7f08	0x150	data	English	United States	0.5833333333333334
RT_MANIFEST	0x5a805c	0x6a2	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia	0.4287396937573616

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
advapi32.dll	FreeSid
comctl32.dll	ImageList_Add
comdlg32.dll	PrintDlgW
gdi32.dll	Pie
netapi32.dll	NetWkstaGetInfo
ole32.dll	OleDraw
oleaut32.dll	VariantCopy
shell32.dll	DragFinish
user32.dll	GetDC
version.dll	VerQueryValueW
wininet.dll	InternetOpenW
winspool.drv	OpenPrinterW
wsock32.dll	htons

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Czech	Czech Republic
Russian	Russia

Target ID:	0
Start time:	15:04:49
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\avz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\avz.exe"
Imagebase:	0x400000
File size:	1'572'352 bytes
MD5 hash:	59E8187B34416258AE6AB3CDF4EE6628
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	326
Total number of Limit Nodes:	18

Executed Functions

Function 0040E850 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040E910,?,?), ref: 0040E882
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040E910,?,?), ref: 0040E88B

Part of subcall function 0040E718: FindFirstFileW.KERNEL32(00000000,?,00000000,0040E776,?,00000001), ref: 0040E74B
Part of subcall function 0040E718: FindClose.KERNEL32(00000000,00000000,?,00000000,0040E776,?,00000001), ref: 0040E75B

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 0700dd98b66c5903688b8b15a74bddea8521a4b67d0f7c0f087b3ee225181435
Instruction ID: 3811a30886e5d95731f1d26f13dd2990b041ae6e55f2e9b7b56907c5429bf487
Opcode Fuzzy Hash: 0700dd98b66c5903688b8b15a74bddea8521a4b67d0f7c0f087b3ee225181435
Instruction Fuzzy Hash: 6D112470A002099BDF04FBA6C942AADB3B9EF44304F50447BF514B73D2DB399E15C669

Uniqueness

Uniqueness Score: -1.00%

Function 0040E718 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040E776,?,00000001), ref: 0040E74B
FindClose.KERNEL32(00000000,00000000,?,00000000,0040E776,?,00000001), ref: 0040E75B

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ac57312274a22885ef9385209d012e2dfb6dd8944491f83ace8229893c571ab4
Instruction ID: cfabb1e82c86de5fe3525c019f52d29633545275c25a8562c8cef58bdab8754f
Opcode Fuzzy Hash: ac57312274a22885ef9385209d012e2dfb6dd8944491f83ace8229893c571ab4
Instruction Fuzzy Hash: CBF05E71500608AFCB61FBB6CD5299EB3ACEF4571476009B7B814F31D1EA389E20995D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E33C Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E561,?,?), ref: 0040E375
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E561,?,?), ref: 0040E3BE
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E561,?,?), ref: 0040E3E0
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040E3FE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040E41C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040E43A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040E458
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040E544,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E561), ref: 0040E498
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040E544,?,80000001), ref: 0040E4C3
RegCloseKey.ADVAPI32(?,0040E54B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040E544,?,80000001,Software\Embarcadero\Locales), ref: 0040E53E

Strings

Software\Borland\Locales, xrefs: 0040E430
Software\Embarcadero\Locales, xrefs: 0040E3B4, 0040E3D6
Software\Borland\Delphi\Locales, xrefs: 0040E44E
Software\CodeGear\Locales, xrefs: 0040E3F4, 0040E412

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: c2c871c4c25e8eca74535b3c46514c1a97de02158678078f6dbc333099dfa2ff
Instruction ID: 8df006f22b3a254145f45432dd01ca0764f38ecc40a7ea8518213d31a401c070
Opcode Fuzzy Hash: c2c871c4c25e8eca74535b3c46514c1a97de02158678078f6dbc333099dfa2ff
Instruction Fuzzy Hash: 3D512771A4020CBEDB10DAA6CC42FEE77ACDB04708F544C77BA04F61C2E6789A508A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E008 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(008C4B8C), ref: 0040E026
RtlLeaveCriticalSection.NTDLL(008C4B8C), ref: 0040E04A
RtlLeaveCriticalSection.NTDLL(008C4B8C), ref: 0040E059
IsValidLocale.KERNEL32(00000000,00000002,00000000,0040E10C,?,?,?,00000000,?,0040E9D4,00000000,0040EA33,?,?,00000000,00000000), ref: 0040E06B
RtlEnterCriticalSection.NTDLL(008C4B8C), ref: 0040E0C8
RtlLeaveCriticalSection.NTDLL(008C4B8C), ref: 0040E0F1

Strings

en-GB,en,en-US,, xrefs: 0040E036, 0040E0DD

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 99267138c7f9b43ceefaf0c8989081b1abe9504df68f6f9c07349cf7b1ebe2eb
Instruction ID: 969a9f573a89ea90201c21e821028458a1f512703f5f375bbbf21895bb880bdb
Opcode Fuzzy Hash: 99267138c7f9b43ceefaf0c8989081b1abe9504df68f6f9c07349cf7b1ebe2eb
Instruction Fuzzy Hash: 78219F30710A1057D710B7E78812F5A21A8EB84724F50943FB400FB6C2DAFDDC95965E

Uniqueness

Uniqueness Score: -1.00%

Function 00410B90 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00410C48

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a7b5bc098e118efd5262aaa79d43dd566328c810c3c383e58a0a6d4e39ba55a5
Instruction ID: 7fb592685186cf33688800424b75e34a538c16581061763188b4eff0837aa182
Opcode Fuzzy Hash: a7b5bc098e118efd5262aaa79d43dd566328c810c3c383e58a0a6d4e39ba55a5
Instruction Fuzzy Hash: F8A14E75A007099FDB14DFE9D880BEEBBB6BB48300F14811AE505AB390DBB4A9C5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00424D98 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,00422F52), ref: 00424DA9
GetLastError.KERNEL32(00000000,?,?,?,00422F52), ref: 00424E02

Strings

, xrefs: 00424DF3
{, xrefs: 00424E13

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID: ${
API String ID: 1799206407-4046706400
Opcode ID: 48a71003d5f46396b33cf28021c47105213fb405774180b804ec14106ee9548e
Instruction ID: b43b927ac7921c27406272267bd3af01d1d6248a404300e15480699ddc2f1e40
Opcode Fuzzy Hash: 48a71003d5f46396b33cf28021c47105213fb405774180b804ec14106ee9548e
Instruction Fuzzy Hash: 0C01F73431423011FA3560B93C86BBB0144DFD67A6FFA1917F911A7BE1CA8D4C43506E

Uniqueness

Uniqueness Score: -1.00%

Function 00424E30 Relevance: 9.1, APIs: 6, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,0042493D), ref: 00424E46
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,0042493D), ref: 00424E85
CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,0042493D), ref: 00424E90
GetLastError.KERNEL32(00000000,?,?,?,?,?,0042493D), ref: 00424ED7

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateErrorHandleLast
String ID:
API String ID: 2927643983-0
Opcode ID: 81d8c16c902cbaf31908049c1d90399f2241ce0585bd2bf338620e2f96500007
Instruction ID: ecd14b63ca4923df054c3088237b710d2f266073a6e603d34634352d570b6b73
Opcode Fuzzy Hash: 81d8c16c902cbaf31908049c1d90399f2241ce0585bd2bf338620e2f96500007
Instruction Fuzzy Hash: 14115B31B4423024FA7011B8BE86F7B2188CBC2724FBB1527FB51E66C5C18D9C81501E

Uniqueness

Uniqueness Score: -1.00%

Function 0040678C Relevance: 3.8, APIs: 3, Instructions: 32
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00406856,?,?,?,004068E9), ref: 004067A2
Sleep.KERNEL32(0000000A,00000000,00406856,?,?,?,004068E9), ref: 004067BB
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,00406856,?,?,?,004068E9), ref: 004067E9

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Sleep$AllocVirtual
String ID:
API String ID: 3510833457-0
Opcode ID: bd580362bbecb767b6105ddf6ddc66df879c95c9dfc539682c4a020134eba282
Instruction ID: 3586af41941fe4e54c37ecdce78ec90e2d0ab3b540c31e4ea7a10a641838911c
Opcode Fuzzy Hash: bd580362bbecb767b6105ddf6ddc66df879c95c9dfc539682c4a020134eba282
Instruction Fuzzy Hash: 10F0822071075064EB10ABB06C1AF571661A7017ACF41183FA3037B2D2D7BD9999D65D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E91C Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040EA33,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EABA,00000000,?,00000105), ref: 0040E9C7
GetSystemDefaultUILanguage.KERNEL32(00000000,0040EA33,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EABA,00000000,?,00000105), ref: 0040E9EF

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 7cda3bb782ff04a27bd42aa94b9f18a25c9832d78bcbd4f3fea7fdbfa4e7290b
Instruction ID: 98b503460a745a57f3c14c933e1ef4cc48e28c0ffa6fee42ab21ad605bd5f443
Opcode Fuzzy Hash: 7cda3bb782ff04a27bd42aa94b9f18a25c9832d78bcbd4f3fea7fdbfa4e7290b
Instruction Fuzzy Hash: 88312070A102199BDB14EB9BC882A9EB7B5FF48304F50487BE400B33D1D77C9E958B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA40 Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EAFA,?,00400000,008B5C48), ref: 0040EA7C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EAFA,?,00400000,008B5C48), ref: 0040EACD

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 0350a7ccb8c1c526539eaedde8086d9c2dc1334cf9ad47a7efefb4de2d8be29c
Instruction ID: 20d0a0414cf8f6ebef93b6583375bab900407c3ab3e2ac4c874ab0c1f2033a40
Opcode Fuzzy Hash: 0350a7ccb8c1c526539eaedde8086d9c2dc1334cf9ad47a7efefb4de2d8be29c
Instruction Fuzzy Hash: D1118230A4021C9BDB14EB61C886BDE73B8EB08304F1144BAF408B32D1DB785F84CE99

Uniqueness

Uniqueness Score: -1.00%

Function 00429D54 Relevance: 3.0, APIs: 2, Instructions: 49
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,?,00000000,?,?,0043238A,00000000,004323E3), ref: 00429D78
LocalFree.KERNEL32(?,00429DD1,00003300,00000000,00000000,00000000,?,00000000,00000000,?,00000000,?,?,0043238A,00000000,004323E3), ref: 00429DC4

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: 85646905df23e58e8383d6d38fe2bd207c96aad944755341ac33a141038212d1
Instruction ID: 989ab6ebfb786be34d35395e77302ccde31e9c7036b91f8ff4082280360bdeeb
Opcode Fuzzy Hash: 85646905df23e58e8383d6d38fe2bd207c96aad944755341ac33a141038212d1
Instruction Fuzzy Hash: A2014930724328BFE7289655AC12F7B329DEFC4B00FE0403BB400D22C1D97D9D11A668

Uniqueness

Uniqueness Score: -1.00%

Function 0042D63C Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 0042D646
LoadLibraryW.KERNEL32(00000000,00000000,0042D690,?,00000000,0042D6AE), ref: 0042D675

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: a24b81db8646aea93704916e5821ca76e1f8cb7b1f27d862d26963d0353bc75e
Instruction ID: 42147dc9f2810356fc869eb36e5528ddbba2ae7ae7b38aae34635417d0df3c90
Opcode Fuzzy Hash: a24b81db8646aea93704916e5821ca76e1f8cb7b1f27d862d26963d0353bc75e
Instruction Fuzzy Hash: 0EF08270B04708BEDB029F769C528ABBBFCE74DB0079348B6F814A2691E67D5820856C

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC90 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

74D41560.VERSION(?,0042BD78,?,?,00000000,?,00000000,?,00000000,0042BD49,?,00000000,?,00000000,0042BD66), ref: 0042BD21

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: D41560
String ID:
API String ID: 3025727225-0
Opcode ID: cd534159c38a5224cf7425053597969d595ad40571e794f29e76ec093baeb153
Instruction ID: 142d2396d975a6c64bd12ea1ce118dffe536678657c9fec164b7dbb8f94f2fe7
Opcode Fuzzy Hash: cd534159c38a5224cf7425053597969d595ad40571e794f29e76ec093baeb153
Instruction Fuzzy Hash: 31217471B14709AFDB00DFA6DC829EEB7FCEB483007914876B510E3691D738AE009A58

Uniqueness

Uniqueness Score: -1.00%

Function 00415EB8 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00415EF7

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b9e7d47dc86991aef5be46c282249b581b1e0f82557d0ce3bc0e2ed4b639fc0f
Instruction ID: 2d9cd11f058f90f2e14b19f2c1d4c7c756708d382e317987b3b81fd2818f3a88
Opcode Fuzzy Hash: b9e7d47dc86991aef5be46c282249b581b1e0f82557d0ce3bc0e2ed4b639fc0f
Instruction Fuzzy Hash: AEF07FB2605119AF8B80DE9DDC81EDB77ECEB4D264B05412ABA08E7201D635ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040D7CC Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040D7EA

Part of subcall function 0040EA40: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EAFA,?,00400000,008B5C48), ref: 0040EA7C
Part of subcall function 0040EA40: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EAFA,?,00400000,008B5C48), ref: 0040EACD

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 751168551c2308f442b75f3116d8031d5525a74588f1d5826d195966025f1d29
Instruction ID: 1c38836be26e917c7004fabc85749c792c4e11dd02784b61004cf669b28b0675
Opcode Fuzzy Hash: 751168551c2308f442b75f3116d8031d5525a74588f1d5826d195966025f1d29
Instruction Fuzzy Hash: 3AE0EDB2A003109BCF50DE98C8C5A573BE4AB08758F044966ED64DF387D375DD248BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00425A74 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,00424FDE,00000000,00425003,?,?,00000000,00000000,00000000,00000000), ref: 00425A81

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d3b65435948135ef86e67bec4c74d3fd09c2601ff01950b86c823f1883d5ba4a
Instruction ID: 7ca6796180724455c01f6d530e22512ccb907c442657097512633fa598517ca2
Opcode Fuzzy Hash: d3b65435948135ef86e67bec4c74d3fd09c2601ff01950b86c823f1883d5ba4a
Instruction Fuzzy Hash: 83B092A27902411AEA0036FA1CD2B2E008CD794A0AF10083AB511D7182D96AC8441059

Uniqueness

Uniqueness Score: -1.00%

Function 004165B8 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 004165C3

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c415726e24c9a1ab1789cd6958d8a568dd54a7f1ca1d1d92b1dc9262691174a1
Instruction ID: aba2cb8b160f5213c2966014cbc55f102fa82e411ee86e298bc762e95902e9d8
Opcode Fuzzy Hash: c415726e24c9a1ab1789cd6958d8a568dd54a7f1ca1d1d92b1dc9262691174a1
Instruction Fuzzy Hash: 94B092F200530C7E6500AA96ECC6CB7B75CE6986A8780811ABB0846202A466AC9041BC

Uniqueness

Uniqueness Score: -1.00%

Function 004058C8 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405EDF,FFFFFFDC,00405BB0), ref: 004058DF

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 99705875f4c210d976d8a1df65d6998ceadab0ea21d78aa928a9aad47088ed72
Instruction ID: 5f107d390ec8fce1bfdbed002a99d211afe16f3ea22c88ff3c615973c05485db
Opcode Fuzzy Hash: 99705875f4c210d976d8a1df65d6998ceadab0ea21d78aa928a9aad47088ed72
Instruction Fuzzy Hash: B1F08CF2B003209FD7249F78AD40B027BE5F704714B10423EEA09EB7D8EBB088018B84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E14C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041CE98,?,?), ref: 0040E169
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040E17A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041CE98,?,?), ref: 0040E27A
FindClose.KERNEL32(?,?,?,kernel32.dll,0041CE98,?,?), ref: 0040E28C
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041CE98,?,?), ref: 0040E298
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041CE98,?,?), ref: 0040E2DD

Strings

GetLongPathNameW, xrefs: 0040E174
\, xrefs: 0040E2AA
kernel32.dll, xrefs: 0040E164

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 92ab88ae555d9b73fc90b149e4d3ea8c5713dbcaf25f78294dbb6621d00702aa
Instruction ID: 662e2d521b8b4418c1b62f8d2bcefb21e50cd24e361e2b8799a5a39498fe5c02
Opcode Fuzzy Hash: 92ab88ae555d9b73fc90b149e4d3ea8c5713dbcaf25f78294dbb6621d00702aa
Instruction Fuzzy Hash: A741D371E006189BCB10EBA6CC89ADEB3B5EF44310F1449BAD844F72D1E77CAE558B49

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCF0 Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040DE55,?,0041CE98,?,00000000), ref: 0040DD9A
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040DE55,?,0041CE98,?,00000000), ref: 0040DDB6
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040DE55,?,0041CE98,?,00000000), ref: 0040DDC7

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 9b18f4f6c5c07ef99b456e3fa767a60fc193aa48d43288d82f24196a99c720c7
Instruction ID: a8219854aac5032f0b467625a93bd80a9c4f493a1c36e479c7c13f539b835aa5
Opcode Fuzzy Hash: 9b18f4f6c5c07ef99b456e3fa767a60fc193aa48d43288d82f24196a99c720c7
Instruction Fuzzy Hash: 10319D31A00A18ABDB21EBA1DC81BEF77B9FB44705F5001BAA508B72D1D7385E84DE59

Uniqueness

Uniqueness Score: -1.00%

Function 00422AAC Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,00000000,00422BDA), ref: 00422AE9
QueryDosDeviceW.KERNEL32(?,?,00000104,00000104,?,00000000,00422BDA), ref: 00422B13

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: DeviceDriveLogicalQueryStrings
String ID:
API String ID: 3173366581-0
Opcode ID: 42659737104c80c07e9846b63d526cfee1ce295624b73bfd3fb8e047cceb0fec
Instruction ID: 796e0180e6f874f9e3daf781fdd7e74bd84a102b19b209bea209e783d957a077
Opcode Fuzzy Hash: 42659737104c80c07e9846b63d526cfee1ce295624b73bfd3fb8e047cceb0fec
Instruction Fuzzy Hash: D2317871B00229ABDB24DF65DD81ADEB7B8EB44310F5040EAE904A7351D778EE448F5C

Uniqueness

Uniqueness Score: -1.00%

Function 00424B74 Relevance: 3.0, APIs: 2, Instructions: 24fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00424B88
FindClose.KERNEL32(00000000,?,?), ref: 00424B93

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3b7b8ae2faa15df2c07da32fc0b8b9799ded07ea549e46d916206e73d94a739b
Instruction ID: d8fc9fb91bce8af4b1c4e4b703f86f1a301d6b94da96fb367cb3d589edda14b5
Opcode Fuzzy Hash: 3b7b8ae2faa15df2c07da32fc0b8b9799ded07ea549e46d916206e73d94a739b
Instruction Fuzzy Hash: D3E01B3190061947CB20DEB9DC49BDB779CAB84324F5407977D28C32D1E738EA55869A

Uniqueness

Uniqueness Score: -1.00%

Function 00424D58 Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,00424E1F,00000000,?,?,?,00422F52), ref: 00424D73
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00424E1F,00000000,?,?,?,00422F52), ref: 00424D7E

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6a71c6e7ef97c2a5fb9a493e2f46f97449728dd588981de2b0c989bcfbc02975
Instruction ID: bdf729f2c76547e9294129b6043dc3896349c7a0640c821610c1a3fb9eb6f338
Opcode Fuzzy Hash: 6a71c6e7ef97c2a5fb9a493e2f46f97449728dd588981de2b0c989bcfbc02975
Instruction Fuzzy Hash: 7EE0CD3271434811C71055FA1CC97AB73CCAB84324F4407AB7C5CD21D2EB3C8950019D

Uniqueness

Uniqueness Score: -1.00%

Function 00425874 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 00425895

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: d92bc986ef81812ceff184397a2704dd1345a0b70e15d0921bb9ce514f0ee12e
Instruction ID: cbc403bdb30c5b628bad92339df88a3604d98f03f7add9cf00e72c7a3d5c39a6
Opcode Fuzzy Hash: d92bc986ef81812ceff184397a2704dd1345a0b70e15d0921bb9ce514f0ee12e
Instruction Fuzzy Hash: 1611C0B5A00209AFDB04DF99C8819EFB7F9FFCC304B14C569A519E7254E6319A018B94

Uniqueness

Uniqueness Score: -1.00%

Function 00429DD8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00429DF6

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: def7ac3e456bb8f8ec7bf3fd384838056e1632a3009c17d1bba6b72a090af279
Instruction ID: 67777cc51c3e3a8affb08b4c0b1f9cdeec2521c4ed3bfa8c9619515006d4a270
Opcode Fuzzy Hash: def7ac3e456bb8f8ec7bf3fd384838056e1632a3009c17d1bba6b72a090af279
Instruction Fuzzy Hash: 82E0D87270031417D310A5595C86EFB725C9788300F40417FBE05D7383EDB49E9042ED

Uniqueness

Uniqueness Score: -1.00%

Function 00429E24 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00429F26,?,00000001,00000000,0042A135), ref: 00429E37

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 42eda52df85462583e631e3bece2b3b05b8c069128f14d6ed3dd90bd0c6255f1
Instruction ID: 65d72377fed7332669f71cbd0272c2506b4d9e4e24131374b0ea35ead9819877
Opcode Fuzzy Hash: 42eda52df85462583e631e3bece2b3b05b8c069128f14d6ed3dd90bd0c6255f1
Instruction Fuzzy Hash: 1CD0A7B730927076E210915B7E85EBB56DCCBC9771F51443BBB48C6242E214CC06D375

Uniqueness

Uniqueness Score: -1.00%

Function 00428164 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0042816C

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e96037cdcb3af8b33d5c2ea492dad19547a9688f617538e7be4aa87ff84122d3
Instruction ID: 54c9bdabe8e395a7f608ec81a9535ec0056474b9b36f6d7f26fe090c1deeff9c
Opcode Fuzzy Hash: e96037cdcb3af8b33d5c2ea492dad19547a9688f617538e7be4aa87ff84122d3
Instruction Fuzzy Hash: 75E0A56040D621A1C344AF56D44143EB7E5AED4B42F808C9EF8D4401A1EB38C5E8D36B

Uniqueness

Uniqueness Score: -1.00%

Function 004412E8 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b21352abde81e8ee2e7784e7ba7487dd1bed82b7de2696400854922f7f065d9
Instruction ID: 6b8c1f254004efe189f6bbb4a7b1384ef2992162a6a0a8b41d9a8cff10a552b8
Opcode Fuzzy Hash: 5b21352abde81e8ee2e7784e7ba7487dd1bed82b7de2696400854922f7f065d9
Instruction Fuzzy Hash: 5202C036910235CFDB92CF69C180109B7B6FF8A72432A82D6D854AB229D270BE51DFD1

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA4 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: 9c2adda681bae308b16cda7bcb35e3e1c7b0fb4e491055bf19dcf38a0b2ed589
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: 2801D632B043114B870CDD3EDDD952AB6D3ABC8910F09C73E9589C72C4DD318C1AC286

Uniqueness

Uniqueness Score: -1.00%

Function 00430804 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0043080D

Part of subcall function 004307D8: GetProcAddress.KERNEL32(00000000), ref: 004307F1

Strings

VariantChangeTypeEx, xrefs: 0043081B
VarBstrFromBool, xrefs: 004309E9
VarMod, xrefs: 004308CB
VarDiv, xrefs: 0043089F
VarOr, xrefs: 004308F7
VarXor, xrefs: 0043090D
VarR4FromStr, xrefs: 0043094F
VarBoolFromStr, xrefs: 004309A7
VarAdd, xrefs: 0043085D
VarSub, xrefs: 00430873
VarI4FromStr, xrefs: 00430939
VarBstrFromCy, xrefs: 004309BD
VarMul, xrefs: 00430889
VarBstrFromDate, xrefs: 004309D3
oleaut32.dll, xrefs: 00430808
VarNot, xrefs: 00430847
VarCyFromStr, xrefs: 00430991
VarAnd, xrefs: 004308E1
VarCmp, xrefs: 00430923
VarIdiv, xrefs: 004308B5
VarDateFromStr, xrefs: 0043097B
VarR8FromStr, xrefs: 00430965
VarNeg, xrefs: 00430831

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: e0839a13ef9fe47684dd56df152b3b05aa7d9bef75fba41a3ad76975bab60dfe
Instruction ID: 92727bea0c399d7e089baf32d9d5e319d72316314fc2ded378fb3a487a5c4fc3
Opcode Fuzzy Hash: e0839a13ef9fe47684dd56df152b3b05aa7d9bef75fba41a3ad76975bab60dfe
Instruction Fuzzy Hash: 0B41FA616483085B53847B6E786182A77E8E75C714FA0E33BF5049AEA5DB38BC418E2D

Uniqueness

Uniqueness Score: -1.00%

Function 004169B8 Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 130libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(PSAPI.dll,?,00416EC9), ref: 004169CC

Strings

GetModuleBaseNameA, xrefs: 00416A24
GetModuleFileNameExA, xrefs: 00416A36
GetModuleFileNameExW, xrefs: 00416A12, 00416A5A
EnumDeviceDrivers, xrefs: 00416B56
EnumProcessModules, xrefs: 004169EE
GetMappedFileNameA, xrefs: 00416AEA
EnumProcesses, xrefs: 004169DC
PSAPI.dll, xrefs: 004169C7
QueryWorkingSet, xrefs: 00416A90
GetProcessMemoryInfo, xrefs: 00416B68
GetDeviceDriverFileNameW, xrefs: 00416AD8, 00416B44
GetModuleBaseNameW, xrefs: 00416A00, 00416A48
InitializeProcessForWsWatch, xrefs: 00416AA2
GetModuleInformation, xrefs: 00416A6C
EmptyWorkingSet, xrefs: 00416A7E
GetDeviceDriverBaseNameW, xrefs: 00416AC6, 00416B32
GetDeviceDriverBaseNameA, xrefs: 00416AFC
GetMappedFileNameW, xrefs: 00416AB4, 00416B20
GetDeviceDriverFileNameA, xrefs: 00416B0E

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: EmptyWorkingSet$EnumDeviceDrivers$EnumProcessModules$EnumProcesses$GetDeviceDriverBaseNameA$GetDeviceDriverBaseNameW$GetDeviceDriverFileNameA$GetDeviceDriverFileNameW$GetMappedFileNameA$GetMappedFileNameW$GetModuleBaseNameA$GetModuleBaseNameW$GetModuleFileNameExA$GetModuleFileNameExW$GetModuleInformation$GetProcessMemoryInfo$InitializeProcessForWsWatch$PSAPI.dll$QueryWorkingSet
API String ID: 1029625771-2267155864
Opcode ID: 3b17d900d9fb32b61366c26caae8728510ed44753c1ef3421e4c8f10743df750
Instruction ID: dafbba327100e23e13b9bce306479ad729c29725f9fa77da75123b8140bb5cb0
Opcode Fuzzy Hash: 3b17d900d9fb32b61366c26caae8728510ed44753c1ef3421e4c8f10743df750
Instruction Fuzzy Hash: F34101B0A40A50ABDF00EBA9D886FA637B8FB59305751066AB400CF264D77CE8C18B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00415F10 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61registryclipboardwindowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(MouseZ,Magellan MSWHEEL), ref: 00415F28
RegisterClipboardFormatW.USER32(MSWHEEL_ROLLMSG), ref: 00415F34
RegisterClipboardFormatW.USER32(MSH_WHEELSUPPORT_MSG), ref: 00415F43
RegisterClipboardFormatW.USER32(MSH_SCROLL_LINES_MSG), ref: 00415F4F
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00415F67
SendMessageW.USER32(00000000,?,00000000,00000000), ref: 00415F8B

Strings

MSWHEEL_ROLLMSG, xrefs: 00415F2F
Magellan MSWHEEL, xrefs: 00415F1E
MSH_SCROLL_LINES_MSG, xrefs: 00415F4A
MouseZ, xrefs: 00415F23
MSH_WHEELSUPPORT_MSG, xrefs: 00415F3E

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 1aa6db04791840d1f838eaca6eb156c58cb8deeae8a85bebaaa1482f2d7939e1
Instruction ID: fbfa7c2c10157cbc6459837c8ee6b7d3063f3ad165bdc784deb74b8f7a3f5c78
Opcode Fuzzy Hash: 1aa6db04791840d1f838eaca6eb156c58cb8deeae8a85bebaaa1482f2d7939e1
Instruction Fuzzy Hash: E5111F70204701EFE3159F65C842BEBBBA8EF85754F60402AF8449B285E6B89D818B98

Uniqueness

Uniqueness Score: -1.00%

Function 00429E50 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0042A135,?,?,?,?,00000000,00000000), ref: 00429E77
GetThreadLocale.KERNEL32(?,00000001,00000000,0042A135,?,?,?,?,00000000,00000000), ref: 00429E80

Part of subcall function 00429E24: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00429F26,?,00000001,00000000,0042A135), ref: 00429E37

Part of subcall function 00429DD8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00429DF6

Strings

AMPM , xrefs: 0042A0BD
m/d/yy, xrefs: 00429F81
AMPM, xrefs: 0042A0AE
mmmm d, yyyy, xrefs: 00429FA6
2, xrefs: 0042A111
:mm:ss, xrefs: 0042A0E8
:mm, xrefs: 0042A0CD

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 1ee8cf7d1d2100117b1e952d746c51a6bc7536ec43c56e5ee8175d076dabd0e5
Instruction ID: de098bb62cddf8eeaab23ab6c58694bf9fc9945ba54a5f45fc28193c39012481
Opcode Fuzzy Hash: 1ee8cf7d1d2100117b1e952d746c51a6bc7536ec43c56e5ee8175d076dabd0e5
Instruction Fuzzy Hash: AF7132317101289BDB01EBA5E841BDF72AADF44704F94807BF904AB346DA3CDE16976E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A584 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00409448: GetTickCount.KERNEL32 ref: 0040947F
Part of subcall function 00409448: GetTickCount.KERNEL32 ref: 00409497

Part of subcall function 00429DD8: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00429DF6

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0042A61C
EnumCalendarInfoW.KERNEL32(0042A448,00000000,00000000,00000004), ref: 0042A627
GetThreadLocale.KERNEL32(00000000,00000003,0042A448,00000000,00000000,00000004), ref: 0042A662
EnumCalendarInfoW.KERNEL32(0042A4EC,00000000,00000000,00000003,0042A448,00000000,00000000,00000004), ref: 0042A66D
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0042A6FE
EnumCalendarInfoW.KERNEL32(0042A448,00000000,00000000,00000004), ref: 0042A709
GetThreadLocale.KERNEL32(00000000,00000003,0042A448,00000000,00000000,00000004), ref: 0042A746
EnumCalendarInfoW.KERNEL32(0042A4EC,00000000,00000000,00000003,0042A448,00000000,00000000,00000004), ref: 0042A751

Strings

B.C., xrefs: 0042A6AC

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: ed2633bfbf01954b83452c2ae3521b02fcae5d245beea307e078fed541a42bf1
Instruction ID: 7b532adcd31deb5feb0d66c23733b9de51a913cecd74f929d691c27f48c900b8
Opcode Fuzzy Hash: ed2633bfbf01954b83452c2ae3521b02fcae5d245beea307e078fed541a42bf1
Instruction Fuzzy Hash: 6461A274B006108FDB10EF69D885E9A77B5FB88314B90857AEC00D73A1C738ED91CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00432D70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00432E09
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00432E25
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00432E5E
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00432EDB
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00432EF4
VariantCopy.OLEAUT32(?), ref: 00432F29

Strings

, xrefs: 00432D8A

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: a88f8c186627226a8bb89a534aa3a27678cbc0ad8fea231a65c47542f7067d81
Instruction ID: 4ec420417957f98377c31f631acc3d5e9fbeafff5ff5c0a360f7f9dd5ce58477
Opcode Fuzzy Hash: a88f8c186627226a8bb89a534aa3a27678cbc0ad8fea231a65c47542f7067d81
Instruction Fuzzy Hash: 7D5100759006299BCB21DB59DD91BDAB3BCBF0C314F0051DAF909E7202D678AF818F64

Uniqueness

Uniqueness Score: -1.00%

Function 0042B564 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0042B76A), ref: 0042B604
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0042B76A), ref: 0042B630

Part of subcall function 00410254: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00410299

Strings

(hA, xrefs: 0042B6B9
0gA, xrefs: 0042B5D2
(gA, xrefs: 0042B5C3
gA, xrefs: 0042B5B4
8gA, xrefs: 0042B5E1

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: gA$(gA$(hA$0gA$8gA
API String ID: 902310565-2315461067
Opcode ID: aa4007e2ac4df262029a5b5b3c5ebc1777ff6d8d55acbb50982d19775eae0fa7
Instruction ID: c20b52338d199a289a12ca4b603f57bff3eb28f55eb7dd03666e4b5dd3f0ee9f
Opcode Fuzzy Hash: aa4007e2ac4df262029a5b5b3c5ebc1777ff6d8d55acbb50982d19775eae0fa7
Instruction Fuzzy Hash: A651E734A04668DFDB50DF68DD89AD9B7F4EB48304F4041E6E808A7351D778AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004091E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation,00000000), ref: 004091F6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004091FC
GetLogicalProcessorInformation.KERNEL32(00000000,00000000,GetLogicalProcessorInformation,00000000), ref: 0040920F
GetLastError.KERNEL32(00000000,00000000,GetLogicalProcessorInformation,00000000), ref: 00409218
GetLogicalProcessorInformation.KERNEL32(00000000,00000000,00000000,0040928C,?,00000000,00000000,GetLogicalProcessorInformation,00000000), ref: 00409243

Strings

GetLogicalProcessorInformation, xrefs: 004091EC
kernel32.dll, xrefs: 004091F1

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-812649623
Opcode ID: b5b5ef7ece3e5db104d06d6a461812be039b62a027b790defb21eca3e90c2c69
Instruction ID: 1748b76f01d1b7f4fa5c93cc10198c5b6f48fdbdd5d7321f97b5cbe42bf4362f
Opcode Fuzzy Hash: b5b5ef7ece3e5db104d06d6a461812be039b62a027b790defb21eca3e90c2c69
Instruction Fuzzy Hash: 64117271D08604BEEB10EBA5D842B9EB7A8DB40314F2049BFE404B65C3D67D9D808619

Uniqueness

Uniqueness Score: -1.00%

Function 00405F68 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405BD8), ref: 00405FFE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405BD8), ref: 00406018

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3d12017965c1e6ec3bb7374744ea864a06a5e0024714f769dd9334216f0e0332
Instruction ID: 9151ffcba9cb40bf2fae9799633bdcc14248b04464888a796b8d01ff3c8e85bd
Opcode Fuzzy Hash: 3d12017965c1e6ec3bb7374744ea864a06a5e0024714f769dd9334216f0e0332
Instruction Fuzzy Hash: 70710331244A109FE725CB29CD84B17BBE5EB45324F14C27FE849AB3D2D6788841CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042AE5C Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042AC64: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0042AE10), ref: 0042AC97
Part of subcall function 0042AC64: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0042ACBB
Part of subcall function 0042AC64: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042ACD6
Part of subcall function 0042AC64: LoadStringW.USER32(00000000,0000FFEF,?,00000100), ref: 0042AD71

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0042AF81), ref: 0042AEBD
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042AEF0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042AF02
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042AF08
GetStdHandle.KERNEL32(000000F4,0042AF9C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0042AF1C
WriteFile.KERNEL32(00000000,000000F4,0042AF9C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0042AF22
LoadStringW.USER32(00000000,0000FFD0,?,00000040), ref: 0042AF46
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0042AF60

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: b09159c0806e6ff97a796ec39832f3a121be48d1c476e2ccab17963672d8f62d
Instruction ID: 0d96ae8e9d09ebb0fb24c4c868295916678d77c4f245c56f45ea8f186dc1020f
Opcode Fuzzy Hash: b09159c0806e6ff97a796ec39832f3a121be48d1c476e2ccab17963672d8f62d
Instruction Fuzzy Hash: A73188B1744218BFEB10E795EC82FDA73ACEB44704F904166BA04E71D1DEB87E848769

Uniqueness

Uniqueness Score: -1.00%

Function 00406160 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5fee4053ccfd8eda4222657e49ae256434644a39e4506ff90d3e4f52558343
Instruction ID: e4bb5e60ae9d8a74cb8e59fb61834b0517264fe028697c87ef6dc4da0fb2cfcf
Opcode Fuzzy Hash: af5fee4053ccfd8eda4222657e49ae256434644a39e4506ff90d3e4f52558343
Instruction Fuzzy Hash: 65C14272710A010BD714AA7D9C8476FB692DBC4324F29823FE605EB3D6DA7CEC418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00409448 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004098BC: GetCurrentThreadId.KERNEL32 ref: 004098BF

GetTickCount.KERNEL32 ref: 0040947F
GetTickCount.KERNEL32 ref: 00409497
GetCurrentThreadId.KERNEL32 ref: 004094C6
GetTickCount.KERNEL32 ref: 004094F1
GetTickCount.KERNEL32 ref: 00409528
GetTickCount.KERNEL32 ref: 00409552
GetCurrentThreadId.KERNEL32 ref: 004095C2

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 45b437dbed47f981b5bbcfaaf90de7331bcc883f9fb90d2309538c648ee17df6
Instruction ID: 4197c7784af8f999670a3dde22c005d51560284a8e20b89e315f358f9684a336
Opcode Fuzzy Hash: 45b437dbed47f981b5bbcfaaf90de7331bcc883f9fb90d2309538c648ee17df6
Instruction Fuzzy Hash: 1D41407160C7416ED722AE79C98435FBAD1AF80354F14893EE4D8973C3EA798C81875A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A428 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?,?,0040A5FA,00407203,0040724A,?,?), ref: 0040A461
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?,?,0040A5FA,00407203,0040724A,?), ref: 0040A467
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?), ref: 0040A482
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6), ref: 0040A488

Strings

Runtime error at 00000000, xrefs: 0040A45A, 0040A49F
Error, xrefs: 0040A49A

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: a5c2b3ef274f10e101e72884be1022945b687b6694a4f5241685cc9f5443053d
Instruction ID: 8a2e0f98f1cb10d7845291bb527a883e0b6e36b5f05b7f91f10e3923a5105889
Opcode Fuzzy Hash: a5c2b3ef274f10e101e72884be1022945b687b6694a4f5241685cc9f5443053d
Instruction Fuzzy Hash: 74F0625168478478EA10B3B55C0AF6B3618F744B25F54477FB620B82E2CAFC48848B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00422CD4 Relevance: 9.2, APIs: 6, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,?,00000000,00422F11), ref: 00422D31
CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000001,00000000,?,?,00000000,00422F11), ref: 00422DC7
MapViewOfFile.KERNEL32(000003EE,00000004,00000000,00000000,00000001,00000000,00422EA0,?,?,00000000,00000002,00000000,00000001,00000000,?,?), ref: 00422DF6
GetCurrentProcess.KERNEL32(00000104,00000000,00422E82,?,000003EE,00000004,00000000,00000000,00000001,00000000,00422EA0,?,?,00000000,00000002,00000000), ref: 00422E1B
UnmapViewOfFile.KERNEL32(00000000,00422E89,000003EE,00000004,00000000,00000000,00000001,00000000,00422EA0,?,?,00000000,00000002,00000000,00000001,00000000), ref: 00422E7C

Part of subcall function 00422AAC: GetLogicalDriveStringsW.KERNEL32(00000104,?,00000000,00422BDA), ref: 00422AE9
Part of subcall function 00422AAC: QueryDosDeviceW.KERNEL32(?,?,00000104,00000104,?,00000000,00422BDA), ref: 00422B13

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: File$View$CreateCurrentDeviceDriveLogicalMappingProcessQuerySizeStringsUnmap
String ID:
API String ID: 435433801-0
Opcode ID: ad4652ba22eff28cab9b011fb52d156467f253577bc146de9d54660df817ed2e
Instruction ID: 5a254778e1851bdcbdf599d1b6fa6e3d011a768260e796bad8529f9734c59cc4
Opcode Fuzzy Hash: ad4652ba22eff28cab9b011fb52d156467f253577bc146de9d54660df817ed2e
Instruction Fuzzy Hash: 93517230A00219BFDB20EFA5DD95BDEB7B5EB48304F9044AAE504A7290D7B85E81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004064AC Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405618,00000000,?,00000000,?,?,00000000,00406E45), ref: 004064CE
WriteFile.KERNEL32(00000000,000000F4,00405618,00000000,?,00000000,?,?,00000000,00406E45), ref: 004064D4
GetStdHandle.KERNEL32(000000F4,00405614,00000000,?,00000000,00000000,000000F4,00405618,00000000,?,00000000,?,?,00000000,00406E45), ref: 004064F3
WriteFile.KERNEL32(00000000,000000F4,00405614,00000000,?,00000000,00000000,000000F4,00405618,00000000,?,00000000,?,?,00000000,00406E45), ref: 004064F9
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405614,00000000,?,00000000,00000000,000000F4,00405618,00000000,?), ref: 00406510
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405614,00000000,?,00000000,00000000,000000F4,00405618,00000000), ref: 00406516

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 3dc040826da280c7b9392c470598f39269d0a841bb0d5035c6e1c5611a8b6961
Instruction ID: 2a8ba324e91a7e7a8d1e7623cdd631929826dbf6519b3623dff416626cd046b0
Opcode Fuzzy Hash: 3dc040826da280c7b9392c470598f39269d0a841bb0d5035c6e1c5611a8b6961
Instruction Fuzzy Hash: C90144A1248B103EE501F7BA9C86FAB268CDF4972DF51063B7118F60D2C5788D548FBA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BE4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00405BB0), ref: 00405C9B
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00405BB0), ref: 00405CB1
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00405BB0), ref: 00405CDF
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00405BB0), ref: 00405CF5

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fd9e149fc077c62ac1cb0d2a52850570bd8223e1c6952a906501d14ae0c51be4
Instruction ID: 73b3eeebb6945c8d2749b15a811edb9c3e4d553475b65aec9881030c5ef190ba
Opcode Fuzzy Hash: fd9e149fc077c62ac1cb0d2a52850570bd8223e1c6952a906501d14ae0c51be4
Instruction Fuzzy Hash: 56C12072604B618BDB25CF29E884B17BBA1FB85310F1882BFD445AB3D5C7789941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0042AC64 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0042AE10), ref: 0042AC97
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0042ACBB
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042ACD6
LoadStringW.USER32(00000000,0000FFEF,?,00000100), ref: 0042AD71

Strings

MZP, xrefs: 0042ACD5

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: ba77518689330cb1b0535cf0a7d48155ff414153aaea9229868a9b2700b7f7a0
Instruction ID: ae8db52867a6f02680e14c50f2ed2f4cf839cf6d740da82d911e2f87a05549bd
Opcode Fuzzy Hash: ba77518689330cb1b0535cf0a7d48155ff414153aaea9229868a9b2700b7f7a0
Instruction Fuzzy Hash: E5415270A002689FDB20DF55DD81BD9B7F9AB88304F8040EAE908E7251D7799EA4CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00439E3C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b76a4bdee36c4afcba397b63e3570457c9e699ab127eb2a4a91cf48366803d
Instruction ID: 71429c688a4c31f75ba805e4d2a083748cfbcbec8ea10e1a626119188e79f16b
Opcode Fuzzy Hash: 64b76a4bdee36c4afcba397b63e3570457c9e699ab127eb2a4a91cf48366803d
Instruction Fuzzy Hash: 2ED1BE35A04149AFCF00EFA5C4818FEBBB9FF4D314F5450A6E840A7351E638AE55CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0043891C Relevance: 7.8, APIs: 5, Instructions: 269COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00438988
VariantInit.OLEAUT32(?), ref: 00438A9B

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 1a5ef56cd7e7e4459cd6da983dfe7ef76dd614a8f874364c6a0c4c4a86e3860d
Instruction ID: 3b33c8a4d625262ce05aac053ee8e330884a6e6640a5839ce2bf0caaaa85649f
Opcode Fuzzy Hash: 1a5ef56cd7e7e4459cd6da983dfe7ef76dd614a8f874364c6a0c4c4a86e3860d
Instruction Fuzzy Hash: 7EB12775A00209EFCB04EF95C5818EDB7B4EF4D714F9064AAF900A7251DB38AE85DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040A4F6
FreeLibrary.KERNEL32(00400000,?,?,?,?,0040A5FA,00407203,0040724A,?,?,00407263,?,?,?,?,00461CE6), ref: 0040A594
ExitProcess.KERNEL32(00000000,?,?,?,?,0040A5FA,00407203,0040724A,?,?,00407263,?,?,?,?,00461CE6), ref: 0040A5CD

Part of subcall function 0040A428: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?,?,0040A5FA,00407203,0040724A,?,?), ref: 0040A461
Part of subcall function 0040A428: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?,?,0040A5FA,00407203,0040724A,?), ref: 0040A467
Part of subcall function 0040A428: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6,?,?,?), ref: 0040A482
Part of subcall function 0040A428: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040A4E6), ref: 0040A488

Strings

@3B, xrefs: 0040A4CE

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: @3B
API String ID: 3490077880-3814855006
Opcode ID: d7a5be3b1cd6048d197d4fe152a8bda805781fe9892db142f3eab9669dbd1bde
Instruction ID: 5d1d9798a3a686d6ed063720b418eab16085fba7c731d977bf47d82cfd733821
Opcode Fuzzy Hash: d7a5be3b1cd6048d197d4fe152a8bda805781fe9892db142f3eab9669dbd1bde
Instruction Fuzzy Hash: E331AD70600740ABDB30ABB6884871B76E0BB08318F18443FE405AB2D1D77CDCA4C71B

Uniqueness

Uniqueness Score: -1.00%

Function 00428574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00428657), ref: 004285FA
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00428657), ref: 00428600

Strings

, xrefs: 004285C6
yyyy, xrefs: 004285D5

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 4f1f99426b1af829e2c909c2451d964a6fb8680ff718a23145411cafab76a871
Instruction ID: 6637f5fd66acc0210661637f80b1713101e3411e92d846e5cdc835b8e1ef0f6c
Opcode Fuzzy Hash: 4f1f99426b1af829e2c909c2451d964a6fb8680ff718a23145411cafab76a871
Instruction Fuzzy Hash: E02165356016289BDB11DF95D841AAEB3F8EF08700F5144ABFC04E7381DB389E54C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00416058 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(hhctrl.ocx,00416111), ref: 00416066

Part of subcall function 00414F7C: GetProcAddress.KERNEL32(004427A8,?), ref: 00414FA0

Part of subcall function 00414F7C: GetProcAddress.KERNEL32(004427A8,00000000), ref: 00414FC2

Strings

hhctrl.ocx, xrefs: 00416061
HtmlHelpW, xrefs: 0041608E
HtmlHelpA, xrefs: 00416079

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HtmlHelpA$HtmlHelpW$hhctrl.ocx
API String ID: 2238633743-2872279806
Opcode ID: 423fae1a5712db9c4d01cb5542911d204a440723cb33bc678aaa6d1a26fd76b2
Instruction ID: d61c27442857f174904f1baba1beb4b108deb7937cca62d30b80dfa8185e3ce6
Opcode Fuzzy Hash: 423fae1a5712db9c4d01cb5542911d204a440723cb33bc678aaa6d1a26fd76b2
Instruction Fuzzy Hash: 60F09274540B109EDF15DB65E859BD63AB6B35C705FA2442AE000862A0D7BDB5C4CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00424BC0 Relevance: 6.1, APIs: 4, Instructions: 112timeCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00000000,00000000,?,00000000,00424CF2), ref: 00424BFA
GetFileAttributesExW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,00424CF2), ref: 00424C5D
GetLastError.KERNEL32(00000000,00000000,?,00000000,00424CF2), ref: 00424C6C
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,00000000,?,00000000,00424CF2), ref: 00424CB5

Part of subcall function 00422F24: GetFileAttributesW.KERNEL32(00000000), ref: 00422F71
Part of subcall function 00422F24: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00422FA3
Part of subcall function 00422F24: CloseHandle.KERNEL32(000000FF,00422FEC,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00422FDF

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: File$Attributes$Time$CloseCreateErrorHandleLastLocal
String ID:
API String ID: 3059364927-0
Opcode ID: 5e7c79930a72b09e5ff77fc31b3e36cc653edefa963234aef69869e02b34d4e2
Instruction ID: d33ed64edae41702e397e581a60024facf28ab7922bf400e91a9c9f08f4d251c
Opcode Fuzzy Hash: 5e7c79930a72b09e5ff77fc31b3e36cc653edefa963234aef69869e02b34d4e2
Instruction Fuzzy Hash: E131A871E01229ABCB10EFEAD981BAEB7B9EF84304F524567F800E3341D7389E059658

Uniqueness

Uniqueness Score: -1.00%

Function 0040DEEC Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040DEFD
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040DF5B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040DFB8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040DFEB

Part of subcall function 0040DEA8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040DF69), ref: 0040DEBF
Part of subcall function 0040DEA8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040DF69), ref: 0040DEDC

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 15ae0c7a0683f35f4954645567adbb561c3980bc8151f8db019a494b3132f1ec
Instruction ID: ed53143e23c3fe3e570e85c1ff96fbf00cdd0e2ebef1580dbd30679384d2b5a9
Opcode Fuzzy Hash: 15ae0c7a0683f35f4954645567adbb561c3980bc8151f8db019a494b3132f1ec
Instruction Fuzzy Hash: 53316370E0021A9BCB10DBE9C895AAEB3B8FF58314F004576E511FB2D1D7789D49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004250B0 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 004250CD
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 004250DE
SetFileTime.KERNEL32(?,00000000,00000000,?), ref: 004250FA
GetLastError.KERNEL32(?,00000000,00000000,?), ref: 00425103

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: Time$File$DateErrorLastLocal
String ID:
API String ID: 4098483309-0
Opcode ID: 730b44dcf02f7a47d28b967bc5d2fb3c5397017f6f4bed316b92bd236c1fc5e5
Instruction ID: 104ce1d5c36ce0db7031dab684c0c83d281e793dc59dbf0bc52fdb779c7bd7f3
Opcode Fuzzy Hash: 730b44dcf02f7a47d28b967bc5d2fb3c5397017f6f4bed316b92bd236c1fc5e5
Instruction Fuzzy Hash: 64F04F72A006197ACB10DAE95C81BFFB3EC9B48345F504167B900E2281F678DA0483A9

Uniqueness

Uniqueness Score: -1.00%

Function 004248D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00424E30: GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,0042493D), ref: 00424E46

GetVolumeInformationW.KERNEL32(00000000,?,00000104,00000104,?,?,00000104,00000104), ref: 00424990
GetDriveTypeW.KERNEL32(00000000,00000000,?,00000104,00000104,?), ref: 004249B5

Part of subcall function 00424D98: GetFileAttributesW.KERNEL32(00000000,?,?,?,00422F52), ref: 00424DA9

Strings

|HB, xrefs: 00424904, 00424A28

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AttributesFile$DriveInformationTypeVolume
String ID: |HB
API String ID: 2660071179-47754647
Opcode ID: 59c1109705d04a2b68fe279d5e633c08280419d2b124c901f533439a887fabf5
Instruction ID: 1d84b7afeaea9bcce400ccf02c52260b49ede79b3fdc239eada8d72e5af75229
Opcode Fuzzy Hash: 59c1109705d04a2b68fe279d5e633c08280419d2b124c901f533439a887fabf5
Instruction Fuzzy Hash: ED31ABB0B001285BDB11E7A5E842BEF77A4DF84308F850167E901A73D1D77C9E85D65D

Uniqueness

Uniqueness Score: -1.00%

Function 00422BE8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,NtQueryObject), ref: 00422C0E

Part of subcall function 00414F7C: GetProcAddress.KERNEL32(004427A8,?), ref: 00414FA0

Strings

NtQueryObject, xrefs: 00422C04
NTDLL.DLL, xrefs: 00422C09

Memory Dump Source

Source File: 00000000.00000002.2857267956.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2857247249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.00000000008E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.0000000000960000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2857267956.000000000099B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2858280239.00000000009A8000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_avz.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NTDLL.DLL$NtQueryObject
API String ID: 1646373207-3865875859
Opcode ID: c7194e78d248e79cc6de978be01c56cbecd9f0151e5e89ad9617909cd235c3c3
Instruction ID: 199557c96de0f5bba26cc897b3fa2e069fb6324f482ff4156a06a5118d166eb1
Opcode Fuzzy Hash: c7194e78d248e79cc6de978be01c56cbecd9f0151e5e89ad9617909cd235c3c3
Instruction Fuzzy Hash: DF118E71704614BFEB10EFA6EE82F9E73B8EB48714F604466F104E6290D6B8A9C0861C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report avz.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: avz.exePID: 7728, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: avz.exePID: 7728, Parent PID: 2580COMMON

Windows Analysis Report
avz.exe

Function 0040E850 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Function 0040E718 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Function 0040E33C Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Function 0040E008 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Function 00410B90 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Function 00424D98 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Function 00424E30 Relevance: 9.1, APIs: 6, Instructions: 83
fileCOMMON

Function 0040678C Relevance: 3.8, APIs: 3, Instructions: 32
sleepmemoryCOMMON

Function 0040E91C Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Function 0040EA40 Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Function 00429D54 Relevance: 3.0, APIs: 2, Instructions: 49
windowCOMMON

Function 0042D63C Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Function 0042BC90 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Function 00415EB8 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Function 0040D7CC Relevance: 1.5, APIs: 1, Instructions: 26
COMMON