Edit tour

Windows Analysis Report
4NsDuAp8TA.exe

Overview

General Information

Sample name:	4NsDuAp8TA.exe renamed because original name is a hash value
Original sample name:	0471df01d611ffbd17f9bb9e6e32d69685d2378184c69107ff78a31bbbc84567.exe
Analysis ID:	1438239
MD5:	cae6f54148013b927ed9f993f739ae2e
SHA1:	381484ae43668a86797ef320f3d0eaaf0e907251
SHA256:	0471df01d611ffbd17f9bb9e6e32d69685d2378184c69107ff78a31bbbc84567
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

4NsDuAp8TA.exe (PID: 1124 cmdline: "C:\Users\user\Desktop\4NsDuAp8TA.exe" MD5: CAE6F54148013B927ED9F993F739AE2E)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 4NsDuAp8TA.exe

Virustotal: Detection: 38%

Perma Link

Source: 4NsDuAp8TA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_00405454 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405454
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_00405E7B FindFirstFileA,FindClose,	0_2_00405E7B

Source: 4NsDuAp8TA.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 4NsDuAp8TA.exe, 00000000.00000002.2045049060.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error(
Source: 4NsDuAp8TA.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FC2

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_004030EF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030EF

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00404801

0_2_00404801

Source: 4NsDuAp8TA.exe

Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: 4NsDuAp8TA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_004042C5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004042C5

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

File created: C:\Users\user\AppData\Local\Temp\nsi56C.tmp

Jump to behavior

Source: 4NsDuAp8TA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4NsDuAp8TA.exe

Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

File read: C:\Users\user\Desktop\4NsDuAp8TA.exe

Jump to behavior

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00405EA2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA2

Source: 4NsDuAp8TA.exe

Static PE information: real checksum: 0x70616 should be: 0x310b9

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

API coverage: 8.3 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_00405454 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405454
Source: C:\Users\user\Desktop\4NsDuAp8TA.exe	Code function: 0_2_00405E7B FindFirstFileA,FindClose,	0_2_00405E7B

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

API call chain: ExitProcess graph end node

graph_0-2815

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00405EA2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA2

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\4NsDuAp8TA.exe

Code function: 0_2_00405B99 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405B99

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4NsDuAp8TA.exe	38%	Virustotal		Browse

Name	Source	Malicious	Reputation
http://nsis.sf.net/NSIS_Error	4NsDuAp8TA.exe	false	high
http://nsis.sf.net/NSIS_ErrorError	4NsDuAp8TA.exe	false	high
http://nsis.sf.net/NSIS_Error(	4NsDuAp8TA.exe, 00000000.00000002.2045049060.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438239
Start date and time:	2024-05-08 14:08:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4NsDuAp8TA.exe renamed because original name is a hash value
Original Sample Name:	0471df01d611ffbd17f9bb9e6e32d69685d2378184c69107ff78a31bbbc84567.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.342181082524124
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4NsDuAp8TA.exe
File size:	165'400 bytes
MD5:	cae6f54148013b927ed9f993f739ae2e
SHA1:	381484ae43668a86797ef320f3d0eaaf0e907251
SHA256:	0471df01d611ffbd17f9bb9e6e32d69685d2378184c69107ff78a31bbbc84567
SHA512:	2c5d51b462c81d6a9461f47011313e554c0feb4ba68f65e97898686ea40e7d591e5c1b1802e1349f5e161ad683b80efa13bc7dfe0dec6b60428e49385cd73816
SSDEEP:	3072:qylurXGahXJpKmvQEMpJDqgkwQmvpUJ26qTJX:qzZzycgkyvG1qVX
TLSH:	B6F30756E3099CB8DD1A0775667BEDB10A23BEB8E420641D25DE3D2F7E73382406AD07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x.......z...x...........i...,"..t.......y...Richx...........................PE..L....e.Q.................\....9....

File Icon


Icon Hash:	d080c6ee8e92ca1d

Static PE Info

General

Entrypoint:	0x4030ef
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x519965C7 [Sun May 19 23:52:39 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b40f29cd171eb54c01b1dd2683c9c26b

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], 00409190h
mov dword ptr [esp+18h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040728Ch]
push 00000008h
mov dword ptr [007A27B8h], eax
call 00007F77250DD9F3h
mov dword ptr [007A2704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079DCB8h
call dword ptr [00407164h]
push 00409180h
push 007A1F00h
call 00007F77250DD69Dh
call dword ptr [0040711Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007F77250DD68Bh
push ebx
call dword ptr [00407114h]
cmp byte ptr [007A8000h], 00000022h
mov dword ptr [007A2700h], eax
mov eax, ebp
jne 00007F77250DAC8Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 007A8001h
push dword ptr [esp+14h]
push eax
call 00007F77250DD138h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+20h], eax
jmp 00007F77250DAD40h
cmp cl, 00000020h
jne 00007F77250DAC88h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F77250DAC7Ch

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3bf000	0x111c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x63780	0xa40	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5bc2	0x5c00	d75213ff3654bd251ba7ede13ba551f3	False	0.6815132472826086	data	6.5073852787100455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	6c31e0693072284f258d2c4a271de506	False	0.4524739583333333	OpenPGP Secret Key	5.236327486414569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x3997f8	0x400	cc4b8c7cfe81dc194cfb0c595288fc86	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x1c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3bf000	0x111c8	0x11200	bbb015d8423c571296eed99a1464fd36	False	0.12783702098540145	data	4.40852816567891	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3bf208	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	English	United States	0.11396841358097717
RT_DIALOG	0x3cfa30	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x3cfb50	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x3cfc70	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3cfd38	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3cfd98	0x14	data	English	United States	1.15
RT_VERSION	0x3cfdb0	0x148	x86 executable not stripped	English	United States	0.600609756097561
RT_MANIFEST	0x3cfef8	0x2cb	XML 1.0 document, ASCII text, with very long lines (715), with no line terminators	English	United States	0.5664335664335665

Imports

DLL	Import
KERNEL32.dll	Sleep, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, CompareFileTime, SearchPathA, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, SetFileAttributesA, lstrcmpiA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, GetCommandLineA, GetTempPathA, FreeLibrary, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, WriteFile, MultiByteToWideChar
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:08:53
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\4NsDuAp8TA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4NsDuAp8TA.exe"
Imagebase:	0x400000
File size:	165'400 bytes
MD5 hash:	CAE6F54148013B927ED9F993F739AE2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.3%
Total number of Nodes:	1243
Total number of Limit Nodes:	16

Executed Functions

Function 004030EF Relevance: 72.1, APIs: 27, Strings: 14, Instructions: 324
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403110
SetErrorMode.KERNELBASE(00008001), ref: 0040311B
OleInitialize.OLE32(00000000), ref: 00403122

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

SHGetFileInfoA.SHELL32(0079DCB8,00000000,?,00000160,00000000,00000008), ref: 0040314A

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

GetCommandLineA.KERNEL32(007A1F00,NSIS Error), ref: 0040315F
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\4NsDuAp8TA.exe",00000000), ref: 00403172
CharNextA.USER32(00000000,"C:\Users\user\Desktop\4NsDuAp8TA.exe",00000020), ref: 0040319D
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403295
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032A6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032B2
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032C6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032CE
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004032DF
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004032E7
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsi56C.tmp), ref: 004032FB
OleUninitialize.OLE32(?), ref: 004033A9
ExitProcess.KERNEL32 ref: 004033C9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\4NsDuAp8TA.exe",00000000,?), ref: 004033D5
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 004033E1
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 004033ED
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 004033F4
DeleteFileA.KERNEL32(0079D8B8,0079D8B8,?,007A3000,?), ref: 0040344D
CopyFileA.KERNEL32(C:\Users\user\Desktop\4NsDuAp8TA.exe,0079D8B8,00000001), ref: 00403461
CloseHandle.KERNEL32(00000000,0079D8B8,0079D8B8,?,0079D8B8,00000000), ref: 0040348E
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004034E3
ExitWindowsEx.USER32(00000002,00000000), ref: 0040351F
ExitProcess.KERNEL32 ref: 00403542

Strings

Error launching installer, xrefs: 00403361
C:\Users\user\Desktop\4NsDuAp8TA.exe, xrefs: 0040345C
TMP, xrefs: 004032E2
NSIS Error, xrefs: 00403150
TEMP, xrefs: 004032DA
~nsu.tmp, xrefs: 004033CF
Low, xrefs: 004032C8
C:\Users\user\Desktop, xrefs: 004033DA, 004033DF, 00403402
SeShutdownPrivilege, xrefs: 004034F5
C:\Users\user\AppData\Local\Temp\, xrefs: 0040328A, 0040328F, 004032A5, 004032B1, 004032C0, 004032CD, 004032D9, 004032E1, 004033D4, 004033E0, 004033EC, 004033F3, 004034A2
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00403165, 0040316B, 0040331F
C:\Users\user\AppData\Local\Temp\nsi56C.tmp, xrefs: 004032F6
\Temp, xrefs: 004032AC
", xrefs: 004031C2

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\4NsDuAp8TA.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi56C.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\4NsDuAp8TA.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-3618925605
Opcode ID: bb2f33ecdff20610578708f8948ad051a470c2b479a9dfe6989223ef90e98589
Instruction ID: 3931d960d2cecc16523f178db0b803f8d2f925e5e1ab1ff86deffc182e7e2b76
Opcode Fuzzy Hash: bb2f33ecdff20610578708f8948ad051a470c2b479a9dfe6989223ef90e98589
Instruction Fuzzy Hash: 01B10A709083816EE7116F755C4DA2B7EE8EB86306F04457EF181B62E2C77C9A05CB6E

Function 00405EA2 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction ID: 2f3dee603afa82187d4e64c95529cacee06f2ec99598d25ed76f38a586475c1c
Opcode Fuzzy Hash: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction Fuzzy Hash: FBE08C32A04610ABC6209B209D0896B77ACEB88B41300497EF945F6151D734AC119BBA

Function 00402C33 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C44
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\4NsDuAp8TA.exe,00000400), ref: 00402C60

Part of subcall function 00405825: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 00405829
Part of subcall function 00405825: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4NsDuAp8TA.exe,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 00402CAC

Strings

Error launching installer, xrefs: 00402C83
C:\Users\user\Desktop\4NsDuAp8TA.exe, xrefs: 00402C4A, 00402C59, 00402C6D, 00402C8D
Null, xrefs: 00402D2A
C:\Users\user\Desktop, xrefs: 00402C8E, 00402C93, 00402C99
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C3D
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00402C33
soft, xrefs: 00402D21
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E0B
Inst, xrefs: 00402D18

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\4NsDuAp8TA.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3959419485
Opcode ID: 8615a0d7497347a6936d50477fdbb3dffcc1fd598afdbcafc3831bfd5a2cc2dc
Instruction ID: 9cc68cb9a8033aa8cfa9fb84db7bfe2d2ab72e09e198f7c7f71ed61724ba903c
Opcode Fuzzy Hash: 8615a0d7497347a6936d50477fdbb3dffcc1fd598afdbcafc3831bfd5a2cc2dc
Instruction Fuzzy Hash: 74510471D40204ABDB209F65DE89B6E7BA8EF40354F14403BFA04B62D1C7BC9E418BAD

Function 00405854 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405868
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405882

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405857, 0040585B
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00405854
nsa, xrefs: 0040585F

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2858627192
Opcode ID: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction ID: 7032c49e779d22ef4b019cebcd704e5cdda6a64cd28d021928a5f34cef86c798
Opcode Fuzzy Hash: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction Fuzzy Hash: 21F082777082046BDB109F66DC04B9B7B9CDF95750F14C03BFE44DA180D6B499548B59

Function 004030BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DE2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E3A
Part of subcall function 00405DE2: CharNextA.USER32(?,?,?,00000000), ref: 00405E47
Part of subcall function 00405DE2: CharNextA.USER32(?,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E4C
Part of subcall function 00405DE2: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E5C

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 004030DC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004030BC, 004030C1, 004030C7, 004030D3, 004030DB, 004030E2
C:\Users\user\AppData\Local\Temp\nsi56C.tmp, xrefs: 004030E3

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi56C.tmp
API String ID: 4115351271-3746163108
Opcode ID: 8e7680eb481f2e00cc16df113ff911000dfe49d9d02a3d1b6cba6af61926cd3a
Instruction ID: c9728f7b553dd8aa4c0e43ad66b561e8a411fb1fe81b444dc1201db4bd0af2db
Opcode Fuzzy Hash: 8e7680eb481f2e00cc16df113ff911000dfe49d9d02a3d1b6cba6af61926cd3a
Instruction Fuzzy Hash: 13D09222506D3122E99132263C06FCF1A4C8F8B35AF51817BF50A781855A6D1A92C9FE

Function 00405825 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 00405829
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction ID: d58f26a5a32defaeeb3d325f121af029a3aa60b04f4a5bd1c9a51958cab5ad8a
Opcode Fuzzy Hash: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction Fuzzy Hash: B8D09E31658301AFEF098F20DE16F2EBBA2EB84B01F10962CB642940E0D6715C15DB16

Function 00403072 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EBC,000000FF,00000004,00000000,00000000,00000000), ref: 00403089

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction ID: 0981d36ce8a37324ca65ea29ac33eec068edb21049201a101882ec42e2df6d76
Opcode Fuzzy Hash: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction Fuzzy Hash: 3FE08C32151119BBCF205E619C08AEB3B5CEB007A6F00C033BA18E5190D630EB149BA8

Function 004053A8 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxIndirectA.USER32(00409210), ref: 00405403

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: 5101a69139d125882d8b2f460b10c68b17d567ebaafa8d60d0565db0f68381b7
Instruction ID: 35481f56b36490c99b65deed9c981b3ebab50b8ac52ff9247c4327c075b7b7cb
Opcode Fuzzy Hash: 5101a69139d125882d8b2f460b10c68b17d567ebaafa8d60d0565db0f68381b7
Instruction Fuzzy Hash: B8F05274680200AFC354CF58EA447623BE0E399350F10897EE245A23B2C3B88A86CF48

Function 00403548 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(FFFFFFFF,004033A9,?), ref: 00403553

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 589a16cc77adabca8de4aa73762697773acad4ee3cb03b9089ecdffb6a6655dc
Instruction ID: fc4578a4b6b7db8cc3d98c31650a0345e59194aa90dc0d4e26b17281c046a7f9
Opcode Fuzzy Hash: 589a16cc77adabca8de4aa73762697773acad4ee3cb03b9089ecdffb6a6655dc
Instruction Fuzzy Hash: 91C08030604600A6D5247F7C9D4BA453A945741336B904735F475F50F3D73C5BC5956D

Non-executed Functions

Function 00404FC2 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 279
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405021
GetDlgItem.USER32(?,000003EE), ref: 00405030
GetClientRect.USER32(?,?), ref: 0040506D
GetSystemMetrics.USER32(00000015), ref: 00405075
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405096
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050A7
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BA
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050C8
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050DB
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32(?,000003EC), ref: 00405132
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405142
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040515B
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405167
GetDlgItem.USER32(?,000003F8), ref: 0040503F

Part of subcall function 00403EBC: SendMessageA.USER32(00000028,?,00000001,00403CED), ref: 00403ECA

GetDlgItem.USER32(?,000003EC), ref: 00405184
CreateThread.KERNEL32(00000000,00000000,Function_00004F56,00000000), ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(00000000,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405261
GetWindowRect.USER32(00000000,?), ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32 ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004052FC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405329
SetClipboardData.USER32(00000001,00000000), ref: 00405334
CloseClipboard.USER32 ref: 0040533A

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0ea0c883de9e267c42cbeb6e3c80013dc4c93350febcbc7ac3233a1783f0389b
Instruction ID: 5cc5a493c7826af022734a05619d12b61540e90d3b7798cd1ee4812e4cb533c1
Opcode Fuzzy Hash: 0ea0c883de9e267c42cbeb6e3c80013dc4c93350febcbc7ac3233a1783f0389b
Instruction Fuzzy Hash: FDA16C70900208BFEB119F60DC85AAE7F79FB44355F00816AFA05BA1A1C7795E41DFA9

Function 00404801 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404819
GetDlgItem.USER32(?,00000408), ref: 00404824
GlobalAlloc.KERNEL32(00000040,?), ref: 0040486E
LoadBitmapA.USER32(0000006E), ref: 00404881
SetWindowLongA.USER32(?,000000FC,00404DF8), ref: 0040489A
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004048AE
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004048C0
SendMessageA.USER32(?,00001109,00000002), ref: 004048D6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048E2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048F4
DeleteObject.GDI32(00000000), ref: 004048F7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404922
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040492E
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049C3
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049EE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A02
GetWindowLongA.USER32(?,000000F0), ref: 00404A31
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A3F
ShowWindow.USER32(?,00000005), ref: 00404A50
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B4D
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404BB2
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BC7
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BEB
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C0B
ImageList_Destroy.COMCTL32(?), ref: 00404C20
GlobalFree.KERNEL32(?), ref: 00404C30
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404CA9
SendMessageA.USER32(?,00001102,?,?), ref: 00404D52
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D61
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D81
ShowWindow.USER32(?,00000000), ref: 00404DCF
GetDlgItem.USER32(?,000003FE), ref: 00404DDA
ShowWindow.USER32(00000000), ref: 00404DE1

Strings

M, xrefs: 004049AA
, xrefs: 00404DB9
N, xrefs: 00404A8B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fd8361cfeaf59b72f1386bedcc7aea6d4778cb975f7506de2bc5f1e87fd31e76
Instruction ID: 73e5042133b470fdde48d750d06e43d2904589ccee469aaf4ee40575ec54014f
Opcode Fuzzy Hash: fd8361cfeaf59b72f1386bedcc7aea6d4778cb975f7506de2bc5f1e87fd31e76
Instruction Fuzzy Hash: 59027FB0900209AFEB10DF54DC85AAE7BB5FB84315F10853AF610B62E1C7799E42CF58

Function 004042C5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 268stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404314
SetWindowTextA.USER32(00000000,?), ref: 0040433E
SHBrowseForFolderA.SHELL32(?,0079E0D0,?), ref: 004043EF
CoTaskMemFree.OLE32(00000000), ref: 004043FA
lstrcmpiA.KERNEL32(007A16A0,0079ECF8), ref: 0040442C
lstrcatA.KERNEL32(?,007A16A0), ref: 00404438
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040444A

Part of subcall function 0040538C: GetDlgItemTextA.USER32(?,?,00000400,00404481), ref: 0040539F

Part of subcall function 00405DE2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E3A
Part of subcall function 00405DE2: CharNextA.USER32(?,?,?,00000000), ref: 00405E47
Part of subcall function 00405DE2: CharNextA.USER32(?,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E4C
Part of subcall function 00405DE2: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E5C

GetDiskFreeSpaceA.KERNEL32(0079DCC8,?,?,0000040F,?,0079DCC8,0079DCC8,?,00000000,0079DCC8,?,?,000003FB,?), ref: 00404505
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404520
SetDlgItemTextA.USER32(00000000,00000400,0079DCB8), ref: 004045A6

Strings

A, xrefs: 004043E8

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: a68b45dffeb6f84f52b39daaa5d793e6caad4b47951e738af54e6220d2aef0ae
Instruction ID: 03cdc0df629eda19bc81850558ffdd0616f3ff49271ebeceec1b5cb03d6b2ac4
Opcode Fuzzy Hash: a68b45dffeb6f84f52b39daaa5d793e6caad4b47951e738af54e6220d2aef0ae
Instruction Fuzzy Hash: DB9192B1900208BBDB11AFA1CC81AAF77B8EF85305F14447BFB01B62D1D77C9A418B69

Function 00405B99 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0079E4D8,00000000,00404EBC,0079E4D8,00000000), ref: 00405C4A
GetSystemDirectoryA.KERNEL32(007A16A0,00000400), ref: 00405CC5
GetWindowsDirectoryA.KERNEL32(007A16A0,00000400), ref: 00405CD8
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405D14
SHGetPathFromIDListA.SHELL32(?,007A16A0), ref: 00405D22
CoTaskMemFree.OLE32(?), ref: 00405D2D
lstrcatA.KERNEL32(007A16A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D4F
lstrlenA.KERNEL32(007A16A0,?,0079E4D8,00000000,00404EBC,0079E4D8,00000000), ref: 00405DA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C94
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D49

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: eaa8d679cdde7ec1b846b7d20550e8a9090a2d3d3f7a51f3022e8c133c3e6eb0
Instruction ID: 050506686e60d08a76f5c318217997e75ce046d50ca6fca7f220fc6f31a13d77
Opcode Fuzzy Hash: eaa8d679cdde7ec1b846b7d20550e8a9090a2d3d3f7a51f3022e8c133c3e6eb0
Instruction Fuzzy Hash: 5E61F471A04A05AAEF115F24CC88BBF3BA9EF52314F14813BE941BA2D1D27C5981DF5E

Function 00405454 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 0040547D
lstrcatA.KERNEL32(0079FD00,\*.*,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 004054C5
lstrcatA.KERNEL32(?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 004054E6
lstrlenA.KERNEL32(?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 004054EC
FindFirstFileA.KERNEL32(0079FD00,?,?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 004054FD
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004055AA
FindClose.KERNEL32(00000000), ref: 004055BB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405462
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00405454
\*.*, xrefs: 004054BF

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-425970362
Opcode ID: 882c0e5d12b924f8698f38e7a6dc77829c612616eb812936588a6f232fd63121
Instruction ID: 6c887a6cd9596c43cc691a5f5e4ea67afdeb508a4c755cd09b57e0a75bcacbf5
Opcode Fuzzy Hash: 882c0e5d12b924f8698f38e7a6dc77829c612616eb812936588a6f232fd63121
Instruction Fuzzy Hash: 6F51C030800A04BACB21AB21CC45BBF7AB9DF42318F54817BF455B11D2D73C9A82DEAD

Function 00402036 Relevance: 3.1, APIs: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409398,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: e012038d3e8a169ff903bf719303fb9d47d5aed85b4ede8371c8d23c588ac1eb
Instruction ID: b07af7920b8309ffd935e8952b71055f016d565fd75ec3e93ef818f940943bf4
Opcode Fuzzy Hash: e012038d3e8a169ff903bf719303fb9d47d5aed85b4ede8371c8d23c588ac1eb
Instruction Fuzzy Hash: 91415F75A00205AFCB00DFA4CD88EAE7BB5EF49314F204169F905EB2D1CA79AD41CB55

Function 00405E7B Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,007A0548,007A0100,00405755,007A0100,007A0100,00000000,007A0100,007A0100,?,?,75923410,00405474,?,C:\Users\user\AppData\Local\Temp\,75923410), ref: 00405E86
FindClose.KERNEL32(00000000), ref: 00405E92

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction ID: e3a419463b19944544fc21c9ad6669fb55d517ae4bfd2eba5619c06405e9773a
Opcode Fuzzy Hash: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction Fuzzy Hash: 6AD012319195205BC3406738AC0C89F7B69DB563317304B32B5BDF12E0C2389D628AE9

Function 0040264F Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040265E

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 8e05c904b43dae5a009f96364440cc8acb8de351f29cb0f39e35ebea2b885a46
Instruction ID: 3ab4b2e523f4ece34398282fff8650a64823828ee778d7c177d23f294cc8494d
Opcode Fuzzy Hash: 8e05c904b43dae5a009f96364440cc8acb8de351f29cb0f39e35ebea2b885a46
Instruction Fuzzy Hash: FAF0A032A041149AD700E7B4A949AEEB778CB15324F20067BE101E20C2C6B869859A2E

Function 004039B4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039F0
ShowWindow.USER32(?), ref: 00403A0D
DestroyWindow.USER32 ref: 00403A21
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A3D
GetDlgItem.USER32(?,?), ref: 00403A5E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A72
IsWindowEnabled.USER32(00000000), ref: 00403A79
GetDlgItem.USER32(?,00000001), ref: 00403B27
GetDlgItem.USER32(?,00000002), ref: 00403B31
SetClassLongA.USER32(?,000000F2,?), ref: 00403B4B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B9C
GetDlgItem.USER32(?,00000003), ref: 00403C42
ShowWindow.USER32(00000000,?), ref: 00403C63
EnableWindow.USER32(?,?), ref: 00403C75
EnableWindow.USER32(?,?), ref: 00403C90
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CA6
EnableMenuItem.USER32(00000000), ref: 00403CAD
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403CC5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CD8
lstrlenA.KERNEL32(0079ECF8,?,0079ECF8,007A1F00), ref: 00403D01
SetWindowTextA.USER32(?,0079ECF8), ref: 00403D10
ShowWindow.USER32(?,0000000A), ref: 00403E44

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: d971db1fb676f9121a2777190888625fc0312326e765dd8249487f5c43209863
Instruction ID: 08d6703954b26bba67f61acca2d9aa754b0d4f7535d1ee947126766f28ce6238
Opcode Fuzzy Hash: d971db1fb676f9121a2777190888625fc0312326e765dd8249487f5c43209863
Instruction Fuzzy Hash: 42C1C231904200ABEB21AF25ED45E2B7EACF745706F04453EFA41B11E1C77DA982DB6E

Function 00403622 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi56C.tmp,0079ECF8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079ECF8,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75923410,"C:\Users\user\Desktop\4NsDuAp8TA.exe",00000000), ref: 0040369D
lstrlenA.KERNEL32(007A16A0,?,?,?,007A16A0,00000000,007A8400,C:\Users\user\AppData\Local\Temp\nsi56C.tmp,0079ECF8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079ECF8,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403712
lstrcmpiA.KERNEL32(?,.exe), ref: 00403725
GetFileAttributesA.KERNEL32(007A16A0), ref: 00403730
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,007A8400), ref: 00403779

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

RegisterClassA.USER32(007A1EA0), ref: 004037B6
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004037CE
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403803
ShowWindow.USER32(00000005,00000000), ref: 00403839
LoadLibraryA.KERNEL32(RichEd20), ref: 0040384A
LoadLibraryA.KERNEL32(RichEd32), ref: 00403855
GetClassInfoA.USER32(00000000,RichEdit20A,007A1EA0), ref: 00403865
GetClassInfoA.USER32(00000000,RichEdit,007A1EA0), ref: 00403872
RegisterClassA.USER32(007A1EA0), ref: 0040387B
DialogBoxParamA.USER32(?,00000000,004039B4,00000000), ref: 0040389A

Strings

RichEd20, xrefs: 00403845
RichEdit, xrefs: 0040386C
.exe, xrefs: 0040371F
RichEdit20A, xrefs: 0040385D, 00403863
.DEFAULT\Control Panel\International, xrefs: 00403688
_Nb, xrefs: 00403795, 004037FD
C:\Users\user\AppData\Local\Temp\, xrefs: 0040362E
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00403626
RichEd32, xrefs: 00403850
Control Panel\Desktop\ResourceLocale, xrefs: 00403656
C:\Users\user\AppData\Local\Temp\nsi56C.tmp, xrefs: 00403642, 00403698

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$.DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi56C.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-694510882
Opcode ID: fcf350a16533a8f7f48c774a1ae8809bdd7b9640d83f0523be5dbe97f1948a0b
Instruction ID: b0afc0e10dc8cbe2448bed9474bc03f366f348945261fe302a10aac9679cd79a
Opcode Fuzzy Hash: fcf350a16533a8f7f48c774a1ae8809bdd7b9640d83f0523be5dbe97f1948a0b
Instruction Fuzzy Hash: FA61E6716442007EE710BB659C85F373AACEB8275AF00857EFA45B22E2D67D6D01CB2D

Function 00403FD0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040405B
GetDlgItem.USER32(00000000,000003E8), ref: 0040406F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040408D
GetSysColor.USER32(?), ref: 0040409E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004040AD
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004040BC
lstrlenA.KERNEL32(?), ref: 004040BF
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040CE
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040E3
GetDlgItem.USER32(?,0000040A), ref: 00404145
SendMessageA.USER32(00000000), ref: 00404148
GetDlgItem.USER32(?,000003E8), ref: 00404173
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004041B3
LoadCursorA.USER32(00000000,00007F02), ref: 004041C2
SetCursor.USER32(00000000), ref: 004041CB
ShellExecuteA.SHELL32(0000070B,open,007A16A0,00000000,00000000,00000001), ref: 004041DE
LoadCursorA.USER32(00000000,00007F00), ref: 004041EB
SetCursor.USER32(00000000), ref: 004041EE
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040421A
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040422E

Strings

N, xrefs: 00404161
open, xrefs: 004041D6

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction ID: 031dbeac94855a04ab7bc056baf49b9f62a127ba2e136bb98bc4968a945489ce
Opcode Fuzzy Hash: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction Fuzzy Hash: DF61B971A40209BFEB109F60CC45F6A3B69FB84755F10816AFB047B2D1C7B8A951CF99

Function 0040589D Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(007A0A88,NUL,?,00000000,?,00000000,?,00405A53,?,?,00000001,00405613,?,00000000,000000F1,?), ref: 004058AD
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405A53,?,?,00000001,00405613,?,00000000,000000F1,?), ref: 004058D1
GetShortPathNameA.KERNEL32(00000000,007A0A88,00000400), ref: 004058DA

Part of subcall function 0040578A: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
Part of subcall function 0040578A: lstrlenA.KERNEL32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

GetShortPathNameA.KERNEL32(?,007A0E88,00000400), ref: 004058F7
wsprintfA.USER32 ref: 00405915
GetFileSize.KERNEL32(00000000,00000000,007A0E88,C0000000,00000004,007A0E88,?,?,?,?,?), ref: 00405950
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 0040595F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405979
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004059A9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,007A0688,00000000,-0000000A,0040936C,00000000,[Rename]), ref: 004059FF
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00405A11
GlobalFree.KERNEL32(00000000), ref: 00405A18
CloseHandle.KERNEL32(00000000), ref: 00405A1F

Part of subcall function 00405825: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 00405829
Part of subcall function 00405825: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

Strings

%s=%s, xrefs: 0040590B
NUL, xrefs: 004058A7
[Rename], xrefs: 00405991, 004059A3

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 3756836283-4148678300
Opcode ID: 3dc5f7bb7184485a7b87fb4c129ebc8997b7fd1a3a4ee1b2d00c5489aec53c8d
Instruction ID: 703081f9f45e0959c07b6a00457515c8324f77790511a56e8ac0345a7c84fdf8
Opcode Fuzzy Hash: 3dc5f7bb7184485a7b87fb4c129ebc8997b7fd1a3a4ee1b2d00c5489aec53c8d
Instruction Fuzzy Hash: 91412B71B04705AFD2206B249C49F6B7B6CEF89754F14053AFD01F62D2D678A8008EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,007A1F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction ID: dd0e79dd03d73333c37d03741989dce367d08c72bd534bd23d7a1991bc4c48e1
Opcode Fuzzy Hash: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction Fuzzy Hash: E5419A71804249AFCB058F95CD459BFBFB9FF45310F00812AF962AA1A0C738EA51DFA5

Function 00402E6C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402ECE
GetTickCount.KERNEL32 ref: 00402F55
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F82
wsprintfA.USER32 ref: 00402F92
WriteFile.KERNEL32(00000000,00000000,?,7FFFFFFF,00000000), ref: 00402FC0

Strings

... %d%%, xrefs: 00402F8C

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 596e255581a170ddd44a042c57955e67d10ae647dc5c05ba9c0314ae55046869
Instruction ID: abbc5e543d40cc295139a54e2e8a13b251616715b744bb5f177e15d4b263a606
Opcode Fuzzy Hash: 596e255581a170ddd44a042c57955e67d10ae647dc5c05ba9c0314ae55046869
Instruction Fuzzy Hash: B1519C7190121AABCF10DF69DA48A9E7BB8BF04355F14413BF901B72C4D3789E50DBAA

Function 00405DE2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E3A
CharNextA.USER32(?,?,?,00000000), ref: 00405E47
CharNextA.USER32(?,"C:\Users\user\Desktop\4NsDuAp8TA.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E4C
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405E5C

Strings

*?|<>/":, xrefs: 00405E2A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE3, 00405DE8
"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 00405E1E

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1833393900
Opcode ID: 2024885374f02dac88d9fb103eccae40028a2ab1d30660e2dcec4d8ea4488381
Instruction ID: 982ed4f0ea0d1ffb3a75412ce8e95c0ea6245537b44222f6b90d7ae264b7a878
Opcode Fuzzy Hash: 2024885374f02dac88d9fb103eccae40028a2ab1d30660e2dcec4d8ea4488381
Instruction Fuzzy Hash: 7511B671804B9129EB3217248C44B776F98CB9A7A0F18047BE5C5723C2C67C5E828EED

Function 00403EEE Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F0B
GetSysColor.USER32(00000000), ref: 00403F27
SetTextColor.GDI32(?,00000000), ref: 00403F33
SetBkMode.GDI32(?,?), ref: 00403F3F
GetSysColor.USER32(?), ref: 00403F52
SetBkColor.GDI32(?,?), ref: 00403F62
DeleteObject.GDI32(?), ref: 00403F7C
CreateBrushIndirect.GDI32(?), ref: 00403F86

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 43f1f9eadd2e023582460ec461a07703dc87d5103ca70cdaf59bc9c3c4c10c95
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: B1219971904705AFC7219F68DD08B5BBFF8AF01715F04852AF995E22D1C378E944CB55

Function 0040268D Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026E1
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026FD
GlobalFree.KERNEL32(?), ref: 00402736
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402748
GlobalFree.KERNEL32(00000000), ref: 0040274F
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402767
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040277B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 9965696cac2c5dcee919c64b3846389293bd495e345133515c16cb9a9d46e221
Instruction ID: 94283e328d35fee59e2da4f8035aa06736476ebf885dd15e4876c46effbb42d0
Opcode Fuzzy Hash: 9965696cac2c5dcee919c64b3846389293bd495e345133515c16cb9a9d46e221
Instruction Fuzzy Hash: E4319171C00128BBCF216FA5DD89DAE7E79EF05364F20423AF520762E1C7791D408BA9

Function 00404E84 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FA6,0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
lstrcatA.KERNEL32(0079E4D8,00402FA6,00402FA6,0079E4D8,00000000,?,007898A8), ref: 00404EE0
SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 6d23eeeeadc8c975830744756af2e0c6f2d7ce04b7bca1b24e7dcfc844a15c14
Instruction ID: 0879e44440130bf100c4abc817e106b172b9c081b4a19821dc72f8a86b472426
Opcode Fuzzy Hash: 6d23eeeeadc8c975830744756af2e0c6f2d7ce04b7bca1b24e7dcfc844a15c14
Instruction Fuzzy Hash: E3216071900118BFDB019FA5CD849DEBFB9EB45354F14807AF904B6291C6785E40CBA4

Function 0040474F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476A
GetMessagePos.USER32 ref: 00404772
ScreenToClient.USER32(?,?), ref: 0040478C
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040479E
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C4

Strings

f, xrefs: 004047A0

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 6bd71cb3d479751b3b69d93d67c88433f783f46e4abb255f82c81c082e4bdd88
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: C5014075D00218BADB01DBA4DC45FFEBBBCAB55711F10412BBB10B71C0C7B865018BA5

Function 00402B4C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B67
MulDiv.KERNEL32(?,00000064,?), ref: 00402B92
wsprintfA.USER32 ref: 00402BA2
SetWindowTextA.USER32(?,?), ref: 00402BB2
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC4

Strings

verifying installer: %d%%, xrefs: 00402B9C

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction ID: 338c4dd4cc7a1f9a3f94f7e8e9aba01fa07f8a2d27e46d6da828e47d9d426f75
Opcode Fuzzy Hash: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction Fuzzy Hash: 32014F70540208ABEF249F61DD0AEAE37B9AB00304F00803AFA06A92D1D7B9A9518B59

Function 0040173F Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,00409B98,007A8800,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,00409B98,00409B98,00000000,00000000,00409B98,007A8800,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

Part of subcall function 00404E84: lstrlenA.KERNEL32(0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FA6,0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0079E4D8,00402FA6,00402FA6,0079E4D8,00000000,?,007898A8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 9b098a5e810a5c28b9326644494c538c1da79562833f8fa9deb61f0cdda3993c
Instruction ID: df8d039fdd937f1c478db27dfce12e75bce6feb5164cf919340bcacede668491
Opcode Fuzzy Hash: 9b098a5e810a5c28b9326644494c538c1da79562833f8fa9deb61f0cdda3993c
Instruction Fuzzy Hash: F241B771900615BACB10BBA5CC46DAF7979DF42368F20423BF525F10E2DA3C5A419A6D

Function 00402A47 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A68
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA4
RegCloseKey.ADVAPI32(?), ref: 00402AAD
RegCloseKey.ADVAPI32(?), ref: 00402AD2
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF0

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 61aa7b08b25d36179ae4cb5662e9664e60734cdc6a87b09974626dd03ae36e85
Instruction ID: 1ad4598d9375e79b5c4158f8ae6fede31b6a0d7771ae0489b8e1e2a10aea7df0
Opcode Fuzzy Hash: 61aa7b08b25d36179ae4cb5662e9664e60734cdc6a87b09974626dd03ae36e85
Instruction Fuzzy Hash: 72116D31600108BFDF219F90DE48DAA3B6DEB55348B108036FA06A00A0D7B89E519F69

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b0c852230168c282e54fa96b58fa246ff6a884e323492708f62686b2ee3a6f71
Instruction ID: 7c3280a60d84a3596340f685d6ada4bc9ba3972ea03b1155ec5ca5a37b5200ea
Opcode Fuzzy Hash: b0c852230168c282e54fa96b58fa246ff6a884e323492708f62686b2ee3a6f71
Instruction Fuzzy Hash: 01F04FB2905104AFD701EBA4EE88CAFB7BCEB44301B004476F601F2091C638AD018B79

Function 00401D26 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040AFA0), ref: 00401DA1

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d50846cf01dc4d21c027121a250a91c6e779b9c02126d39bd440f749e4007b39
Instruction ID: 4f22f7d967d41569425e1cc72a43e48c322de2a0bc5ea7779ffcdbaac11077e3
Opcode Fuzzy Hash: d50846cf01dc4d21c027121a250a91c6e779b9c02126d39bd440f749e4007b39
Instruction Fuzzy Hash: 760162B1958341AFE7015BB0AE1ABAF7F74A725705F100439F145BA2E2C67C14158B2B

Function 0040466D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079ECF8,0079ECF8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040458D,000000DF,0000040F,00000400,00000000), ref: 004046FB
wsprintfA.USER32 ref: 00404703
SetDlgItemTextA.USER32(?,0079ECF8), ref: 00404716

Strings

%u.%u%s%s, xrefs: 004046E5

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: de6b24ac2de06aa5a6c00b34d189335991a4621482d9b42b83f82e23e4af78ce
Instruction ID: 808364b1aeea65b13bf83ed040d55ad759ad6ec36480b824a7a4bb04bc91d3c3
Opcode Fuzzy Hash: de6b24ac2de06aa5a6c00b34d189335991a4621482d9b42b83f82e23e4af78ce
Instruction Fuzzy Hash: 8B1108736002243BDB0065699C06EEF329DDBC3375F14023BFA29F61D1E9799C5182E9

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 8eff71bb5ebd36046c366c13d8ffe373437556df99635d979973e320c5583c2f
Instruction ID: 12ae1f52ecf524c97be6b8063d2fdb139482407b097923a357ceac7fbdf5fe65
Opcode Fuzzy Hash: 8eff71bb5ebd36046c366c13d8ffe373437556df99635d979973e320c5583c2f
Instruction Fuzzy Hash: 43219271A44248AFEF01AFB4CD8AAAE7FB5EF44348F14443EF501B61E1D6B95940DB18

Function 00405624 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 0040562A
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923410,0040329C), ref: 00405633
lstrcatA.KERNEL32(?,00409014), ref: 00405644

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405624

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction ID: 00b6ae861ddc274f1a22631493032202eb54a79e67bc778d52c9d7871f0e19dd
Opcode Fuzzy Hash: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction Fuzzy Hash: C8D0A962A099302ED20226158C05EDB3A98CF02315B040873F200B22E2C67C2D418BFE

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 00404E84: lstrlenA.KERNEL32(0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FA6,0079E4D8,00000000,?,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0079E4D8,00402FA6,00402FA6,0079E4D8,00000000,?,007898A8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 2a470f3a265e4707170224a08b78964a62a1333b3cd2c4511b05f9becfff01cd
Instruction ID: d3abe0a985e527f0133db3cb222e4045a6b822903cb71d54981d30858ec5e20d
Opcode Fuzzy Hash: 2a470f3a265e4707170224a08b78964a62a1333b3cd2c4511b05f9becfff01cd
Instruction Fuzzy Hash: 01213032904211ABCF207F64CE49A6F79B0AF44358F20413BF601B62D1D7BD4E419A5E

Function 0040231A Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402358
lstrlenA.KERNEL32(0040A398,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402378
RegSetValueExA.ADVAPI32(?,?,?,?,0040A398,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B1
RegCloseKey.ADVAPI32(?,?,?,0040A398,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 5e693f3d9e7b741cdf9ea44cab5545e1dd95195cd1b4dfe7724add09a22c1e66
Instruction ID: 496afd6724d83472fd7aeeeeb6c9636b40b67d15b6efd44fac0fbba193c6cb19
Opcode Fuzzy Hash: 5e693f3d9e7b741cdf9ea44cab5545e1dd95195cd1b4dfe7724add09a22c1e66
Instruction Fuzzy Hash: 40116071E00208BEEB10EFB5CE89EAF7A78EB44358F10403AF905B61D1D6B85D419A69

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 004056BD: CharNextA.USER32(?,?,007A0100,?,00405729,007A0100,007A0100,?,?,75923410,00405474,?,C:\Users\user\AppData\Local\Temp\,75923410,00000000), ref: 004056CB
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056D0
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056E4

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,007A8800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: e118064044a600f7a7b96e15b728bb44457af851d1526a60e40b802bef7a032a
Instruction ID: be2e729169105f21f0136a8afe605fb55404e4043758c9297c14daf22ca337c6
Opcode Fuzzy Hash: e118064044a600f7a7b96e15b728bb44457af851d1526a60e40b802bef7a032a
Instruction Fuzzy Hash: A7114831908150ABDB213F755D04EBF77B4EE56366724073FF492B22E2C63C09429A2E

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 8dfb373d46bd70ea73ae3966ad25f80cbb65e2499764b4783afd86685f1e7734
Instruction ID: d9cf4706ccd720fe68a9057b37b388a6d3cc99dc36037c8cf20abe177969b22e
Opcode Fuzzy Hash: 8dfb373d46bd70ea73ae3966ad25f80cbb65e2499764b4783afd86685f1e7734
Instruction Fuzzy Hash: 02117071900108BEDB01EFA5DD81DAEBBB9EF04344B20807AF505F61E2D7789E54DB28

Function 00402BCF Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DAF,00000001), ref: 00402BE2
GetTickCount.KERNEL32 ref: 00402C00
CreateDialogParamA.USER32(0000006F,00000000,00402B4C,00000000), ref: 00402C1D
ShowWindow.USER32(00000000,00000005), ref: 00402C2B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction ID: d1c4e1838bfb856cd6d3ea9dd85ee240d54de3540c59ddf7a57925f8cf4fbe18
Opcode Fuzzy Hash: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction Fuzzy Hash: 52F0D030909620BFC6616F18BD4CE5F7BA4E745B117518467F204A11A5D27CA8838FAD

Function 004038E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,007A1F00), ref: 0040397F

Strings

"C:\Users\user\Desktop\4NsDuAp8TA.exe", xrefs: 004038E8
C:\Users\user\AppData\Local\Temp\nsi56C.tmp, xrefs: 004038EB, 004038F5, 00403966

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\4NsDuAp8TA.exe"$C:\Users\user\AppData\Local\Temp\nsi56C.tmp
API String ID: 530164218-3123412644
Opcode ID: 25d9b52c00bc6c780318a8bb18bdb4372ba541c453f9d771c50e3bd4cd5310d4
Instruction ID: 3eeb35b712935f7be9db67fea1ba5421606f6b55dcd8c4013f5d2095cba695b6
Opcode Fuzzy Hash: 25d9b52c00bc6c780318a8bb18bdb4372ba541c453f9d771c50e3bd4cd5310d4
Instruction Fuzzy Hash: 121108B1B046009BC721AF19CC809333BADEBC6756318823FED01673A1D77D9D028B68

Function 00404DF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E27
CallWindowProcA.USER32(?,?,?,?), ref: 00404E78

Part of subcall function 00403ED3: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403EE5

Strings

, xrefs: 00404E08

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 526848415f932e083bf7b3d36508f4b1bda904cbcea418d5975b356f5bc0ad6e
Instruction ID: 7d65f4a0b806027d78491f0c636345f1b5379c259f2f3d92d144b4497ee353ee
Opcode Fuzzy Hash: 526848415f932e083bf7b3d36508f4b1bda904cbcea418d5975b356f5bc0ad6e
Instruction Fuzzy Hash: 600184B1500208ABDF219F21ED80EAB3726F7C5755F204137FB04761D1C7799C5196AA

Function 00405347 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,007A0500,Error launching installer), ref: 0040536C
CloseHandle.KERNEL32(?), ref: 00405379

Strings

Error launching installer, xrefs: 0040535A

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction ID: f3300c01cb1876a67fd1897e7389f13c8369481b1b26804573fe4f9c45dca3ad
Opcode Fuzzy Hash: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction Fuzzy Hash: 22E0ECB4900209AFDB009F64DC09E6F7BBCFB00344F40CA21BD11E2150F778E9108AA9

Function 0040358D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75923410,00403565,004033A9,?), ref: 004035A7
GlobalFree.KERNEL32(?), ref: 004035AE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040359F

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction ID: 25ceb6f6e8048fd8c7c72bafa6746df7c9a9eea5615397dbd2628d9726c916a8
Opcode Fuzzy Hash: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction Fuzzy Hash: 6EE08C32805020ABC6215F14AD0471AB6686B89B22F01406BE9407B2A087B8AD428BD8

Function 0040566B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4NsDuAp8TA.exe,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 00405671
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\4NsDuAp8TA.exe,C:\Users\user\Desktop\4NsDuAp8TA.exe,80000000,00000003), ref: 0040567F

Strings

C:\Users\user\Desktop, xrefs: 0040566B

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction ID: 066a61083934c2e15797617eaf2660ffc2c94803564b26df0c9315ada1aa8723
Opcode Fuzzy Hash: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction Fuzzy Hash: 38D0A762409D702EF30352108C04BEF6A88CF12300F0904A2E440E21D0C2781C418BED

Function 0040578A Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
lstrcmpiA.KERNEL32(?,?), ref: 004057B2
CharNextA.USER32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057C3
lstrlenA.KERNEL32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

Memory Dump Source

Source File: 00000000.00000002.2044721183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2044704620.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044734705.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.0000000000795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044748829.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2044899114.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4NsDuAp8TA.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction ID: df48b93824ef6af08d299fa443af8079e3e9d2208639ace1cb57769ac35cd01d
Opcode Fuzzy Hash: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction Fuzzy Hash: DBF0C235504518FFC7029BA5DC4099FBBB8EF45350F2540AAF800F7210D274EE01ABA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4NsDuAp8TA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 4NsDuAp8TA.exePID: 1124, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: 4NsDuAp8TA.exePID: 1124, Parent PID: 1028COMMON

Execution Graph

Graph

Windows Analysis Report
4NsDuAp8TA.exe

Function 004030EF Relevance: 72.1, APIs: 27, Strings: 14, Instructions: 324
stringfilecomCOMMON

Function 00405EA2 Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00402C33 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00405854 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 004030BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 00405825 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00403072 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 004053A8 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Function 00403548 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 00404FC2 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 279
windowclipboardmemoryCOMMON

Function 00404801 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 004039B4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00403622 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 216
stringregistrylibraryCOMMON

Function 00403FD0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205
windowstringCOMMON

Function 0040589D Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141
filestringmemoryCOMMON