Edit tour

Windows Analysis Report
ws_ftp le 508.exe

Overview

General Information

Sample name:	ws_ftp le 508.exe
Analysis ID:	1438423
MD5:	64a58dd55cc3af76fea415ebdbec7af9
SHA1:	3ca099902c524527fecfb7f5e2bbc5d0e7c4a76b
SHA256:	9d23f416f03f351c8441fbe390893cacf00c3ec09beb7a8947023847d2428d2b
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Found evasive API chain (date check)

PE file contains executable resources (Code or Archives)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

ws_ftp le 508.exe (PID: 6704 cmdline: "C:\Users\user\Desktop\ws_ftp le 508.exe" MD5: 64A58DD55CC3AF76FEA415EBDBEC7AF9)

SFS5D46.tmp (PID: 6196 cmdline: "C:\Users\user\Desktop\SFS5D46.tmp" MD5: EC184194C54DBAB8D0D84CEF50C3189A)

SFS5D75.tmp (PID: 4600 cmdline: "C:\Users\user\Desktop\SFS5D75.tmp" MD5: 6993AF44351EE82C42D77CCF5D550A29)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\SFS5D46.tmp

ReversingLabs: Detection: 22%

Multi AV Scanner detection for submitted file

Source: ws_ftp le 508.exe

ReversingLabs: Detection: 22%

Source: ws_ftp le 508.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

Code function: 0_2_004012CE sprintf,FindFirstFileA,

0_2_004012CE

Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: HTTP://www.ipswitch.com
Source: SFS5D46.tmp.0.dr	String found in binary or memory: http://www.ipswitch.com
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: http://www.ipswitch.com/downloads/ws_ftp_PRO.html
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: http://www.ipswitch.com/products/ws_ftp/
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: http://www.ipswitch.com/products/ws_ftp/DLG_NOT_AUTHRemoveDIRWS_FTPINSTOPTSWS_FTPWS_FTP.exe%s
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: http://www.ipswitch.comopenHTTP://www.ipswitch.comWS_FTPhttp://www.ipswitch.com/downloads/ws_ftp_PRO
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	String found in binary or memory: https://buy.ipswitch.com/cgi-ole/buypro.showform/wsftppro/?000001767Ipswitch

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_00406259 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

2_2_00406259

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_0040AA00

2_2_0040AA00

Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 4039 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 368128 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 428032 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 246726 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 2455 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 102912 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 6699 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 12118 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 14354 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: EXE type: MS Compress archive data, SZDD variant, original size: 10008 bytes
Source: SFS5D75.tmp.1.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: ws_ftp le 508.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@5/2@0/0

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_00406259 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

2_2_00406259

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_004086E4 StretchDIBits,GlobalUnlock,FreeResource,ReleaseDC,ValidateRect,

2_2_004086E4

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

File created: C:\Users\user\Desktop\SFS5D46.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SFS5D75.tmp

File created: C:\Users\user\AppData\Local\Temp\WFT5DD2.tmp

Jump to behavior

Source: ws_ftp le 508.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SFS5D75.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ws_ftp le 508.exe

ReversingLabs: Detection: 22%

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

File read: C:\Users\user\Desktop\ws_ftp le 508.exe

Jump to behavior

Source: C:\Users\user\Desktop\SFS5D75.tmp

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_2-4345

Source: unknown	Process created: C:\Users\user\Desktop\ws_ftp le 508.exe "C:\Users\user\Desktop\ws_ftp le 508.exe"
Source: C:\Users\user\Desktop\ws_ftp le 508.exe	Process created: C:\Users\user\Desktop\SFS5D46.tmp "C:\Users\user\Desktop\SFS5D46.tmp"
Source: C:\Users\user\Desktop\SFS5D46.tmp	Process created: C:\Users\user\Desktop\SFS5D75.tmp "C:\Users\user\Desktop\SFS5D75.tmp"
Source: C:\Users\user\Desktop\ws_ftp le 508.exe	Process created: C:\Users\user\Desktop\SFS5D46.tmp "C:\Users\user\Desktop\SFS5D46.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D46.tmp	Process created: C:\Users\user\Desktop\SFS5D75.tmp "C:\Users\user\Desktop\SFS5D75.tmp"	Jump to behavior

Source: C:\Users\user\Desktop\ws_ftp le 508.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ws_ftp le 508.exe	Section loaded: fddint.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D46.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D46.tmp	Section loaded: fddint.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: lz32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SFS5D75.tmp	Section loaded: textshaping.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SFS5D75.tmp

Window detected: Number of UI elements: 11

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

Code function: 0_2_004014D6 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcessId,FreeLibrary,GetModuleFileNameA,_getcwd,_chdir,_chdir,strcat,LoadLibraryA,GetProcAddress,remove,FreeLibrary,_chdir,memset,GetVersion,strlen,strlen,MoveFileA,strcpy,??2@YAPAXI@Z,strcpy,strcat,strcat,CreateProcessA,??3@YAXPAX@Z,CreateProcessA,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,remove,

0_2_004014D6

Source: C:\Users\user\Desktop\ws_ftp le 508.exe	Code function: 0_2_00401800 push eax; ret		0_2_0040182E
Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004092D0 push eax; ret		2_2_004092FE

Source: C:\Users\user\Desktop\ws_ftp le 508.exe	File created: C:\Users\user\Desktop\SFS5D46.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\SFS5D46.tmp	File created: C:\Users\user\Desktop\SFS5D75.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_0040481A MessageBoxA,GetVersionExA,GetSystemDirectoryA,wsprintfA,GetSystemDirectoryA,wsprintfA,GetSystemDirectoryA,wsprintfA,GetSystemDirectoryA,wsprintfA,GetProfileStringA,lstrlenA,MessageBoxA,MessageBoxA,MessageBoxA,GetProfileStringA,MessageBoxA,GetProfileIntA,wsprintfA,lstrlenA,wsprintfA,lstrlenA,wsprintfA,lstrlenA,CreateDialogParamA,GetDlgItem,GetDlgItem,lstrcpyA,GetDlgItem,GetDlgItem,GetDlgItem,wsprintfA,wsprintfA,wsprintfA,MessageBoxA,GetDlgItem,GetDlgItem,wsprintfA,GetPrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,GetDlgItem,SetWindowTextA,SetActiveWindow,DestroyWindow,GetProfileStringA,wsprintfA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,wsprintfA,wsprintfA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,wsprintfA,wsprintfA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,wsprintfA,lstrcpyA,wsprintfA,MessageBoxA,wsprintfA,WritePrivateProfileStringA,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,wsprintfA,WriteProfileStringA,MessageBoxA,

2_2_0040481A

Source: C:\Users\user\Desktop\SFS5D75.tmp

Evasive API call chain: GetSystemTime,DecisionNodes

graph_2-5075

Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004098C0 GetSystemTime followed by cmp: cmp word ptr [00412c9ah], cx and CTI: jne 0040992Bh	2_2_004098C0
Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004098C0 GetSystemTime followed by cmp: cmp word ptr [00412c98h], ax and CTI: jne 0040992Bh	2_2_004098C0
Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004098C0 GetSystemTime followed by cmp: cmp word ptr [00412c96h], ax and CTI: jne 0040992Bh	2_2_004098C0
Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004098C0 GetSystemTime followed by cmp: cmp word ptr [00412c92h], ax and CTI: jne 0040992Bh	2_2_004098C0
Source: C:\Users\user\Desktop\SFS5D75.tmp	Code function: 2_2_004098C0 GetSystemTime followed by cmp: cmp word ptr [00412c90h], ax and CTI: jne 0040992Bh	2_2_004098C0

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

Code function: 0_2_004012CE sprintf,FindFirstFileA,

0_2_004012CE

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

0_2_004014D6

Source: SFS5D75.tmp, 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	Binary or memory string: 5Program Manager Group
Source: SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp	Binary or memory string: WFT\OSNTWSInstalAPP_MAINWS_FTP Limited Edition Install (32)IPSWITCHWS_FTP LE HelpWS_FTP LE Release NotesUninstall WS_FTP LEWS_FTP Icon PlacementWS_FTP Explorer HelpWS_BMP%s (.)\|.\|WS_FTP95.exeDLG_GETSRCDIRDLG_BROWSEaws_ftp\WS_FTPDLG_GETDIRPROGMAN/\\[DeleteItem("%s")]/\\[DeleteItem("%s")][AddItem("%s","%s",,,,,%s)]WS_FTP[DeleteGroup(%s)][CreateGroup(%s)]PROGMANGroups
Source: SFS5D75.tmp, 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	Binary or memory string: Please enter the name of the Program Manager group for this software:
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	Binary or memory string: Ipswitch0Software\Microsoft\Windows\CurrentVersionRunOnceRunServicesOnceRunOnceRunServicesOnce%uSeShutdownPrivilegeWFT\OSNTWSInstalAPP_MAINWS_FTP Limited Edition Install (32)IPSWITCHWS_FTP LE HelpWS_FTP LE Release NotesUninstall WS_FTP LEWS_FTP Icon PlacementWS_FTP Explorer HelpWS_BMP%s (.)\|.\|WS_FTP95.exeDLG_GETSRCDIRDLG_BROWSEaws_ftp\WS_FTPDLG_GETDIRPROGMAN/\\[DeleteItem("%s")]/\\[DeleteItem("%s")][AddItem("%s","%s",,,,,%s)]WS_FTP[DeleteGroup(%s)][CreateGroup(%s)]PROGMANGroups
Source: SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp	Binary or memory string: PROGMAN

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_004098C0 GetLocalTime,GetSystemTime,GetTimeZoneInformation,

2_2_004098C0

Source: C:\Users\user\Desktop\SFS5D75.tmp

Code function: 2_2_004098C0 GetLocalTime,GetSystemTime,GetTimeZoneInformation,

2_2_004098C0

Source: C:\Users\user\Desktop\ws_ftp le 508.exe

0_2_004014D6

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	2 Process Injection	1 Access Token Manipulation	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ws_ftp le 508.exe	22%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\SFS5D46.tmp	22%	ReversingLabs
C:\Users\user\Desktop\SFS5D75.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.ipswitch.comopenHTTP://www.ipswitch.comWS_FTPhttp://www.ipswitch.com/downloads/ws_ftp_PRO	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ipswitch.com	SFS5D46.tmp.0.dr	false		high
https://buy.ipswitch.com/cgi-ole/buypro.showform/wsftppro/?000001767Ipswitch	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false		high
HTTP://www.ipswitch.com	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false		high
http://www.ipswitch.com/downloads/ws_ftp_PRO.html	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false		high
http://www.ipswitch.comopenHTTP://www.ipswitch.comWS_FTPhttp://www.ipswitch.com/downloads/ws_ftp_PRO	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www.ipswitch.com/products/ws_ftp/	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false		high
http://www.ipswitch.com/products/ws_ftp/DLG_NOT_AUTHRemoveDIRWS_FTPINSTOPTSWS_FTPWS_FTP.exe%s	SFS5D46.tmp, 00000001.00000002.1904844086.0000000000770000.00000004.00000020.00020000.00000000.sdmp, SFS5D75.tmp, 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmp, SFS5D75.tmp, 00000002.00000000.1617571641.0000000000410000.00000008.00000001.01000000.00000005.sdmp, ws_ftp le 508.exe, SFS5D75.tmp.1.dr, SFS5D46.tmp.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438423
Start date and time:	2024-05-08 17:52:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ws_ftp le 508.exe
Detection:	MAL
Classification:	mal56.winEXE@5/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: ws_ftp le 508.exe

Process:	C:\Users\user\Desktop\ws_ftp le 508.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.266125935401919
Encrypted:	false
SSDEEP:	12288:dvHjaC8X3QI2u/t4UoaUPGE8cxgorFTtMwHhE9qZfdP1dr0jy5rlunptp4qm:LQA9u/t4ULcxgITK7qFdPbr0O5rlcH4
MD5:	EC184194C54DBAB8D0D84CEF50C3189A
SHA1:	DA7BCDA14A77659042EFFBF909A4ECE23D71A5BE
SHA-256:	E00D900CFE979ABE531F353112372F472F305387F361A87AC0E07C6269B1FC5A
SHA-512:	453D902CCD8068F7CB63F885B54006F1225A9B010E02130703C332C57583665AA1A787A8F0518D21FA1B77FB4B9F3169FE0B8D7182D8EAC78DE1C6157046435A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~S...=...=...=..?7...=.p.3...=..?9...=......=...<...=..?6...=.4.;...=.Rich..=.................PE..L...3..8.....................0......B........ ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata....... ....... ..............@..@.data...@....0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\SFS5D75.tmp

Download File

Process:	C:\Users\user\Desktop\SFS5D46.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707072
Entropy (8bit):	7.361872641098785
Encrypted:	false
SSDEEP:	12288:ovHjaC8X3QI2u/t4UoaUPGE8cxgorFTtMwHhE9qZfdP1dr0jy5rlunptp4qm:aQA9u/t4ULcxgITK7qFdPbr0O5rlcH4
MD5:	6993AF44351EE82C42D77CCF5D550A29
SHA1:	5E14F5084710C1856DE15747F9ABDE647FD81D6A
SHA-256:	88D64F61C68CDB3A3A875A18393B23E32ED6DEEB4C4071CB851B91E9B5B6A661
SHA-512:	2C585AB9D754D2466DD4E7180BF256142B2D6E3A0E4862D985BCAF7443106EA2C8C37290692A94F69D7766DC3D194B3137A02484D70E084250859D4C69986BAB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.8.........................................@.......................... ...............................................P.......p...............................................................................S...............................text............................... ..`.rdata..............................@..@.data....L.......&..................@....idata.......P......................@....rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.171228185522057
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ws_ftp le 508.exe
File size:	748'032 bytes
MD5:	64a58dd55cc3af76fea415ebdbec7af9
SHA1:	3ca099902c524527fecfb7f5e2bbc5d0e7c4a76b
SHA256:	9d23f416f03f351c8441fbe390893cacf00c3ec09beb7a8947023847d2428d2b
SHA512:	5daae789b606ffd6a40a408c969b4184e4eb367c5a779483814c7a112a2ef4a6f929f9448e6c81a7fc0ee577f5f8ffce46536d982709c8ec65a0d82d9724c6de
SSDEEP:	12288:QvHjaC8X3QI2u/t4UoaUPGE8cxgorFTtMwHhE9qZfdP1dr0jy5rlunptp4qm:yQA9u/t4ULcxgITK7qFdPbr0O5rlcH4
TLSH:	B1F4DF11FBFCC290F1B66A319DB186B549377C74FB31D44BA290365E99B3A81C920B27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~S...=...=...=..?7...=.p.3...=..?9...=.......=...<...=..?6...=.4.;...=.Rich..=.................PE..L...3..8...................

File Icon


Icon Hash:	6070db9bd6a79b9b

Static PE Info

General

Entrypoint:	0x401842
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x38F2F833 [Tue Apr 11 10:02:27 2000 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	eb140edabf6cc30fb6de453bcbc882f4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004020F8h
push 004019D0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004020E0h]
pop ecx
or dword ptr [00403134h], FFFFFFFFh
or dword ptr [00403138h], FFFFFFFFh
call dword ptr [004020DCh]
mov ecx, dword ptr [00403130h]
mov dword ptr [eax], ecx
call dword ptr [004020D8h]
mov ecx, dword ptr [0040312Ch]
mov dword ptr [eax], ecx
mov eax, dword ptr [004020D4h]
mov eax, dword ptr [eax]
mov dword ptr [0040313Ch], eax
call 00007F04F942C305h
cmp dword ptr [00403110h], ebx
jne 00007F04F942C1FEh
push 004019BEh
call dword ptr [004020D0h]
pop ecx
call 00007F04F942C2D7h
push 0040300Ch
push 00403008h
call 00007F04F942C2C2h
mov eax, dword ptr [00403128h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00403124h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004020C8h]
push 00403004h
push 00403000h
call 00007F04F942C28Fh

Rich Headers

Programming Language:

[LNK] VC++ 6.0 SP5 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2104	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x3a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xf8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9dc	0x1000	bae576c1f4049f288e2a5f62c89f79c9	False	0.423095703125	data	4.411963957342886	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x5b6	0x1000	503e775b1bc7ce0f249f8c9325ac87d8	False	0.1953125	data	2.283776335987302	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x140	0x1000	c4590b5e069a69502aae18028b3e67a7	False	0.051025390625	Matlab v4 mat-file (little endian) VersionR, numeric, rows 0, columns 0	0.5032120759742087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x3a0	0x1000	8db07c772559061d24c652cf850b4b0d	False	0.080810546875	data	1.062044026204254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x40a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.33064516129032256
RT_GROUP_ICON	0x4388	0x14	data	English	United States	1.2

Imports

DLL	Import
KERNEL32.dll	CreateFileA, MapViewOfFile, CreateFileMappingA, OpenFile, FindFirstFileA, GetTempPathA, GetTempFileNameA, GetCurrentDirectoryA, _lclose, UnmapViewOfFile, MoveFileA, GetVersion, GetModuleFileNameA, FreeLibrary, GetCurrentProcessId, GetProcAddress, LoadLibraryA, WriteFile, CreateProcessA, WaitForSingleObject, GetStartupInfoA, GetModuleHandleA, CloseHandle
ADVAPI32.dll	RegOpenKeyExA, RegQueryValueExA, RegCloseKey
MSVCRT.dll	fopen, atoi, malloc, remove, strcat, memcpy, strcmp, strstr, _strlwr, strlen, sprintf, fclose, ??3@YAXPAX@Z, ??2@YAPAXI@Z, memset, fread, _chdir, _getcwd, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, _access, strcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	17:53:31
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\ws_ftp le 508.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ws_ftp le 508.exe"
Imagebase:	0x400000
File size:	748'032 bytes
MD5 hash:	64A58DD55CC3AF76FEA415EBDBEC7AF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:53:31
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\SFS5D46.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SFS5D46.tmp"
Imagebase:	0x400000
File size:	727'552 bytes
MD5 hash:	EC184194C54DBAB8D0D84CEF50C3189A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 22%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:53:31
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\SFS5D75.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SFS5D75.tmp"
Imagebase:	0x400000
File size:	707'072 bytes
MD5 hash:	6993AF44351EE82C42D77CCF5D550A29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	51.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.2%
Total number of Nodes:	86
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004014D6 Relevance: 66.8, APIs: 31, Strings: 7, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(fddint.dll,?,?,00000000), ref: 004014E7
GetProcAddress.KERNEL32(00000000,LoadSecurityFdd), ref: 00401501
GetProcAddress.KERNEL32(00000000,DelSuspectProcess), ref: 0040150C
GetProcAddress.KERNEL32(00000000,SetParam), ref: 00401517
GetCurrentProcessId.KERNEL32(00000000), ref: 0040153B
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0040154A
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 0040155E
_getcwd.MSVCRT ref: 004015B8
_chdir.MSVCRT ref: 004015CB
strcat.MSVCRT(?,\SFSLogic.DLL,?,?,00000000), ref: 004015D9
LoadLibraryA.KERNEL32(?), ref: 004015E8
GetProcAddress.KERNEL32(00000000,RunProcessUsingCom), ref: 004015FB
remove.MSVCRT(?), ref: 00401634
FreeLibrary.KERNEL32(?), ref: 00401648
_chdir.MSVCRT ref: 00401655
memset.MSVCRT ref: 00401670
GetVersion.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401690
strlen.MSVCRT ref: 004016AD
strlen.MSVCRT ref: 004016BB
MoveFileA.KERNEL32(?,?), ref: 00401719
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040172D
??2@YAPAXI@Z.MSVCRT ref: 00401735
strcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00401744
strcat.MSVCRT(00000000,0040309C,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040174F
strcat.MSVCRT(00000000,00401976,00000000,0040309C,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00401758
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000800,00000000,00000000,?,?), ref: 00401774
??3@YAXPAX@Z.MSVCRT ref: 0040177B
CreateProcessA.KERNELBASE(?,00401976,00000000,00000000,00000000,00000800,00000000,00000000,?,?), ref: 0040179F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,00000000), ref: 004017B0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,00000000), ref: 004017BB
remove.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 004017C8

Strings

fddint.dll, xrefs: 004014E2
\SFSLogic.DLL, xrefs: 004015D3
SetParam, xrefs: 0040150E
LoadSecurityFdd, xrefs: 004014FB
RunProcessUsingCom, xrefs: 004015F5
.exe, xrefs: 004016FD
DelSuspectProcess, xrefs: 00401503

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: AddressLibraryProc$Processstrcat$CreateFileFreeLoadObjectSingleWait_chdirremovestrcpystrlen$??2@??3@CurrentModuleMoveNameVersion_getcwdmemset
String ID: .exe$DelSuspectProcess$LoadSecurityFdd$RunProcessUsingCom$SetParam$\SFSLogic.DLL$fddint.dll
API String ID: 3916422402-60373743
Opcode ID: d5a1c937f75c8d7b89c17025dc390320e5124bf3b09acbbe6bc4dff956bcb20b
Instruction ID: 59754085575d6863a064e487a5cb80b000d6e00c00894dd9b8ca2cba1f24dfd1
Opcode Fuzzy Hash: d5a1c937f75c8d7b89c17025dc390320e5124bf3b09acbbe6bc4dff956bcb20b
Instruction Fuzzy Hash: DE8161B2C00218ABDF11EBA09D89EDF7B7CAB04314F1445BBF605B3191DB399A45CB68

Function 00401000 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 102
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Finjan\SurfinShield\install\install1,00000000,00000001,?,00000000), ref: 0040101D
RegQueryValueExA.ADVAPI32(?,Directory,00000000,?,004015A7,004015A7,00000104,74DEF550), ref: 00401055
strcat.MSVCRT(00000104,\bin), ref: 00401067
strcpy.MSVCRT(?,00000104,00000104,\bin), ref: 00401076
strcat.MSVCRT(?,\winsfcm.exe,?,00000104,00000104,\bin), ref: 00401087
_access.MSVCRT ref: 00401094
RegQueryValueExA.ADVAPI32(?,VersionL,00000000,?,00000104,00000104), ref: 004010BF
atoi.MSVCRT ref: 004010CF
RegQueryValueExA.ADVAPI32(?,VersionR,00000000,?,00000104,00000104), ref: 004010F1
atoi.MSVCRT ref: 004010FB
RegCloseKey.ADVAPI32(?), ref: 0040110A

Strings

Directory, xrefs: 00401046
\winsfcm.exe, xrefs: 00401081
VersionL, xrefs: 004010B4
VersionR, xrefs: 004010E9
\bin, xrefs: 0040105F
SOFTWARE\Finjan\SurfinShield\install\install1, xrefs: 00401013

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: QueryValue$atoistrcat$CloseOpen_accessstrcpy
String ID: Directory$SOFTWARE\Finjan\SurfinShield\install\install1$VersionL$VersionR$\bin$\winsfcm.exe
API String ID: 2098520314-31041771
Opcode ID: 65e61885fb17c18efb209aa3b213dab9104abb256decaeed14945547a4f2da6b
Instruction ID: 9587274f73c2fef2bab9d487080f71abeba12e663352ca29afcb3d9e2aef618b
Opcode Fuzzy Hash: 65e61885fb17c18efb209aa3b213dab9104abb256decaeed14945547a4f2da6b
Instruction Fuzzy Hash: 0A31387690021DBAEF11DBA1DD85EEE7B7CAB44749F104077EA00F60A1D6B49A48CB68

Function 00401342 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00401358
fread.MSVCRT ref: 00401382
fclose.MSVCRT ref: 004014C8

Strings

SFS, xrefs: 004013F3, 0040142E

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: fclosefopenfread
String ID: SFS
API String ID: 2679521937-3321536822
Opcode ID: 07c20854c58d725c210bb6ec4e4aaead1d06585420e296d01c4f77d64915ae2c
Instruction ID: f27f53a31cbd0b6726bd87a240828b5473448072a7a66b4a0719d91ee750a7be
Opcode Fuzzy Hash: 07c20854c58d725c210bb6ec4e4aaead1d06585420e296d01c4f77d64915ae2c
Instruction Fuzzy Hash: BD41AF71800218BBDF219FA0DD89EDF7B79EB44314F2082A6FA14B21E0D7758A80CB64

Function 00401842 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040186F
__p__fmode.MSVCRT ref: 00401884
__p__commode.MSVCRT ref: 00401892
__setusermatherr.MSVCRT ref: 004018BE
_initterm.MSVCRT ref: 004018D4
__getmainargs.MSVCRT ref: 004018F7
_initterm.MSVCRT ref: 00401907
GetStartupInfoA.KERNEL32(?), ref: 00401946
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040196A
exit.KERNELBASE ref: 0040197A
_XcptFilter.MSVCRT ref: 0040198C

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 0ca6625504e637513bd96cbb638093d5bc478517c42de4c0199a25ecba63a2d9
Instruction ID: de05a624fc009e4da56da73807b390ec82bf9ce71630cb5b19aea30ce5b6d9a5
Opcode Fuzzy Hash: 0ca6625504e637513bd96cbb638093d5bc478517c42de4c0199a25ecba63a2d9
Instruction Fuzzy Hash: 78417FB1940344AFDB209FA5DE59AAA7FB8BB09711F20013BE581B72E1C7784940CB58

Function 004011BB Relevance: 9.1, APIs: 6, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFile.KERNEL32(00000000,?,00000000), ref: 004011D2
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 004011E6
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,00000000), ref: 004011FA
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401233

Part of subcall function 0040115C: strcmp.MSVCRT ref: 00401179

UnmapViewOfFile.KERNEL32(00000000,00000000), ref: 0040122A
_lclose.KERNEL32(00000044), ref: 0040123D

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: File$View$ChangeCloseCreateFindMappingNotificationOpenUnmap_lclosestrcmp
String ID:
API String ID: 3924220424-0
Opcode ID: b8582ee5dd1678f429b3e7bbcd9c487ff6e80fc0e92aea0628cb8115f69b0676
Instruction ID: 82b49617ec877ee4a5b9ee3c69f4470f3cece88bbbf1705d35c8fa18a954340e
Opcode Fuzzy Hash: b8582ee5dd1678f429b3e7bbcd9c487ff6e80fc0e92aea0628cb8115f69b0676
Instruction Fuzzy Hash: 01018071501228B7DB202B61EE4DEDB3E6CEB04791F004476F605F51F0CAB48A40C6F9

Non-executed Functions

Function 004012CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 0040130D
FindFirstFileA.KERNEL32(?,?), ref: 00401320

Strings

%s%s%s%d.%s, xrefs: 00401305
1@, xrefs: 004012E0

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: FileFindFirstsprintf
String ID: 1@$%s%s%s%d.%s
API String ID: 3993882898-1896060921
Opcode ID: 3c8a879eb24ad21090cfa5a1977792dfd58f59d0efa1e2c30578c45b5b199129
Instruction ID: 471a128e66f5f84d16eb59ce74ef87f75afeba4c2c2b12453901c8599d1e9b9f
Opcode Fuzzy Hash: 3c8a879eb24ad21090cfa5a1977792dfd58f59d0efa1e2c30578c45b5b199129
Instruction Fuzzy Hash: 99F0F932A00114BBDB105F9DDC49ADF7A29F744325F10027AFA29F21F0D2748E159798

Function 00401248 Relevance: 7.6, APIs: 6, Instructions: 59
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 0040124F
strcpy.MSVCRT(?,?,00000000,?,00000000,00401976,?,004016F0,?,?,?), ref: 0040126B
_strlwr.MSVCRT ref: 00401271
strstr.MSVCRT ref: 00401282
strlen.MSVCRT ref: 00401294
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004012A4

Memory Dump Source

Source File: 00000000.00000002.1905014804.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1904999977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905038239.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905053034.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1905075873.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ws_ftp le 508.jbxd

Similarity

API ID: strcpystrlen$_strlwrstrstr
String ID:
API String ID: 3295458005-0
Opcode ID: 95523ea8d987552f3c620344cdd5b956a4d76afb22a49ff5c4a793c8705fb119
Instruction ID: 56e7d78fca775b5d2133a094132e44fbdaa6b348b5623ce95af93673cf18c57d
Opcode Fuzzy Hash: 95523ea8d987552f3c620344cdd5b956a4d76afb22a49ff5c4a793c8705fb119
Instruction Fuzzy Hash: C90126325082566BD7019F79DC45A9B3BA8EF02364F2000BFF500F71E2D7B8D8019299

Analysis Process: SFS5D75.tmpPID: 4600, Parent PID: 6196COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.9%
Total number of Nodes:	1420
Total number of Limit Nodes:	20

Executed Functions

Function 0040481A Relevance: 323.1, APIs: 75, Strings: 109, Instructions: 1140windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004084DB: DialogBoxParamA.USER32(00400000,DLG_LICENSE,?,0040821E,00000000), ref: 004084FA
Part of subcall function 004084DB: WriteProfileStringA.KERNEL32(WS_FTP,VERSION,2000.02.23), ref: 0040851C
Part of subcall function 004084DB: WriteProfileStringA.KERNEL32(WS_FTP,EVAL,00000000), ref: 0040852E

MessageBoxA.USER32(?,?,00411010,00000000), ref: 004048A3
GetVersionExA.KERNEL32(00000094), ref: 0040499D
GetSystemDirectoryA.KERNEL32(?,00000200), ref: 004049D1
wsprintfA.USER32 ref: 004049E8
GetProfileStringA.KERNEL32(WS_FTP,DIR,?,00000000,00000100), ref: 00404AB5

Strings

WS_FTP95.exe, xrefs: 004057E1
VERSION, xrefs: 0040587B
guest@, xrefs: 004054E2
WS_FTP32.exe, xrefs: 00405718
EVAL, xrefs: 004057C7
wsftp605@, xrefs: 004054CB
WS_FTP, xrefs: 00405638
WS_FTP32, xrefs: 004057A0
%s\remove.exe, xrefs: 00405303
GROUP, xrefs: 00405A7B
\Program Files\WS_FTP, xrefs: 004049D7
WS_FTP, xrefs: 00404AB0
2000.02.23, xrefs: 00405784
WS_FTP, xrefs: 00405703
EVAL, xrefs: 004056FE
WS_FTP32.exe, xrefs: 00404E47
WS_FTP, xrefs: 004056EE
WS_FTP.ini, xrefs: 00405A09
EVAL, xrefs: 0040579B
remove.exe, xrefs: 00405946
WS_FTP95.exe, xrefs: 00405146
%s\%s, xrefs: 00405677
\WIN32APP\WS_FTP, xrefs: 00404A15
WS_FTP.pdf, xrefs: 004058DC
%s\%s, xrefs: 00405355
wsftple@, xrefs: 004054FE
VERSION, xrefs: 00405789
INSTOPTS, xrefs: 00404DB9
WS_FTP32 LE, xrefs: 00405739
WS_FTP, xrefs: 00405AB0
WS_FTP LE Manual, xrefs: 00405927
WS_FTP95, xrefs: 00404C03
WSFTP32.dll, xrefs: 004051BC
WS_FTP, xrefs: 004055AD
MAILADDR, xrefs: 004054D0
WS_FTP, xrefs: 004055DC
WS_FTP32, xrefs: 004057B7
WS_FTP, xrefs: 00405A6B
WS_FTP, xrefs: 004056D7
WS_FTP.ini, xrefs: 00405457
WS_FTP95, xrefs: 00404D97
%s\%s, xrefs: 004057ED
_config_, xrefs: 00405A3D
WS_FTP, xrefs: 00404DBE
WS_FTP.pdf, xrefs: 0040591B
WS_FTP LE, xrefs: 004056A1
%s\%s, xrefs: 004058E8
WS_FTP.ini, xrefs: 00405349
%s\%s, xrefs: 00405724
%s%s, xrefs: 00404DDB
WS_FTP, xrefs: 00405A80
_config_, xrefs: 00405525
VERSION, xrefs: 004056E9
EVAL, xrefs: 004056D2
2000.02.23, xrefs: 0040584D
WS_FTP95, xrefs: 004053BE
VERSION, xrefs: 00405852
WS_FTP, xrefs: 004056C5
EVAL, xrefs: 00405890
MAILADDR, xrefs: 00405520
%s%s, xrefs: 00404E53
WSFTP32.dll, xrefs: 004050EB
WS_FTP LE Help, xrefs: 004058B1
WS_FTP95, xrefs: 00405880
%s\%s, xrefs: 00405A15
WS_FTP.exe, xrefs: 0040566B
_, xrefs: 00404F12
DEFDIR, xrefs: 00405A66
WS_FTP.exe, xrefs: 00405053
2000.02.23, xrefs: 004056BB
WS_FTP95, xrefs: 00404B88
WS_FTP, xrefs: 00405A54
WS_FTP.exe, xrefs: 00404DCF
WS_FTP.ini, xrefs: 0040548A
WS_FTP95.exe, xrefs: 00404EBF
remove.exe, xrefs: 0040596C
\WS_FTP, xrefs: 00404A46
WS_FTP95, xrefs: 00404C46
DEFDIR, xrefs: 00404CA2
WS_FTP95, xrefs: 004059EE
WSFTP16.dll, xrefs: 004050A6
%s\%s, xrefs: 004052E7
%s%s, xrefs: 00404ECB
WS_FTP.ini, xrefs: 004053FE
WS_FTP32, xrefs: 004057CC
WS_FTP.hlp, xrefs: 004058A5
WS_FTP95, xrefs: 00405869
INSTOPTS, xrefs: 00405AAB
EVAL, xrefs: 00405864
VERSION, xrefs: 004056C0
Uninstall WS_FTP LE, xrefs: 00405934
\WS_FTP, xrefs: 00404A77
DLG_COPY, xrefs: 00405004
WS_FTP LE Release Notes, xrefs: 004058CF
WS_FTP32, xrefs: 0040578E
WS_FTP95, xrefs: 00405895
_config_, xrefs: 004054D5
DIR, xrefs: 00405A4F
%s\%s, xrefs: 00405496
MAILADDR, xrefs: 00405A38
GROUP, xrefs: 004055D7
WS_FTP95, xrefs: 00405857
%s\%s, xrefs: 00405952
WS_FTP95 LE, xrefs: 00405802
whatsnew.txt, xrefs: 004058C3
WS_FTP, xrefs: 00404CA7
VERSION, xrefs: 004057B2
DIR, xrefs: 00404AAB
remove32.exe, xrefs: 004052DB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ProfileString$Write$DialogDirectoryMessageParamSystemVersionwsprintf
String ID: %s%s$%s%s$%s%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\remove.exe$2000.02.23$2000.02.23$2000.02.23$DEFDIR$DEFDIR$DIR$DIR$DLG_COPY$EVAL$EVAL$EVAL$EVAL$EVAL$EVAL$GROUP$GROUP$INSTOPTS$INSTOPTS$MAILADDR$MAILADDR$MAILADDR$Uninstall WS_FTP LE$VERSION$VERSION$VERSION$VERSION$VERSION$VERSION$WSFTP16.dll$WSFTP32.dll$WSFTP32.dll$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP LE$WS_FTP LE Help$WS_FTP LE Manual$WS_FTP LE Release Notes$WS_FTP.exe$WS_FTP.exe$WS_FTP.exe$WS_FTP.hlp$WS_FTP.ini$WS_FTP.ini$WS_FTP.ini$WS_FTP.ini$WS_FTP.ini$WS_FTP.pdf$WS_FTP.pdf$WS_FTP32$WS_FTP32$WS_FTP32$WS_FTP32$WS_FTP32 LE$WS_FTP32.exe$WS_FTP32.exe$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95$WS_FTP95 LE$WS_FTP95.exe$WS_FTP95.exe$WS_FTP95.exe$\Program Files\WS_FTP$\WIN32APP\WS_FTP$\WS_FTP$\WS_FTP$_$_config_$_config_$_config_$guest@$remove.exe$remove.exe$remove32.exe$whatsnew.txt$wsftp605@$wsftple@
API String ID: 2404108836-3145078816
Opcode ID: b8c9dc46e6588e77c7316e89cd5879afd513945bd0a8b6c32b8218fa648718e9
Instruction ID: 00bd2da8d0ae1a8ef62b34529ab5d44e0785eb2630597541a76622a9778d434d
Opcode Fuzzy Hash: b8c9dc46e6588e77c7316e89cd5879afd513945bd0a8b6c32b8218fa648718e9
Instruction Fuzzy Hash: EEA240B5940218ABDB10DB94DC49FDA77BCAB48705F0480B6F708F21D2E7789A848F6D

Function 004064E3 Relevance: 51.0, APIs: 23, Strings: 6, Instructions: 298
windowstringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000100,?,?,?), ref: 00406515
lstrlenA.KERNEL32(?,?,?), ref: 00406522
lstrlenA.KERNEL32(?,?,?), ref: 00406540
lstrlenA.KERNEL32(?,?,?), ref: 0040655E
GetTempFileNameA.KERNELBASE(?,WFT,00000000,WFT5DD2.tmp), ref: 004065AE
lstrlenA.KERNEL32(00000000), ref: 004065DD
lstrcatA.KERNEL32(?,004115D4), ref: 00406605
GetVersion.KERNEL32 ref: 0040660B
LoadIconA.USER32(00400000,APP_MAIN), ref: 00406780
LoadCursorA.USER32(00000000,00007F00), ref: 00406793
CreateSolidBrush.GDI32(00808000), ref: 004067A4
RegisterClassA.USER32(0000200B), ref: 004067CB
MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 0040681E
GetDesktopWindow.USER32 ref: 00406832
GetWindowRect.USER32(00000000), ref: 00406839
CreateWindowExA.USER32(00000000,WSInstal,WS_FTP Limited Edition Install (32),02C80000,?,?,00000258,00000190,00000000,00000000,00400000,00000000), ref: 0040690C
MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00406966
ShowWindow.USER32(0002044E,00000001), ref: 0040697E
PostMessageA.USER32(0002044E,00000111,00000064,00000000), ref: 004069AF
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004069C2
IsDialogMessageA.USER32(00000000,?), ref: 004069EA
TranslateMessage.USER32(?), ref: 004069FF
DispatchMessageA.USER32(?), ref: 00406A0C

Part of subcall function 0040308B: DestroyWindow.USER32(0j@,?,?,?,?,00406A30,00000000), ref: 00403095

Strings

APP_MAIN, xrefs: 00406775
WFT, xrefs: 004065A2
WSInstal, xrefs: 00406718, 004067BA, 00406905
WSInstal, xrefs: 00406713
WFT5DD2.tmp, xrefs: 0040658E, 0040659B, 004065B6, 004065EC
WS_FTP Limited Edition Install (32), xrefs: 00406900

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Message$Window$lstrlen$CreateLoadTemp$BrushCallbackClassCursorDesktopDestroyDialogDispatchDispatcherFileIconNamePathPostRectRegisterShowSolidTranslateUserVersionlstrcat
String ID: APP_MAIN$WFT$WFT5DD2.tmp$WSInstal$WSInstal$WS_FTP Limited Edition Install (32)
API String ID: 882306480-2460812804
Opcode ID: 6da9ebbad4ad1128a3a7247eab9633f63d2eb1363ff4f0f7c1e62b4d6dbe1793
Instruction ID: 6aa823dbcf9b747cb28b3bb7b43084bdf57f66e68e56781b1ef511cba06a127d
Opcode Fuzzy Hash: 6da9ebbad4ad1128a3a7247eab9633f63d2eb1363ff4f0f7c1e62b4d6dbe1793
Instruction Fuzzy Hash: D3D131B1A00218EFDB21DF64DC49BDD77B8EB04706F1080B6E649E62D0D7B89A94CF59

Function 00406A45 Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 122
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapA.USER32(00400000,IPSWITCH), ref: 00406AE9
lstrcpyA.KERNEL32(WS_FTP LE Help,WS_FTP LE Help), ref: 00406AFE
lstrcpyA.KERNEL32(WS_FTP LE Release Notes,WS_FTP LE Release Notes), ref: 00406B0E
lstrcpyA.KERNEL32(Uninstall WS_FTP LE,Uninstall WS_FTP LE), ref: 00406B1E
lstrcpyA.KERNEL32(WS_FTP Icon Placement,WS_FTP Icon Placement), ref: 00406B2E
lstrcpyA.KERNEL32(WS_FTP Explorer Help,WS_FTP Explorer Help), ref: 00406B3E
LoadBitmapA.USER32(00400000,WS_BMP), ref: 00406B4F
CreateSolidBrush.GDI32(00C0C0C0), ref: 00406B5F
DeleteObject.GDI32(80050DCC), ref: 00406B9B
DeleteObject.GDI32(2F050DE9), ref: 00406BB4
DeleteObject.GDI32(10100DE8), ref: 00406BC0
DefWindowProcA.USER32(?,?,?,?), ref: 00406BD6

Strings

WS_FTP LE Release Notes, xrefs: 00406B09
IPSWITCH, xrefs: 00406ADE
Uninstall WS_FTP LE, xrefs: 00406B19
d, xrefs: 00406AC7
WS_FTP LE Release Notes, xrefs: 00406B04
WS_FTP LE Help, xrefs: 00406AF4
Uninstall WS_FTP LE, xrefs: 00406B14
WS_FTP Explorer Help, xrefs: 00406B34
WS_FTP LE Help, xrefs: 00406AF9
WS_BMP, xrefs: 00406B44
WS_FTP Icon Placement, xrefs: 00406B29
WS_FTP Icon Placement, xrefs: 00406B24
WS_FTP Explorer Help, xrefs: 00406B39

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: lstrcpy$DeleteObject$BitmapLoad$BrushCreateProcSolidWindow
String ID: IPSWITCH$Uninstall WS_FTP LE$Uninstall WS_FTP LE$WS_BMP$WS_FTP Explorer Help$WS_FTP Explorer Help$WS_FTP Icon Placement$WS_FTP Icon Placement$WS_FTP LE Help$WS_FTP LE Help$WS_FTP LE Release Notes$WS_FTP LE Release Notes$d
API String ID: 3189719223-1049329174
Opcode ID: afd370393dcc3e61c370d8e39c01adb4afc0dabf8e63583fef7b8d7b80086d20
Instruction ID: 8cda597b1dbf26d671badf92cf0063951e3bc435f85b83474f0ac230575785ec
Opcode Fuzzy Hash: afd370393dcc3e61c370d8e39c01adb4afc0dabf8e63583fef7b8d7b80086d20
Instruction Fuzzy Hash: A6416DB1604214EFCB109FA8ED49FD937B8EB58742F148476F647E72A0C6789990CB1D

Function 00403AAF Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000110,00000976,?), ref: 00403AE7
CheckDlgButton.USER32(00000110,00000977,?), ref: 00403B00
CheckDlgButton.USER32(00000110,00000978,?), ref: 00403B19
CheckDlgButton.USER32(00000110,00000979,?), ref: 00403B32
CheckDlgButton.USER32(00000110,0000097A,?), ref: 00403B4B
CheckDlgButton.USER32(00000110,0000097B,?), ref: 00403B64
CheckDlgButton.USER32(00000110,0000097C,?), ref: 00403B7D
CheckDlgButton.USER32(00000110,0000097D,?), ref: 00403B98

Strings

@, xrefs: 00403C96

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ButtonCheck
String ID: @
API String ID: 83588225-2766056989
Opcode ID: d4192ab5e582f465debaf320fa58ec8ca6353ecfff21f76111d2e7630dba6dd5
Instruction ID: 6e910f93d41afd629374aee162e22e6f7f537e8d87cc65e4d8e047c8bbb76c06
Opcode Fuzzy Hash: d4192ab5e582f465debaf320fa58ec8ca6353ecfff21f76111d2e7630dba6dd5
Instruction Fuzzy Hash: B261FB76A15608FFEB10CF98C949ADE7FBDEB04742F108426F546EB290C678DB409B19

Function 00405C60 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRadioButton.USER32(?,0000073B,0000073C,0000073B), ref: 00405C9B
GetProfileStringA.KERNEL32(WS_FTP,DEFDIR,00411500,?,00000100), ref: 00405CBC
GetProfileIntA.KERNEL32(WS_FTP,INSTOPTS,00000000), ref: 00405CD6
GetDlgItem.USER32(?,0000073C), ref: 00405CF4
EnableWindow.USER32(00000000), ref: 00405CFB

Strings

WS_FTP, xrefs: 00405CD1
DEFDIR, xrefs: 00405CB2
INSTOPTS, xrefs: 00405CCC
WS_FTP, xrefs: 00405CB7

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Profile$ButtonCheckEnableItemRadioStringWindow
String ID: DEFDIR$INSTOPTS$WS_FTP$WS_FTP
API String ID: 2788321495-3855382250
Opcode ID: 80b65d23e32e508649bb91a3bd778256950a19d1fce81bf16b8b38bfeeb2225c
Instruction ID: 7402c9404ba12bcccc2f0bdf46cd120c891bed680ed92d051f0d0311fee1ba70
Opcode Fuzzy Hash: 80b65d23e32e508649bb91a3bd778256950a19d1fce81bf16b8b38bfeeb2225c
Instruction Fuzzy Hash: C1314A74A44604FBEB109F94CC4DBDB3B69EF44741F208467B60AEA2D1C2BC9A81DF59

Function 0040D140 Relevance: 13.8, APIs: 9, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNELBASE(00000000,00000000,0040F34C,00000001,0040F34C,00000001,024F0C50,?,?,FFFFFFFE,?,FFFFFFFE,?,?,?), ref: 0040D162
CompareStringW.KERNEL32(00000000,00000000,0040F350,00000001,0040F350,00000001,?,?,?,?,0040663B,004115D8), ref: 0040D1A2
CompareStringA.KERNEL32(?,?,?,?,?,?,024F0C50,?,?,FFFFFFFE,?,FFFFFFFE,?,?,?), ref: 0040D1FB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 1a8b79c94fde63c2d1adcd9f462e1673e0e85a039392aabb915b774bf46f4ae0
Instruction ID: f9fce229bb88f211719382ffdb0721d7cf90932293ee3565554149a7e3adf5ce
Opcode Fuzzy Hash: 1a8b79c94fde63c2d1adcd9f462e1673e0e85a039392aabb915b774bf46f4ae0
Instruction Fuzzy Hash: 6391FA72B043106BD7209BD5EC81BABB7A8DB85365F44047BF940E6280D57FE84D87AA

Function 00403931 Relevance: 10.6, APIs: 7, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRadioButton.USER32(00000110,0000073B,0000073E,-0000073A), ref: 00403981

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ButtonCheckRadio
String ID:
API String ID: 2493629399-0
Opcode ID: dbc05ff49b0c900893eb71ca2a9881250b1c0e5f97c8ae091de0a2ed1427cce0
Instruction ID: ae9914eddabf1d7a4451d0649c056647c244a805527381bb06534f228f0defb9
Opcode Fuzzy Hash: dbc05ff49b0c900893eb71ca2a9881250b1c0e5f97c8ae091de0a2ed1427cce0
Instruction Fuzzy Hash: 0431F8B5B04208FBEB10CF98C849BDA7FADAB04346F108426B545AB2C0D27CDB45DF5A

Function 0040EC20 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryA.KERNELBASE(?), ref: 0040EC2B
GetCurrentDirectoryA.KERNEL32(00000105,?), ref: 0040EC3F
SetEnvironmentVariableA.KERNEL32(0000005C,?), ref: 0040EC96
GetLastError.KERNEL32 ref: 0040ECA9

Strings

:, xrefs: 0040EC83
/, xrefs: 0040EC50

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CurrentDirectory$EnvironmentErrorLastVariable
String ID: /$:
API String ID: 373561786-4222935259
Opcode ID: 5800be77dd3a4d5b16c417f98cfdd3cd3fed30e0ab49c82dadbf7a7ed143fba0
Instruction ID: 3e44c1927b87fded5810ae1b30d801f600d11ce2a96b1e3263037d11be6f8aef
Opcode Fuzzy Hash: 5800be77dd3a4d5b16c417f98cfdd3cd3fed30e0ab49c82dadbf7a7ed143fba0
Instruction Fuzzy Hash: 38018E6050C380AAF711D775A8097AB7BD85B81B04F48CD7DB4D8D22C1E67EC868EB67

Function 00403D71 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DialogBoxParamA.USER32(00400000,DLG_FUNCTION,00000002,Function_00003931,00000000), ref: 00403E08
DialogBoxParamA.USER32(00400000,DLG_FTP_USE,00000002,Function_00003AAF,00000000), ref: 00403E57

Strings

DLG_FTP_USE, xrefs: 00403E4C
DLG_FUNCTION, xrefs: 00403DFD

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DialogParam
String ID: DLG_FTP_USE$DLG_FUNCTION
API String ID: 665744214-1741520859
Opcode ID: 33314d246c416ce3cc7aecdb0801773efc0e0e17494086ab5372d94db4b38e5e
Instruction ID: da105ce1ee023838a847b9b87191b81ccf3187952505922d3ffb8d72c63baa46
Opcode Fuzzy Hash: 33314d246c416ce3cc7aecdb0801773efc0e0e17494086ab5372d94db4b38e5e
Instruction Fuzzy Hash: 1941A270D08209EADB10CF94C9497BEBFB8AF05326F204677E521B62D1C3794B45DB9A

Function 00403FFB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://www.ipswitch.com/downloads/ws_ftp_PRO.html, xrefs: 00404037
https://buy.ipswitch.com/cgi-ole/buypro.showform/wsftppro/?000001767Ipswitch+Inc, xrefs: 00404052
http://www.ipswitch.com/products/ws_ftp/, xrefs: 0040406D

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID:
String ID: http://www.ipswitch.com/downloads/ws_ftp_PRO.html$http://www.ipswitch.com/products/ws_ftp/$https://buy.ipswitch.com/cgi-ole/buypro.showform/wsftppro/?000001767Ipswitch+Inc
API String ID: 0-2351002988
Opcode ID: 5f1340747332a71e15a10f4fb326fff5565ddcb7113a7eb510d6c60262a9153e
Instruction ID: 287d8b5b8386b54366d1a56125878b1f819d8532d2fedd08a0727f5bc58b309e
Opcode Fuzzy Hash: 5f1340747332a71e15a10f4fb326fff5565ddcb7113a7eb510d6c60262a9153e
Instruction Fuzzy Hash: 142169B5A08205F7DB10DA58C84A7DE76689B90345F208437BB06BB2C0D2FCCAC5975B

Function 004099D0 Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004099F6

Part of subcall function 0040BE00: HeapCreate.KERNELBASE(00000001,00001000,00000000,00409A36), ref: 0040BE09

Part of subcall function 0040BC20: GetStartupInfoA.KERNEL32(?), ref: 0040BC88
Part of subcall function 0040BC20: GetFileType.KERNEL32(00000000), ref: 0040BD36

GetCommandLineA.KERNEL32 ref: 00409A47

Part of subcall function 0040B7B0: GetEnvironmentStringsW.KERNEL32 ref: 0040B7C6
Part of subcall function 0040B7B0: GetEnvironmentStringsW.KERNEL32 ref: 0040B815

GetStartupInfoA.KERNEL32(?), ref: 00409AE2
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B01

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: EnvironmentInfoStartupStrings$CommandCreateFileHandleHeapLineModuleTypeVersion
String ID:
API String ID: 4198008335-0
Opcode ID: 59f1854a89c2f5bb9b1186e1d773dbab684a1d78de87c00385bbf79efcb552c5
Instruction ID: e8feff56f09fcb000cd912d670c7754ddaf711f84c9b9c3108bebf31642246aa
Opcode Fuzzy Hash: 59f1854a89c2f5bb9b1186e1d773dbab684a1d78de87c00385bbf79efcb552c5
Instruction Fuzzy Hash: 4B41F4B19042859EE721AFB5D80579ABFA4EF41350F28453AE484A22D3E73C4941CF9D

Function 0040AD70 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,0040AD3E,?,00000000,00000000,00409A70,000000FF), ref: 0040AD81
TerminateProcess.KERNEL32(00000000,?,?,?,0040AD3E,?,00000000,00000000,00409A70,000000FF), ref: 0040AD88
ExitProcess.KERNEL32 ref: 0040AE09

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ac6d2a0288e75e0d524355392d0d92dcc1e6e39f1651e2cd1cb89c3e44184fbf
Instruction ID: 82fefd74ab16f9c499f3b549766f12899c53074dc45fd232047e1bf61e9d3096
Opcode Fuzzy Hash: ac6d2a0288e75e0d524355392d0d92dcc1e6e39f1651e2cd1cb89c3e44184fbf
Instruction Fuzzy Hash: C6019231951300EFDA10AF54FD457C73B66AF94346F11403BE504626A0E7B898D4CBAF

Function 00405E17 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DialogBoxParamA.USER32(?,DLG_INSTALL,?,00405C60,00000000), ref: 00405E3B

Strings

DLG_INSTALL, xrefs: 00405E32

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DialogParam
String ID: DLG_INSTALL
API String ID: 665744214-847654678
Opcode ID: 813eb854cdf9a7e8cb3158bbb59208605aae17e13c97a0eef6e7443a5bd16773
Instruction ID: c843d083da198cdeadd9f5cb6935d17cfb22cbb9a30d4f44eec3808a8b47750c
Opcode Fuzzy Hash: 813eb854cdf9a7e8cb3158bbb59208605aae17e13c97a0eef6e7443a5bd16773
Instruction Fuzzy Hash: 41E04F75601208FBD700DB98DC49FCF77BCDB40754F204022B505F7180C274AE008B94

Function 00404116 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DialogBoxParamA.USER32(00400000,DLG_NOT_AUTH,?,Function_00003FFB,00000000), ref: 00404132

Strings

DLG_NOT_AUTH, xrefs: 00404127

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DialogParam
String ID: DLG_NOT_AUTH
API String ID: 665744214-157816563
Opcode ID: 372aec99ca1dd0569ab48627e1e8972865288bfc45e06272f9d849c4741347dd
Instruction ID: d0e5221ce7d36dde7fd57f9faeb2560cd22dfbfd1b9f1b505e9fd0d339a40e19
Opcode Fuzzy Hash: 372aec99ca1dd0569ab48627e1e8972865288bfc45e06272f9d849c4741347dd
Instruction Fuzzy Hash: 53D0C976340204BBD6105A8AEC8AFD77B6CDB85AE6F204022F605D6190D2A4AD4087A8

Function 00409150 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,0040918A,?,0040332C,?), ref: 00409155
GetLastError.KERNEL32 ref: 00409164

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: e4470ded3228b0f8c465be9b9c57ba766ec7c5e47e70f6df50857f62e7a0e210
Instruction ID: 8d522558ccb394645039148d93f6208a045b8b9362c0c1ed3223902ff1e236d0
Opcode Fuzzy Hash: e4470ded3228b0f8c465be9b9c57ba766ec7c5e47e70f6df50857f62e7a0e210
Instruction Fuzzy Hash: AED0C9B8B006019BEA009F79AC0CB4B32A86F80725F484635B419E62D1EA3CCC40961A

Function 0040BE00 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000001,00001000,00000000,00409A36), ref: 0040BE09

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 62a5a0bcb5d34406380dc76731c2023e84535e75953e2e25a6d74dc1d6a6451a
Instruction ID: db970c6eab93140bde6e1bea02bcba5b5e832bbd6ad103fc26957ecf92c0528c
Opcode Fuzzy Hash: 62a5a0bcb5d34406380dc76731c2023e84535e75953e2e25a6d74dc1d6a6451a
Instruction Fuzzy Hash: A0B012702C1300AAE3100B505D06BC036545384B53F20403472005C1D5D6F02080570C

Non-executed Functions

Function 004086E4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

StretchDIBits.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00408763
GlobalUnlock.KERNEL32(00000000), ref: 0040876F
FreeResource.KERNEL32(00000000), ref: 0040877B
ReleaseDC.USER32(?,00000000), ref: 00408789
ValidateRect.USER32(?,00000000), ref: 00408795

Strings

0p)u, xrefs: 00408763

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: BitsFreeGlobalRectReleaseResourceStretchUnlockValidate
String ID: 0p)u
API String ID: 2343598975-3786888629
Opcode ID: 2a297a6c057b7aee1118c63364cd83db08cd16441d64cba85230994e864cc6b1
Instruction ID: c2bd4c87146c0236e3aeaeebb8c11e102946ddb23a7267606f31061a64c62bfc
Opcode Fuzzy Hash: 2a297a6c057b7aee1118c63364cd83db08cd16441d64cba85230994e864cc6b1
Instruction Fuzzy Hash: AE218BB5A44600AFD700CFACED85FDAB7E9E748301F108425F505D7262D675A9418B18

Function 00406259 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00406292
OpenProcessToken.ADVAPI32(00000000), ref: 00406299
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004062AA
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 004062CE
ExitWindowsEx.USER32(00000000,00000000), ref: 004062DA

Strings

SeShutdownPrivilege, xrefs: 004062A3

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 1314775590-3733053543
Opcode ID: 98c75df6f3c32253a300485c81cd218314744e3a74c34b75ae499729e3bf6d4e
Instruction ID: b9b6fd4e747a5c3d2ee25e616a44dcde159e042dfcca196fa10a81d74fed8777
Opcode Fuzzy Hash: 98c75df6f3c32253a300485c81cd218314744e3a74c34b75ae499729e3bf6d4e
Instruction Fuzzy Hash: B9015A71940608EBFB20ABE4DC4DFDE7BB8EB44746F204029F616AB1D1C3B95484CB68

Function 004098C0 Relevance: 4.6, APIs: 3, Instructions: 74timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004098CC
GetSystemTime.KERNEL32(?), ref: 004098D7
GetTimeZoneInformation.KERNEL32(?), ref: 00409930

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Time$InformationLocalSystemZone
String ID:
API String ID: 2475273158-0
Opcode ID: 6a1ec4e42a3ef9ce4888345a1e6057eba0a435f36c26075e6220aa95fe08ba1f
Instruction ID: 249808347673ee99c8fb87ac1726bd7f2d7de3a41c743f1566682b4e52b3e9f5
Opcode Fuzzy Hash: 6a1ec4e42a3ef9ce4888345a1e6057eba0a435f36c26075e6220aa95fe08ba1f
Instruction Fuzzy Hash: D32138B94086029AC710EF68D941AABB3E5EB89304F50C93DE599D3794F738CD81CB99

Function 0040AA00 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe6640f6d50eaeccf053c58d8051a3b325dc1b5cf0786584cae736090ab52ca
Instruction ID: 4a857fce57f4448a3b874f24d6ecdb87d4e2565195bc8d7bf8cf2cd9d5d55d27
Opcode Fuzzy Hash: 5fe6640f6d50eaeccf053c58d8051a3b325dc1b5cf0786584cae736090ab52ca
Instruction Fuzzy Hash: CD416D31A083548FE31489999908373B6E3E781310F2845BBCB66672D1D6BDA837D78F

Function 0040413D Relevance: 154.4, APIs: 28, Strings: 60, Instructions: 432windowstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,Remove), ref: 00404155
GetProfileStringA.KERNEL32(WS_FTP,DIR,00410C88,?,00000100), ref: 00404176
GetProfileIntA.KERNEL32(WS_FTP,INSTOPTS,00000000), ref: 00404190
wsprintfA.USER32 ref: 004041C1
wsprintfA.USER32 ref: 004041F1
wsprintfA.USER32 ref: 00404221
wsprintfA.USER32 ref: 00404251
wsprintfA.USER32 ref: 00404281
wsprintfA.USER32 ref: 004042B1
wsprintfA.USER32 ref: 004042E1

Part of subcall function 00409190: GetFileAttributesA.KERNEL32(00000000,004042F8,?,00000000), ref: 00409195
Part of subcall function 00409190: GetLastError.KERNEL32 ref: 004091A0

wsprintfA.USER32 ref: 00404314
MessageBoxA.USER32(?,?,WS_FTP95,00000004), ref: 0040432F
wsprintfA.USER32 ref: 00404390
wsprintfA.USER32 ref: 004043F0
wsprintfA.USER32 ref: 00404420
GetProfileStringA.KERNEL32(WS_FTP,GROUP,00413A50,?,00000100), ref: 00404465
wsprintfA.USER32 ref: 004044AE
wsprintfA.USER32 ref: 004044F1
wsprintfA.USER32 ref: 0040452D
wsprintfA.USER32 ref: 00404572
wsprintfA.USER32 ref: 004045AE
lstrcpyA.KERNEL32(?,Uninstall WS_FTP LE), ref: 00404641

Part of subcall function 00407399: wsprintfA.USER32 ref: 004074F3

wsprintfA.USER32 ref: 004046BB

Part of subcall function 00407736: wsprintfA.USER32 ref: 00407778
Part of subcall function 00407736: DdeUninitialize.USER32(00000000), ref: 0040779C

Part of subcall function 0040EBF0: RemoveDirectoryA.KERNEL32(?,00404719,?), ref: 0040EBF5
Part of subcall function 0040EBF0: GetLastError.KERNEL32 ref: 0040EC04

WriteProfileStringA.KERNEL32(WS_FTP,00000000,00000000), ref: 0040473A
MessageBoxA.USER32(?,?,?,00000040), ref: 0040477A
wsprintfA.USER32 ref: 004047B3
MessageBoxA.USER32(?,?,?,00000040), ref: 004047D0
MessageBoxA.USER32(?,?,?,00000040), ref: 00404808

Strings

WS_FTP.ini, xrefs: 004042C9
GROUP, xrefs: 0040445B
remove.exe, xrefs: 0040464C
WS_FTP LE Help, xrefs: 004045EC
WS_FTP95.exe, xrefs: 00404269
WS_FTP.exe, xrefs: 00404496
WS_FTP.pdf, xrefs: 004046A3
WS_FTP Documentation, xrefs: 004046F3
%s (95), xrefs: 004045A2
WS_FTP Pro Explorer Help, xrefs: 00404696
WS_FTP32 LE, xrefs: 0040450F
WS_FTP, xrefs: 00404735
WS_FTP32 LE, xrefs: 0040451C
%s\%s, xrefs: 004044E5
WSFTP16.dll, xrefs: 004041D9
WS_FTP LE Release Notes, xrefs: 0040460A
nsftp.hlp, xrefs: 0040468A
WS_FTP95 LE, xrefs: 00404590
INSTOPTS, xrefs: 00404186
WS_FTP32.exe, xrefs: 004044D9
WS_FTP, xrefs: 0040418B
Uninstall WS_FTP LE, xrefs: 00404635
WS_FTP32.exe, xrefs: 00404209
WS_FTP, xrefs: 00404171
WS_FTP, xrefs: 00404460
You have an INI file in the %s directory.Do you want to delete it?WARNING: Deleting the INI will eliminate old stored profiles!, xrefs: 00404308
WS_DIAG, xrefs: 00404628
WS_FTP LE Manual, xrefs: 004046D5
%s\%s, xrefs: 00404384
WS_FTP LE, xrefs: 004044CC
%s\%s, xrefs: 004046AF
whatsnew.txt, xrefs: 004045FE
WS_FTP, xrefs: 00404438
%s\%s, xrefs: 00404245
DIR, xrefs: 0040416C
%s\%s, xrefs: 00404215
%s\%s, xrefs: 004043E4
WS_Diag.exe, xrefs: 0040461C
WS_FTP95, xrefs: 0040431F
%s\%s, xrefs: 004044A2
%s\remove.exe, xrefs: 00404414
WSFTP32.dll, xrefs: 00404299
WS_FTP, xrefs: 00404303
WS_FTP Pro Explorer, xrefs: 00404678
WSFTP32.dll, xrefs: 00404239
WS_FTP.pdf, xrefs: 004046E7
Remove, xrefs: 00404149
%s\%s, xrefs: 004041E5
WS_FTP.pdf, xrefs: 004046C9
%s\%s, xrefs: 004042D5
%s\%s, xrefs: 00404566
%s\%s, xrefs: 004041B5
%s\%s, xrefs: 00404275
WS_FTP.hlp, xrefs: 004045E0
%s\%s, xrefs: 004042A5
WS_FTP Pro Explorer.{49707377-6974-6368-2E4a-756e6f644a01}, xrefs: 00404667
WS_FTP95 LE, xrefs: 0040459D
%s (32), xrefs: 00404521
WS_FTP.exe, xrefs: 004041A9
WS_FTP95.exe, xrefs: 0040455A

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: wsprintf$MessageProfile$String$ErrorLastlstrcpy$AttributesDirectoryFileRemoveUninitializeWrite
String ID: %s (32)$%s (95)$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s$%s\remove.exe$DIR$GROUP$INSTOPTS$Remove$Uninstall WS_FTP LE$WSFTP16.dll$WSFTP32.dll$WSFTP32.dll$WS_DIAG$WS_Diag.exe$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP$WS_FTP Documentation$WS_FTP LE$WS_FTP LE Help$WS_FTP LE Manual$WS_FTP LE Release Notes$WS_FTP Pro Explorer$WS_FTP Pro Explorer Help$WS_FTP Pro Explorer.{49707377-6974-6368-2E4a-756e6f644a01}$WS_FTP.exe$WS_FTP.exe$WS_FTP.hlp$WS_FTP.ini$WS_FTP.pdf$WS_FTP.pdf$WS_FTP.pdf$WS_FTP32 LE$WS_FTP32 LE$WS_FTP32.exe$WS_FTP32.exe$WS_FTP95$WS_FTP95 LE$WS_FTP95 LE$WS_FTP95.exe$WS_FTP95.exe$You have an INI file in the %s directory.Do you want to delete it?WARNING: Deleting the INI will eliminate old stored profiles!$nsftp.hlp$remove.exe$whatsnew.txt
API String ID: 2637603324-1425071345
Opcode ID: a0ec13a249e0656dccb4c11133ca058a406507b5b8e7636401f2e30d5c72b70e
Instruction ID: 0857025733ea1214f40c946ebcb0bc383f7f27ff5b443566ac3d62c763d63313
Opcode Fuzzy Hash: a0ec13a249e0656dccb4c11133ca058a406507b5b8e7636401f2e30d5c72b70e
Instruction Fuzzy Hash: ABF120F5D40218AAEB10D790DC46FDA737CAB44705F5404A7F718F2082E6B8ABD58E6D

Function 00402840 Relevance: 66.8, APIs: 29, Strings: 9, Instructions: 282stringmemoryCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00402854
BeginPaint.USER32(?,?), ref: 00402865
SelectObject.GDI32(00000000,00000001), ref: 00402AB3
DeleteObject.GDI32(?), ref: 00402ABD
GetSystemDefaultLangID.KERNEL32 ref: 00402AD3
lstrcpyA.KERNEL32(?,Arial), ref: 00402AF1
CreateFontIndirectA.GDI32(?), ref: 00402B1F
SelectObject.GDI32(00000000,?), ref: 00402B30
SelectObject.GDI32(00000000,00000001), ref: 00402B5A
DeleteObject.GDI32(?), ref: 00402B64
LocalFree.KERNEL32(?), ref: 00402B6E
SetBkMode.GDI32(00000000,?), ref: 00402B7F
EndPaint.USER32(?,?), ref: 00402B90
GetDlgItem.USER32(?,00000064), ref: 0040288D

Part of subcall function 004025C0: InvalidateRect.USER32(?,00000000,00000001), ref: 004025DB
Part of subcall function 004025C0: GetClientRect.USER32(?,?), ref: 004025E9
Part of subcall function 004025C0: GetDC.USER32(?), ref: 004025F3
Part of subcall function 004025C0: SelectPalette.GDI32(?,00000000,00000000), ref: 00402608
Part of subcall function 004025C0: RealizePalette.GDI32(?), ref: 00402612
Part of subcall function 004025C0: LockResource.KERNEL32(00000000), ref: 0040261E

Part of subcall function 00401000: LoadStringA.USER32(00400000,?,0000273B,00000000), ref: 0040102F
Part of subcall function 00401000: wsprintfA.USER32 ref: 0040104D

Part of subcall function 004027D7: GetTextExtentPoint32A.GDI32(?,?,00000000), ref: 004027F9
Part of subcall function 004027D7: TextOutA.GDI32(?,?,?,00000000,00000000), ref: 00402827

SetBkMode.GDI32(00000000,00000001), ref: 004028A2
GetTextMetricsA.GDI32(00000000,?), ref: 004028C9
LocalAlloc.KERNEL32(00000040,0000003C), ref: 004028D3
GetSystemDefaultLangID.KERNEL32 ref: 004028DC
lstrcpyA.KERNEL32(?,Arial), ref: 004028FA
CreateFontIndirectA.GDI32(?), ref: 0040292B
SelectObject.GDI32(00000000,?), ref: 0040293C
SelectObject.GDI32(00000000,00000001), ref: 00402969
DeleteObject.GDI32(?), ref: 00402973
GetSystemDefaultLangID.KERNEL32 ref: 00402989
lstrcpyA.KERNEL32(?,Arial), ref: 004029A7
CreateFontIndirectA.GDI32(?), ref: 00402A1C
SelectObject.GDI32(00000000,?), ref: 00402A2D
GetDlgItem.USER32(?,00000064), ref: 00402BA3
ValidateRect.USER32(?,00000000), ref: 00402BB8

Strings

File Transfer Client, xrefs: 004029B7, 00402A33
by John A. Junod, xrefs: 004029E5, 00402A6B
Redistribution Not Permitted, xrefs: 004029FC, 00402A8B
Arial, xrefs: 00402AE5
for Windows 95 and Windows NT, xrefs: 004029CE, 00402A4F
WS_FTP, xrefs: 00402945
Arial, xrefs: 004028EE
H, xrefs: 004028BA
Arial, xrefs: 0040299B

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Object$Select$Rect$CreateDefaultDeleteFontIndirectLangSystemTextlstrcpy$ClientItemLocalModePaintPalette$AllocBeginExtentFreeInvalidateLoadLockMetricsPoint32RealizeResourceStringValidatewsprintf
String ID: Arial$Arial$Arial$File Transfer Client$H$Redistribution Not Permitted$WS_FTP$by John A. Junod$for Windows 95 and Windows NT
API String ID: 3244805615-2750852661
Opcode ID: f7e0b65c63411d13e41a150b1a8ad75316ebaea120cf2a491ed0ff57a0b43807
Instruction ID: a63c96d08175b440fc66b48f95dfee8792f23bd6b1a2e38f989b8e4338bb7585
Opcode Fuzzy Hash: f7e0b65c63411d13e41a150b1a8ad75316ebaea120cf2a491ed0ff57a0b43807
Instruction Fuzzy Hash: 64B1E9B1E00218EFDB00DFE8DD49FDEB7B9BB08305F044425F619EB295D6B8A9448B58

Function 00407D10 Relevance: 58.1, APIs: 30, Strings: 3, Instructions: 311windowCOMMON

Download Yara Rule

APIs

PrintDlgA.COMDLG32(00000042), ref: 00407D7A
SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 00407D9E

Strings

Arial, xrefs: 00407DFC
B, xrefs: 00407D56
PRINTDLGBOX, xrefs: 00407EF4

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: MessagePrintSend
String ID: Arial$B$PRINTDLGBOX
API String ID: 1282429637-778315728
Opcode ID: 866afc0d25d58d0436a5d1de29721ece1743e9dadf4320d3f417201a3ef8ac0d
Instruction ID: ddc83824f29d7f70be75272ee3a59284ce05284ade8471d6726e8f81a2fa368e
Opcode Fuzzy Hash: 866afc0d25d58d0436a5d1de29721ece1743e9dadf4320d3f417201a3ef8ac0d
Instruction Fuzzy Hash: 78D1E575A04319DFDB10DF98C948BEDBBB9BF44305F1080AAE549EB290C7789985CF1A

Function 00402219 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,00000973,0000011F), ref: 00402258
CheckDlgButton.USER32(?,00000974,0000011F), ref: 00402270
CheckDlgButton.USER32(?,00000975,0000011F), ref: 00402288
CheckDlgButton.USER32(?,00000976,0000011F), ref: 004022A0
CheckDlgButton.USER32(?,00000977,0000011F), ref: 004022B8
CheckRadioButton.USER32(?,0000073B,0000073C,0000073C), ref: 004022DE
GetDlgItem.USER32(?,00000973), ref: 00402314
EnableWindow.USER32(00000000), ref: 0040231B
GetDlgItem.USER32(?,00000974), ref: 00402336
EnableWindow.USER32(00000000), ref: 0040233D
GetDlgItem.USER32(?,00000975), ref: 00402358
EnableWindow.USER32(00000000), ref: 0040235F
GetDlgItem.USER32(?,00000976), ref: 0040237A
EnableWindow.USER32(00000000), ref: 00402381
GetDlgItem.USER32(?,00000977), ref: 0040239C
EnableWindow.USER32(00000000), ref: 004023A3

Strings

Q#, xrefs: 00402535

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ButtonCheck$EnableItemWindow$Radio
String ID: Q#
API String ID: 2378590362-1075711896
Opcode ID: fe065abb6118fea1bf2be08154b423de4edb50c07082dbc97c509a0cf21cdbf9
Instruction ID: 2180ee9352df77f6be1d752d401f1166791f77e9a47027673d830c97620d17e7
Opcode Fuzzy Hash: fe065abb6118fea1bf2be08154b423de4edb50c07082dbc97c509a0cf21cdbf9
Instruction Fuzzy Hash: F8810D76A54604FBEB009FA4DD4DEDE3BA9EB44341F008425F909DB2E1C6B8D981DB5C

Function 00407888 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 139stringwindowCOMMON

Download Yara Rule

APIs

DdeInitializeA.USER32(00000000,00407385,00000010,00000000), ref: 004078AB
DdeCreateStringHandleA.USER32(00000000,PROGMAN,000003EC), ref: 004078E1
DdeCreateStringHandleA.USER32(00000000,Groups,000003EC), ref: 004078F7
DdeConnect.USER32(00000000,00000000,00000000,00000000), ref: 0040790D
DdeClientTransaction.USER32(00000000,00000000,00000000,?,00000001,000020B0,000003E8,00000000), ref: 00407939
DdeAccessData.USER32(W[@,?), ref: 00407949
DdeUnaccessData.USER32(W[@), ref: 00407986
DdeDisconnect.USER32(00000000), ref: 0040798F
DdeFreeStringHandle.USER32(00000000,00000000), ref: 0040799C
DdeFreeStringHandle.USER32(00000000,?), ref: 004079A9
lstrcmpiA.KERNEL32(00000000,Startup), ref: 004079ED
SendMessageA.USER32(W[@,00000143,00000000,00000000), ref: 00407A0A
DdeUninitialize.USER32(00000000), ref: 00407A19
DdeUninitialize.USER32(00000000), ref: 00407A40

Strings

W[@, xrefs: 00407945, 00407982, 00407948, 00407985
PROGMAN, xrefs: 004078D8
Startup, xrefs: 004079E4
P$A, xrefs: 00407A32
W[@, xrefs: 00407A06, 00407A09
Groups, xrefs: 004078EE

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: HandleString$CreateDataFreeUninitialize$AccessClientConnectDisconnectInitializeMessageSendTransactionUnaccesslstrcmpi
String ID: Groups$P$A$PROGMAN$Startup$W[@$W[@
API String ID: 3748507528-3360646485
Opcode ID: 6a379e55f3096f7bc5b20fb82128b23cff5e8038d355476a5628091bd52abf61
Instruction ID: 078f7c425d5d99baca7a3dcc44c5554cb12f356e8e0193e388e3d1c929574300
Opcode Fuzzy Hash: 6a379e55f3096f7bc5b20fb82128b23cff5e8038d355476a5628091bd52abf61
Instruction Fuzzy Hash: 3051FFB1E04209ABDB00DBE4C945FEF77B8AB08705F14442AF651F72C1D778AA41CB69

Function 0040821E Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 0040824C
SetFocus.USER32(00000000), ref: 00408253
GetStockObject.GDI32(0000000C), ref: 0040825D
SendDlgItemMessageA.USER32(?,000003BA,00000030,00000000), ref: 0040826F
SetDlgItemTextA.USER32(?,0000096C,?), ref: 004082AB
LoadStringA.USER32(00400000,00000050,?,000003E8), ref: 004082EC
wsprintfA.USER32 ref: 00408328
GetDlgItem.USER32(?,000003BA), ref: 00408341
PostMessageA.USER32(?,00000111,00000002,00000000), ref: 00408369

Strings

y, xrefs: 00408472
print, xrefs: 004083A6
P, xrefs: 004082C6
license.wri, xrefs: 004083A1
WS_FTP LE License Agreement, xrefs: 004083C0

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Item$Message$FocusLoadObjectPostSendStockStringTextwsprintf
String ID: P$WS_FTP LE License Agreement$license.wri$print$y
API String ID: 4016294380-3738667631
Opcode ID: e8a9c79fa8777d8e2b81eab887009c3bde93069e01435e2c1b7404ba72cc828c
Instruction ID: 3fd924e1412164d4e03bfeb7b935ba18a425afccdefbdb2d6d96d6e19ab10196
Opcode Fuzzy Hash: e8a9c79fa8777d8e2b81eab887009c3bde93069e01435e2c1b7404ba72cc828c
Instruction Fuzzy Hash: AF5194B1A40209FBDB208B94CD49FEE336DAB44705F00447AFB49EA1C1DBB999818F5D

Function 00402EA4 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 132windowregistryCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,00007F00), ref: 00402F0C
LoadCursorA.USER32(00000000,00007F00), ref: 00402F1F
GetStockObject.GDI32(00000001), ref: 00402F2D
RegisterClassA.USER32(00000003), ref: 00402F50
GetDesktopWindow.USER32 ref: 00402F5A
GetWindowRect.USER32(00000000), ref: 00402F61
CreateWindowExA.USER32(00000008,?,0041058C,02800000,?,?,0000015E,000000FA,00000000,00000000,?,00000000), ref: 00402FA7
ShowWindow.USER32(00000000,00000005), ref: 00402FC0
UpdateWindow.USER32(00000000), ref: 00402FCA
GetTickCount.KERNEL32 ref: 00402FD0
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00402FED
GetTickCount.KERNEL32 ref: 00402FFB
TranslateMessage.USER32(?), ref: 00403011
DispatchMessageA.USER32(?), ref: 0040301E
GetLastError.KERNEL32 ref: 0040302E
wsprintfA.USER32 ref: 00403065
MessageBoxA.USER32(00000000,?,00000000,00000000), ref: 00403078

Strings

WSFTPSPLASH, xrefs: 00402EC3

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Window$Message$CountLoadTick$ClassCreateCursorDesktopDispatchErrorIconLastObjectPeekRectRegisterShowStockTranslateUpdatewsprintf
String ID: WSFTPSPLASH
API String ID: 2755763739-3423754451
Opcode ID: 94f79783320c63f55b2eefc70433c4de44a8279a8d26fd83cc5442d4482c13c2
Instruction ID: c21e5df79018b54be8e2297f7ae679dee0db694e1b14534944ca634262e2accd
Opcode Fuzzy Hash: 94f79783320c63f55b2eefc70433c4de44a8279a8d26fd83cc5442d4482c13c2
Instruction Fuzzy Hash: 53513B75A40608EFEB20DFA0DC49FDE7B79EB44705F1040A6F609EA1C4DBB49A448F59

Function 00405E60 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,00000758,00000000), ref: 00405E94
CheckDlgButton.USER32(?,00000971,00000000), ref: 00405EAC
CheckDlgButton.USER32(?,00000972,00000000), ref: 00405EC4
GetDlgItem.USER32(?,00000758), ref: 00405EDC
EnableWindow.USER32(00000000), ref: 00405EE3
GetDlgItem.USER32(?,00000971), ref: 00405EFB
EnableWindow.USER32(00000000), ref: 00405F02
GetDlgItem.USER32(?,00000972), ref: 00405F28
ShowWindow.USER32(00000000), ref: 00405F2F
GetDlgItem.USER32(?,00000972), ref: 00405F47
EnableWindow.USER32(00000000), ref: 00405F4E

Strings

Q#, xrefs: 00406030

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ItemWindow$ButtonCheckEnable$Show
String ID: Q#
API String ID: 4075633574-1075711896
Opcode ID: 9379d584a9512b38fa9b5f70b86665a59f3de6095f31edde7ead70bcee20a105
Instruction ID: f3744db183ec3d2dc4877af2762711d9bbf5df44940c83a5b9f3e901bd318b26
Opcode Fuzzy Hash: 9379d584a9512b38fa9b5f70b86665a59f3de6095f31edde7ead70bcee20a105
Instruction Fuzzy Hash: 80513376654604FFEB10DFA8DD4DEDA3B69EB44341F108431FA0AEB2A0C67CD9908B59

Function 004084DB Relevance: 29.8, APIs: 6, Strings: 11, Instructions: 56COMMON

Download Yara Rule

APIs

DialogBoxParamA.USER32(00400000,DLG_LICENSE,?,0040821E,00000000), ref: 004084FA
WriteProfileStringA.KERNEL32(WS_FTP,VERSION,2000.02.23), ref: 0040851C
WriteProfileStringA.KERNEL32(WS_FTP,EVAL,00000000), ref: 0040852E
wsprintfA.USER32 ref: 00408564

Strings

VERSION, xrefs: 00408574
WS_FTP, xrefs: 00408517
EVAL, xrefs: 00408586
DLG_LICENSE, xrefs: 004084EF
WS_FTP, xrefs: 00408579
%lu, xrefs: 0040855A
2000.02.23, xrefs: 0040850D
EVAL, xrefs: 00408524
WS_FTP, xrefs: 00408529
WS_FTP, xrefs: 0040858B
VERSION, xrefs: 00408512

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ProfileStringWrite$DialogParamwsprintf
String ID: %lu$2000.02.23$DLG_LICENSE$EVAL$EVAL$VERSION$VERSION$WS_FTP$WS_FTP$WS_FTP$WS_FTP
API String ID: 2056882488-3109447568
Opcode ID: 416aa44f968f99969dcd259455fe42bcca34970ff70eb48c848406d3ad44ad15
Instruction ID: b1cb1d0a511645ab20e30283d0e520cb10f3ee3a7e55beccc468b0f6ab5d047c
Opcode Fuzzy Hash: 416aa44f968f99969dcd259455fe42bcca34970ff70eb48c848406d3ad44ad15
Instruction Fuzzy Hash: AC111F75A80304FBCB10AB94ED0AFDE7BA4D754B46F20C076F641B21E1C6B85684C65E

Function 004060C0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040610D
RegOpenKeyExA.ADVAPI32(?,-00000001,00000000,000F003F,?), ref: 00406148
RegCreateKeyA.ADVAPI32(?,-00000001,?), ref: 00406181
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 004061C1
wsprintfA.USER32 ref: 004061E4
lstrlenA.KERNEL32(?), ref: 004061F6
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 0040620D
RegCloseKey.ADVAPI32(00000000), ref: 00406230
RegCloseKey.ADVAPI32(?), ref: 0040623A

Strings

Ipswitch0, xrefs: 004060D0
RunOnce, xrefs: 00406126
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406103
RunServicesOnce, xrefs: 0040612B
RunOnce, xrefs: 0040615F
RunServicesOnce, xrefs: 00406164

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CloseOpenValue$CreateQuerylstrlenwsprintf
String ID: Ipswitch0$RunOnce$RunOnce$RunServicesOnce$RunServicesOnce$Software\Microsoft\Windows\CurrentVersion
API String ID: 3928020351-2171350881
Opcode ID: 51c995427a2b93bc12ddf6474d8d89fa0ae811931d03f18b8307f96b3de2512e
Instruction ID: 5f339136f7361609a216e0391a3da6880ca4becc8382d6e9ecf0d2de57513354
Opcode Fuzzy Hash: 51c995427a2b93bc12ddf6474d8d89fa0ae811931d03f18b8307f96b3de2512e
Instruction Fuzzy Hash: 2E410075A00209EFDB00DB94D949BEEB7F9EB88305F108029E606E7290D7789A85CB65

Function 004087DC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 134windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(00400000,0000005D,?,000003E8), ref: 0040883F
wsprintfA.USER32 ref: 0040887B
GetDlgItem.USER32(?,000003BA), ref: 00408894
PostMessageA.USER32(?,00000111,00000002,00000000), ref: 004088BC

Strings

prorder.wri, xrefs: 004088E3
print, xrefs: 004088E8
], xrefs: 00408819
WS_FTP Pro Order Form, xrefs: 00408902
m, xrefs: 00408973

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ItemLoadMessagePostStringwsprintf
String ID: WS_FTP Pro Order Form$]$m$print$prorder.wri
API String ID: 1702345966-3373616159
Opcode ID: 892a5219318905f007639180ba37c4c0a668eda0dba1e619834e1e4a1fd6c150
Instruction ID: 6fbe5ddb2a6f17bc06b28cb10e0855ae1ae1f9454c0716fa69eae66d56c42ea2
Opcode Fuzzy Hash: 892a5219318905f007639180ba37c4c0a668eda0dba1e619834e1e4a1fd6c150
Instruction Fuzzy Hash: 2641B3B1A40209EBDB20AB54CD49FEA736CAB44345F10847BF649F61C1DA7C99818F5E

Function 00403706 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 157stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040108E: FormatMessageA.KERNEL32(00000400,?,00000000,00000000,?,00000400,?), ref: 004010B7

SetWindowTextA.USER32(?,?), ref: 0040375C
lstrlenA.KERNEL32(?), ref: 00403766
lstrlenA.KERNEL32(?), ref: 00403781
wsprintfA.USER32 ref: 004037AC
wsprintfA.USER32 ref: 004037CE
wsprintfA.USER32 ref: 004037EC
GetLastError.KERNEL32 ref: 00403899
MessageBoxA.USER32(?,?,?,00000015), ref: 004038EB

Strings

%s%s, xrefs: 004037E0
%s\%s, xrefs: 004037C2
%s%s, xrefs: 004037A0
WFT5DD2.tmp, xrefs: 004037D7, 004037FA

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: wsprintf$Messagelstrlen$ErrorFormatLastTextWindow
String ID: %s%s$%s%s$%s\%s$WFT5DD2.tmp
API String ID: 1180295798-2077468126
Opcode ID: 859293c7e7d0ba2b93b11f6883ceefbfd0e919f29f322e43f9158c334b6e7deb
Instruction ID: b45ecd761a5aaf75a9d57af48d7ad519512da7791cdd2c057f0337c22ae1bc81
Opcode Fuzzy Hash: 859293c7e7d0ba2b93b11f6883ceefbfd0e919f29f322e43f9158c334b6e7deb
Instruction Fuzzy Hash: 9A5120F6900608ABDB10DF98DC49FDF77ACAB08305F0444A6FB19E7182D678DA948F65

Function 00406EB9 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00406ED9
wsprintfA.USER32 ref: 00406F0B
GetOpenFileNameA.COMDLG32(0000004C), ref: 0040701B
lstrcmpA.KERNEL32(?,004116D8,?,0000004C), ref: 00407066
lstrcpyA.KERNEL32(?,?,?,0000004C), ref: 0040707F
lstrcatA.KERNEL32(?,\WS_FTP,?,?,?,?,0000004C), ref: 004070B3

Strings

%s (*.*)|*.*|, xrefs: 00406EFF
d, xrefs: 00406FCE
WS_FTP95.exe, xrefs: 00406FE2
\WS_FTP, xrefs: 004070AA
ws_ftp, xrefs: 00407085
L, xrefs: 00406F72

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: lstrcpy$FileNameOpenlstrcatlstrcmpwsprintf
String ID: %s (*.*)|*.*|$L$WS_FTP95.exe$\WS_FTP$d$ws_ftp
API String ID: 629914147-2021373278
Opcode ID: 283c3c2ed1219be7e2d80d555786c045d7e9edda7c2e6d31011691eaf4d19deb
Instruction ID: c146b2207e1c20b376ff7c1f1a688a972c3acc0b96f6e309ad85206894136b9a
Opcode Fuzzy Hash: 283c3c2ed1219be7e2d80d555786c045d7e9edda7c2e6d31011691eaf4d19deb
Instruction Fuzzy Hash: C65154B5D00219DBDB20EF54DD49BD977B8AB04309F0440A6FA08E7291D379AED4CF59

Function 00403101 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94stringfileCOMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,?,EXE), ref: 0040312A
SizeofResource.KERNEL32(00000000,00000000), ref: 00403145
LoadResource.KERNEL32(00000000,00000000), ref: 00403156
lstrcpyA.KERNEL32(?,00000000), ref: 00403174
lstrlenA.KERNEL32(?), ref: 00403181
lstrcatA.KERNEL32(?,004108DC), ref: 004031A4
lstrcatA.KERNEL32(?,?), ref: 004031B5
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 004031D4
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 004031F9
CloseHandle.KERNEL32(000000FF), ref: 0040321E
FreeResource.KERNEL32(00000000), ref: 00403228

Strings

EXE, xrefs: 00403114

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Resource$Filelstrcat$CloseCreateFindFreeHandleLoadSizeofWritelstrcpylstrlen
String ID: EXE
API String ID: 407728055-4257543290
Opcode ID: 35f85b1499d5de6aa193f5d17235ef093c99cc5f1c4611c153ec7361be0a1282
Instruction ID: 4115bec72df3df7dfe7583e8d77ce5bec2c6fc25b012868bd60fb2ab3583a101
Opcode Fuzzy Hash: 35f85b1499d5de6aa193f5d17235ef093c99cc5f1c4611c153ec7361be0a1282
Instruction Fuzzy Hash: 0031D871900219EFDB10DFE8DC49BDE7BBCAB48302F108565F605E7290D774AA85CBA4

Function 004062F0 Relevance: 19.6, APIs: 13, Instructions: 130windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 00406304
GetClientRect.USER32(?,?), ref: 0040631F
CreateCompatibleDC.GDI32(00000000), ref: 00406329
GetObjectA.GDI32(80050DCC,00000018,?), ref: 0040634E
SelectObject.GDI32(?,80050DCC), ref: 0040635E
BitBlt.GDI32(00000000,0000000A,0000000A,?,?,?,00000000,00000000,00CC0020), ref: 004063C9
SelectObject.GDI32(?,?), ref: 004063D7
GetObjectA.GDI32(2F050DE9,00000018,?), ref: 004063F9
SelectObject.GDI32(?,2F050DE9), ref: 00406409
BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040643F
SelectObject.GDI32(?,?), ref: 0040644D
DeleteDC.GDI32(?), ref: 00406457
EndPaint.USER32(?,?), ref: 00406465

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Object$Select$Paint$BeginClientCompatibleCreateDeleteRect
String ID:
API String ID: 509778671-0
Opcode ID: 17deadf7d14756f97e31e996b5cb585e9af17faf34bd9cec9538f2a19a2ed903
Instruction ID: c82690f7b791b9e454be83a0a63bc5119b9c3ce1e5b74c7fa83b8852168c6db5
Opcode Fuzzy Hash: 17deadf7d14756f97e31e996b5cb585e9af17faf34bd9cec9538f2a19a2ed903
Instruction Fuzzy Hash: 635170B5A00219EFCB40DFE8DD89FDEBBF9BB48341F148065F605E7290D674A9408B64

Function 0040CE40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

LCMapStringA.KERNEL32(00000000,00000100,0040F34C,00000001,00000000,00000000,?,?,?,?,0040EDE0,00000000,00000200,?,00000002,?), ref: 0040CE65
LCMapStringW.KERNEL32(00000000,00000100,0040F350,00000001,00000000,00000000,?,?,?,?,0040EDE0,00000000,00000200,?,00000002,?), ref: 0040CE84
LCMapStringA.KERNEL32(00000200,00000200,00000200,00000000,@,?,?,?,?,?,0040EDE0,00000000,00000200,?,00000002,?), ref: 0040CEE8
MultiByteToWideChar.KERNEL32(?,00000009,00000200,00000000,00000000,00000000,?,?,?,?,0040EDE0,00000000,00000200,?,00000002,?), ref: 0040CF1F
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0040CF5E
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 0040CF78
LCMapStringW.KERNEL32(?,?,00000000,00000000,?,?), ref: 0040CFAD

Strings

@, xrefs: 0040CED2, 0040CEDF

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: @
API String ID: 352835431-216407459
Opcode ID: f7b8106d6216cf57f19ea86a57bf0fa18d394eb7a1711d933e24a5f2fcc60ddf
Instruction ID: cc6315bee66e203b45f1aeba0a1dce30130340aeae1be87f02f30c8e456c162e
Opcode Fuzzy Hash: f7b8106d6216cf57f19ea86a57bf0fa18d394eb7a1711d933e24a5f2fcc60ddf
Instruction Fuzzy Hash: BF51B1B2704301ABE220DB65EC81FAB77ADDBC4755F00063AFA04E72C1D675EC0187AA

Function 004025C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 004025DB
GetClientRect.USER32(?,?), ref: 004025E9
GetDC.USER32(?), ref: 004025F3
SelectPalette.GDI32(?,00000000,00000000), ref: 00402608
RealizePalette.GDI32(?), ref: 00402612
LockResource.KERNEL32(00000000), ref: 0040261E
StretchDIBits.GDI32(?,00000000,00000000,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0040279B
GlobalUnlock.KERNEL32(00000000), ref: 004027AA
ReleaseDC.USER32(?,?), ref: 004027B8
UpdateWindow.USER32(?), ref: 004027CC

Strings

0p)u, xrefs: 0040279B

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: PaletteRect$BitsClientGlobalInvalidateLockRealizeReleaseResourceSelectStretchUnlockUpdateWindow
String ID: 0p)u
API String ID: 1386623887-3786888629
Opcode ID: 6b62533e02111d51aee9e5ec11aa997a9f46aaa1ef7082a2c2fec13cb47aca2f
Instruction ID: e9e2df6d65f761187e35ef4f7a0b2306bac240b842b76d8c6c17b99f644fe0f7
Opcode Fuzzy Hash: 6b62533e02111d51aee9e5ec11aa997a9f46aaa1ef7082a2c2fec13cb47aca2f
Instruction Fuzzy Hash: 5A61B8B5A04605EFCB04DFACD959BEABBF5FB4C301F148029F505EB291E674A940CB58

Function 004070C9 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,00000BC2,00413060), ref: 004070F9
SetDlgItemTextA.USER32(?,000003BA,00412E60), ref: 0040710D

Strings

`.A, xrefs: 00407183
p, xrefs: 00407200
`.A, xrefs: 0040715A

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ItemText
String ID: `.A$`.A$p
API String ID: 3367045223-2593219778
Opcode ID: 0a3573d44fc6e22bb0034da1b4137d3784db28912a0f37d55add9e8cd97ffd30
Instruction ID: f54fafff1c0c32fd9546bbc70bd305f40cf13439d4e6c10fc6f3abed4454d11b
Opcode Fuzzy Hash: 0a3573d44fc6e22bb0034da1b4137d3784db28912a0f37d55add9e8cd97ffd30
Instruction Fuzzy Hash: 80316775B44304F7DB009A94DC4AFDA3A69E704745F108477B605EA2C1D2BCE680879B

Function 0040B7B0 Relevance: 15.2, APIs: 10, Instructions: 172COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0040B7C6
GetEnvironmentStrings.KERNEL32 ref: 0040B7DA
GetEnvironmentStringsW.KERNEL32 ref: 0040B815
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040B855
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040B87C
FreeEnvironmentStringsW.KERNEL32(?), ref: 0040B892
FreeEnvironmentStringsW.KERNEL32(?), ref: 0040B8A3

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 1a265853d79eddf1c2f8f79f256335c02c0be8f753914f7799dc8e5f983baf9b
Instruction ID: ba88a1fc0620916ebb774b9f79f587fecf471607ef8c1d4cfcb5cab06d176aa0
Opcode Fuzzy Hash: 1a265853d79eddf1c2f8f79f256335c02c0be8f753914f7799dc8e5f983baf9b
Instruction Fuzzy Hash: 25412B7B7042095BE7206B65BC457A77798E780372F544037EE05A23D0E77EA80D82ED

Function 00401FE9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 103stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00402009
lstrcatA.KERNEL32(?,%1!u!3), ref: 0040201E
wsprintfA.USER32 ref: 004020B0
wsprintfA.USER32 ref: 0040213A

Strings

%1!u!3, xrefs: 00402012
%02X, xrefs: 004020A4
%02X, xrefs: 0040212E
%s%s, xrefs: 00401FFD

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: wsprintf$lstrcat
String ID: %02X$%02X$%1!u!3$%s%s
API String ID: 2661776893-2746595266
Opcode ID: aacc063e5e71bbb0fea73ecb5e4beb648a12c22b1d43c383a3d42e9e9594e767
Instruction ID: 6c0a9e77cfc7ec90f8eac97dd57c798400b308d86829784d3076b93308c2160e
Opcode Fuzzy Hash: aacc063e5e71bbb0fea73ecb5e4beb648a12c22b1d43c383a3d42e9e9594e767
Instruction Fuzzy Hash: 4741AEB1900218DBCB11CF68CC45BEBB7B8BB09304F1444E6F949E7281D679AA85CF65

Function 0040DE90 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,?,?,0040C0D9,?,Microsoft Visual C++ Runtime Library,00012010,?,?,00000000), ref: 0040DEA2
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040DEBA
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040DECB
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040DED8

Strings

MessageBoxA, xrefs: 0040DEAE
GetActiveWindow, xrefs: 0040DEC5
user32.dll, xrefs: 0040DE9D
GetLastActivePopup, xrefs: 0040DECD

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: ec459311cc5425d001b5661a2daa9caa8202c0d414afc3676858181ef147c74e
Instruction ID: 1ffb3c090d3c3c8265642682e4bd0becb8f368d9400bd7e2bec04d4356f2c443
Opcode Fuzzy Hash: ec459311cc5425d001b5661a2daa9caa8202c0d414afc3676858181ef147c74e
Instruction Fuzzy Hash: E10192756016229BC3219BA5EE44A9B779CEBC87617059037F902E2291D7B8CC188BAC

Function 00407F58 Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

StartPage.GDI32(?), ref: 00408012
EndDoc.GDI32(?), ref: 00408176
EnableWindow.USER32(?,00000001), ref: 0040818F
DestroyWindow.USER32(00000000), ref: 0040819B
LocalFree.KERNEL32(00000000), ref: 004081AF
SelectObject.GDI32(?,?), ref: 004081CA
DeleteObject.GDI32(?), ref: 004081D4
LocalFree.KERNEL32(00000000), ref: 004081DE
DeleteDC.GDI32(?), ref: 004081EB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DeleteFreeLocalObjectWindow$DestroyEnablePageSelectStart
String ID:
API String ID: 540746422-0
Opcode ID: f89d5f9d3788af57bfbcaa858b6322e87946ff99afa9b5723bd6dc4550beb03d
Instruction ID: 704e9fd5f85e17169a1be954737f388d53100f369f302e615e2d2985aeea7e6a
Opcode Fuzzy Hash: f89d5f9d3788af57bfbcaa858b6322e87946ff99afa9b5723bd6dc4550beb03d
Instruction Fuzzy Hash: 85414931904249DBDF20DB98DA48BEDB7B5AF40305F1040BBE485BA2D0CB7C99C6CB1A

Function 00407FA9 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

StartPage.GDI32(?), ref: 00408012
EndDoc.GDI32(?), ref: 00408176
EnableWindow.USER32(?,00000001), ref: 0040818F
DestroyWindow.USER32(00000000), ref: 0040819B
LocalFree.KERNEL32(00000000), ref: 004081AF
SelectObject.GDI32(?,?), ref: 004081CA
DeleteObject.GDI32(?), ref: 004081D4
LocalFree.KERNEL32(00000000), ref: 004081DE
DeleteDC.GDI32(?), ref: 004081EB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DeleteFreeLocalObjectWindow$DestroyEnablePageSelectStart
String ID:
API String ID: 540746422-0
Opcode ID: c3863e46351aa1db74494cc9a15a3da0b37852a28a8ae4e0839acb9831204b36
Instruction ID: b4ffed9f668128aa2374dcf495ac49e43ca418230d6ec9dab3a9604bdbc224ef
Opcode Fuzzy Hash: c3863e46351aa1db74494cc9a15a3da0b37852a28a8ae4e0839acb9831204b36
Instruction Fuzzy Hash: D1313A30904249DBDF109BD8DA4CBDDB7B5AF40306F1040BAE581BA2E0CBBC99C5CB1A

Function 00407FC6 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

StartPage.GDI32(?), ref: 00408012
EndDoc.GDI32(?), ref: 00408176
EnableWindow.USER32(?,00000001), ref: 0040818F
DestroyWindow.USER32(00000000), ref: 0040819B
LocalFree.KERNEL32(00000000), ref: 004081AF
SelectObject.GDI32(?,?), ref: 004081CA
DeleteObject.GDI32(?), ref: 004081D4
LocalFree.KERNEL32(00000000), ref: 004081DE
DeleteDC.GDI32(?), ref: 004081EB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DeleteFreeLocalObjectWindow$DestroyEnablePageSelectStart
String ID:
API String ID: 540746422-0
Opcode ID: 609f3b300f42a410c9af02e3505d817ab539ae93496430203d3a24b7fabe833d
Instruction ID: 0a04f878d458537b958068fd6ac0ef19e030bc57596209ae73e9d0b4df852f42
Opcode Fuzzy Hash: 609f3b300f42a410c9af02e3505d817ab539ae93496430203d3a24b7fabe833d
Instruction Fuzzy Hash: 8B313C71904248DBDF109BD8DA4CBD9B7B4AF40306F1044BAE581AA2E0CBBC89C5CB1A

Function 0040BF40 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 159fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 0040BFBF
GetStdHandle.KERNEL32(000000F4,?,?,00000000), ref: 0040C0F6
WriteFile.KERNEL32(?,?,FFFFFFFE,00000000,00000000,?,?,00000000), ref: 0040C11C

Strings

Runtime Error!Program: , xrefs: 0040C01F
Microsoft Visual C++ Runtime Library, xrefs: 0040C0C8
..., xrefs: 0040C011
<program name unknown>, xrefs: 0040BFC5

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: b7eda74a6f51b2a49ab78f6ae9d5de2887a8fab8377aa50123bb878e17144c40
Instruction ID: a99d1896640747baf5d8c68730bac6acc0053635eac09f64abcb7e58387f7ec8
Opcode Fuzzy Hash: b7eda74a6f51b2a49ab78f6ae9d5de2887a8fab8377aa50123bb878e17144c40
Instruction Fuzzy Hash: 5E41E6366006044BD728CA78AD047AA73C2E7C4330F54473AFE26A76D1DB759D098659

Function 004072C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

DdeCreateStringHandleA.USER32(00000000,PROGMAN,000003EC), ref: 004072EB
DdeConnect.USER32(00000000,00000000,00000000,00000000), ref: 0040730B
lstrlenA.KERNEL32(0040750E), ref: 00407321
DdeClientTransaction.USER32(0040750E,?,00000000,00000000,00000001,00004050,000003E8,?), ref: 00407349
DdeDisconnect.USER32(00000000), ref: 00407366
DdeFreeStringHandle.USER32(00000000,00000000), ref: 00407373

Strings

PROGMAN, xrefs: 004072E2

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: HandleString$ClientConnectCreateDisconnectFreeTransactionlstrlen
String ID: PROGMAN
API String ID: 3433085550-601570409
Opcode ID: c8ce2082f238c815a7deb5e66c9e500d3d27ab9e23e01869fd0a6d1705773e96
Instruction ID: 47fa4f532401b3c35bb8d3d871359993a7bfc977d84bad4f2a52a234123a663f
Opcode Fuzzy Hash: c8ce2082f238c815a7deb5e66c9e500d3d27ab9e23e01869fd0a6d1705773e96
Instruction Fuzzy Hash: EA21EFB5D00208FBDB00DBE8C889FDE77BCAB04305F10446ABA14F72C0C6B8AA84CB54

Function 0040BC20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040BC88
GetFileType.KERNEL32(00000000), ref: 0040BD36
GetStdHandle.KERNEL32(FFFFFFF6), ref: 0040BD9E
GetFileType.KERNEL32(00000000), ref: 0040BDA8
SetHandleCount.KERNEL32(?), ref: 0040BDE5

Strings

@, xrefs: 0040BDCF

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: @
API String ID: 1710529072-2766056989
Opcode ID: 34138e7e39ea4abaa7f02efc31d9fe5d573e29c4c5c8348e54cb574515094cd5
Instruction ID: 8539f5cee9c8c624cad55316d2a729a9339489d1d5949f857a473979aaab81b4
Opcode Fuzzy Hash: 34138e7e39ea4abaa7f02efc31d9fe5d573e29c4c5c8348e54cb574515094cd5
Instruction Fuzzy Hash: 7E5107B19046498BD7219F28DC8479ABBA0EF41324F18827AD469AB3E1D77CD844C7DD

Function 00406D10 Relevance: 10.6, APIs: 7, Instructions: 102windowCOMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,000005E7,00413060), ref: 00406D37
PostMessageA.USER32(?,00000111,00000500,00000000), ref: 00406D4D

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ItemMessagePostText
String ID:
API String ID: 4059469734-0
Opcode ID: 3784e8ded44de77c1bf672bd6dae6eb72893b2aa928b677d78d08176d25a7a54
Instruction ID: f3a8a08e536eff6df53d080976601ca41a4f99d7ff369ae4563570ccac5d5c2b
Opcode Fuzzy Hash: 3784e8ded44de77c1bf672bd6dae6eb72893b2aa928b677d78d08176d25a7a54
Instruction Fuzzy Hash: 0B311375644309FADB249F58CC49BEA77B4AB04741F214432B70BFE1D0C2BC96A1DB99

Function 00403240 Relevance: 10.6, APIs: 7, Instructions: 61stringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000100,?), ref: 00403258
lstrlenA.KERNEL32(?), ref: 00403265
lstrlenA.KERNEL32(?), ref: 00403283
lstrlenA.KERNEL32(?), ref: 004032A1
lstrcatA.KERNEL32(?,004108E0), ref: 004032C7
lstrcpyA.KERNEL32(?,?), ref: 004032FD
lstrcatA.KERNEL32(?,4106BC00), ref: 0040331A

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: lstrlen$lstrcat$PathTemplstrcpy
String ID:
API String ID: 3104176457-0
Opcode ID: 605619c77e57e99bda073deeebef4d2a7e116fc2624203727c78bcc0e96e0887
Instruction ID: 1f683ee9a572019a285dfd59d2cb963964ee1f52b244138bdda21adcc0bd627b
Opcode Fuzzy Hash: 605619c77e57e99bda073deeebef4d2a7e116fc2624203727c78bcc0e96e0887
Instruction Fuzzy Hash: 88215475905528DBCB11DBA4DC48BEEBBBCBB48306F1444F6E949E2141D3789BC98F18

Function 004086AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

StretchDIBits.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00408763
GlobalUnlock.KERNEL32(00000000), ref: 0040876F
FreeResource.KERNEL32(00000000), ref: 0040877B
ReleaseDC.USER32(?,00000000), ref: 00408789
ValidateRect.USER32(?,00000000), ref: 00408795

Strings

0p)u, xrefs: 00408763

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: BitsFreeGlobalRectReleaseResourceStretchUnlockValidate
String ID: 0p)u
API String ID: 2343598975-3786888629
Opcode ID: f100aed82d1eac287a925dca9fdf55fd27f347d7b2da2b22cad72450ee43015d
Instruction ID: 219085e46411850decf3ce5cd3dfc44181f5984dc4bd36103363da56664aeb4e
Opcode Fuzzy Hash: f100aed82d1eac287a925dca9fdf55fd27f347d7b2da2b22cad72450ee43015d
Instruction Fuzzy Hash: 39117AB9A44604EFD700CFACED85FDA77E9E748302F108425F605D72A2D675E9418B18

Function 00403F2B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56windowCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,open,00410B7C,00000000,00410B78,00000001), ref: 00403F72
LoadStringA.USER32(00400000,00002752,?,00000100), ref: 00403F98
wsprintfA.USER32 ref: 00403FD5
MessageBoxA.USER32(?,?,WS_FTP,00000000), ref: 00403FF0

Strings

open, xrefs: 00403F69
WS_FTP, xrefs: 00403FE0

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ExecuteLoadMessageShellStringwsprintf
String ID: WS_FTP$open
API String ID: 3602480490-1079579106
Opcode ID: 839dd6c6a650a4b509de19262e710efc09126d5da1ce479bb626c4ffbd26aae8
Instruction ID: 029dc494fc23ce8e6b3b63f28d21fc001adbe4faf5205ec3b5f47f1d305fb758
Opcode Fuzzy Hash: 839dd6c6a650a4b509de19262e710efc09126d5da1ce479bb626c4ffbd26aae8
Instruction Fuzzy Hash: D7118275900319FBDB10DF94CC89FDA7BBDAB08705F0080A6F618E6181C7B89AC48F58

Function 0040E510 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000000,00000001,0040F34C,00000001,?,?,?,?,00000000,?,00000001,00000000), ref: 0040E536
GetStringTypeW.KERNEL32(00000001,0040F350,00000001,?,?,?,?,00000000,?,00000001,00000000), ref: 0040E551
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00000001,00000000), ref: 0040E59F
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,00000000,?,00000001,00000000), ref: 0040E5D6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00000000,?,00000001,00000000), ref: 0040E602
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0040E618

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 4db3a37180dd3eb978ace99377fd721c312bb6f017f6ea05edfae57cda022ddd
Instruction ID: 514a62f1c49b2fa1921630a7d9d7674577b58157eb1af09816a2bdc9e7d975fd
Opcode Fuzzy Hash: 4db3a37180dd3eb978ace99377fd721c312bb6f017f6ea05edfae57cda022ddd
Instruction Fuzzy Hash: C931D371704200AFE2109B95EC41FBB7798EB88718F04093AF905E7290E679FC1487AA

Function 004033A0 Relevance: 9.1, APIs: 6, Instructions: 83fileCOMMON

Download Yara Rule

APIs

LZOpenFileA.LZ32(?,?,00000000), ref: 00403411
LZOpenFileA.LZ32(?,?,00000000,?,?,00000000), ref: 00403441

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: ba564e7d4127aea1a9b29503b0580c07dcfe96ff05c67109af250954b5fd8da5
Instruction ID: e4a1c085d46a74d26320909c61a811cfb54580113746dbbf2679d0cdced3444f
Opcode Fuzzy Hash: ba564e7d4127aea1a9b29503b0580c07dcfe96ff05c67109af250954b5fd8da5
Instruction Fuzzy Hash: D831217190021CAFCF11DF69CC45BD977BCAB09315F0041EAF558EB282D638AB818F94

Function 00406C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00406C59
GetDesktopWindow.USER32 ref: 00406C75
GetWindowRect.USER32(00000000), ref: 00406C7C
MoveWindow.USER32(?,?,8"@,?,?,00000000,?,?,?,?,?,?,?,?,?,00402238), ref: 00406CFE

Strings

8"@, xrefs: 00406CDE, 00406CEB

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Window$Rect$DesktopMove
String ID: 8"@
API String ID: 2894293738-72837770
Opcode ID: 232b7b7fe6ea4e7423f9ab167c3e36a486582101fc29e071ec1539ced00360e2
Instruction ID: 2d3429b9add670098690ae398574976236d0a143ead4f8e11423920c5ad0f6cb
Opcode Fuzzy Hash: 232b7b7fe6ea4e7423f9ab167c3e36a486582101fc29e071ec1539ced00360e2
Instruction Fuzzy Hash: F3219375A1010AEFDF04CFBCD989AEEBBF9FB48215F048529E905E7254D634EA408B64

Function 00407736 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00407778

Part of subcall function 004072C0: DdeCreateStringHandleA.USER32(00000000,PROGMAN,000003EC), ref: 004072EB
Part of subcall function 004072C0: DdeConnect.USER32(00000000,00000000,00000000,00000000), ref: 0040730B
Part of subcall function 004072C0: lstrlenA.KERNEL32(0040750E), ref: 00407321
Part of subcall function 004072C0: DdeClientTransaction.USER32(0040750E,?,00000000,00000000,00000001,00004050,000003E8,?), ref: 00407349
Part of subcall function 004072C0: DdeDisconnect.USER32(00000000), ref: 00407366
Part of subcall function 004072C0: DdeFreeStringHandle.USER32(00000000,00000000), ref: 00407373

DdeUninitialize.USER32(00000000), ref: 0040779C

Strings

WS_FTP, xrefs: 0040774F
G@P:A, xrefs: 00407754, 00407768, 00407757, 0040776B
[DeleteGroup(%s)], xrefs: 0040776C

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: HandleString$ClientConnectCreateDisconnectFreeTransactionUninitializelstrlenwsprintf
String ID: G@P:A$WS_FTP$[DeleteGroup(%s)]
API String ID: 3185502352-3071203189
Opcode ID: d7d5b77fdac69f6cc83fe3bad8185aade7a40a92ee69a37ce2b438bb19602624
Instruction ID: 4bed21f49ccabbefc97d56dc4c3019854aefef2721394ceb7bda76a9c357b82f
Opcode Fuzzy Hash: d7d5b77fdac69f6cc83fe3bad8185aade7a40a92ee69a37ce2b438bb19602624
Instruction Fuzzy Hash: F7F0C8B5900214A7DB10BB65EC49FC637AC9700349F004476B614D7291E23CE58487A9

Function 00407249 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00413060,?), ref: 0040725B
lstrcpyA.KERNEL32(00412E60,?), ref: 0040726A
DialogBoxParamA.USER32(?,DLG_GETDIR,?,004070C9,00000000), ref: 00407284
lstrcpyA.KERNEL32(?,00412E60), ref: 004072A0

Strings

DLG_GETDIR, xrefs: 0040727B

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: lstrcpy$DialogParam
String ID: DLG_GETDIR
API String ID: 4002069846-2949970309
Opcode ID: a46dc6122e452849c7200da228a7e3872b631631e5a45bb05f219196179eab4f
Instruction ID: 5d96f88d498123023cd395a1ad281dfac594a39a56b9ee2d763c49368237e9d0
Opcode Fuzzy Hash: a46dc6122e452849c7200da228a7e3872b631631e5a45bb05f219196179eab4f
Instruction Fuzzy Hash: BEF0FF75A40218FBD700DFE8ED4AFDE7BB8EB48751F104026F901D7190C274A9848B69

Function 00408B3E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00413060,?), ref: 00408B50
lstrcpyA.KERNEL32(00412E60,?), ref: 00408B5F
DialogBoxParamA.USER32(?,DLG_INPUT,?,Function_00008A40,00000000), ref: 00408B79
lstrcpyA.KERNEL32(?,00412E60), ref: 00408B95

Strings

DLG_INPUT, xrefs: 00408B70

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: lstrcpy$DialogParam
String ID: DLG_INPUT
API String ID: 4002069846-2389665704
Opcode ID: 38762f76040836de7f71b8b3b16a7c978d726e101a33c36d3c63fbf212b3e437
Instruction ID: c0b8730eefe2089751aa89c1c3897f898ba12bea925efec53c15f8a9efd64dce
Opcode Fuzzy Hash: 38762f76040836de7f71b8b3b16a7c978d726e101a33c36d3c63fbf212b3e437
Instruction Fuzzy Hash: 49F0AF75640218FBD700DFA8ED49FDA7BB8EB48751F108426FA01E6290C674AA948B69

Function 0040CA20 Relevance: 7.8, APIs: 5, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60d4b283fa8b140685c8660a6af27a08a98393582f449c09eca73d4dbfba18f
Instruction ID: 5aeb7386d3eab7372f1901a563787a04074faaaac21352f8589fb3bc50923ba3
Opcode Fuzzy Hash: e60d4b283fa8b140685c8660a6af27a08a98393582f449c09eca73d4dbfba18f
Instruction Fuzzy Hash: D4A1FA72604200CAE310DB2CFC853AB77A0AB81335F54073BE964A63E2D77D9949D79B

Function 0040E820 Relevance: 7.7, APIs: 5, Instructions: 240COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000220,?,?,?,?,00000000,?,00000000,?,00412C90,00000000,00412DB4,00000040,?,004099AD), ref: 0040E894

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 4d77e46f870ad4eee7b0565bb2c77ec47607e7c557560d7a2aa2bfaf1ee34e69
Instruction ID: 48f2a47090996d89513b2ba53179a9d152c788e63fab1358e44fb6ccadf9245c
Opcode Fuzzy Hash: 4d77e46f870ad4eee7b0565bb2c77ec47607e7c557560d7a2aa2bfaf1ee34e69
Instruction Fuzzy Hash: E0613B733402045BDB109B5ABC40BABB794F7C1776F540A3BEA40A23D0D63E995DC76A

Function 004035E0 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 004035F2
GetLastError.KERNEL32 ref: 00403605
CreateDirectoryA.KERNEL32(?,00000000), ref: 0040366F
GetLastError.KERNEL32 ref: 004036A7
MessageBoxA.USER32(00000000,?,?,00000010), ref: 004036F3

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CreateDirectoryErrorLast$Message
String ID:
API String ID: 2381442119-0
Opcode ID: c595cbfd49e5a0b239e951a90e2571065bb08722d9624cb56fd4ce531381106a
Instruction ID: f147e1a9ab869e49975179a39bccfb3642d8466fa9d0d3e68045d93a259e78dc
Opcode Fuzzy Hash: c595cbfd49e5a0b239e951a90e2571065bb08722d9624cb56fd4ce531381106a
Instruction Fuzzy Hash: D5314FB5900208FFDB10DFA4DC49BDE7BBCAB18306F0044A6F549A7281D6B55BC4CB65

Function 00405B20 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000965), ref: 00405B4B
SetDlgItemTextA.USER32(?,00000965,00413A50), ref: 00405B68

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Item$Text
String ID:
API String ID: 1601838975-0
Opcode ID: 08229dc55a8aca7b7506af132988b54e7e4d19ec34c3ab115f52498c33258781
Instruction ID: baefc51d0e55afea1a78395299e9a545032da751ba918cc8e2436edb575296df
Opcode Fuzzy Hash: 08229dc55a8aca7b7506af132988b54e7e4d19ec34c3ab115f52498c33258781
Instruction Fuzzy Hash: 0D115175644604FBEB109F98C849BDB7768DB45745F108433BA02BB2C0D1B9E9819F5E

Function 00408A40 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,00000BC2,00413060), ref: 00408A70
SetDlgItemTextA.USER32(?,000003BA,00412E60), ref: 00408A84

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: a601418571e23d01f6546a3de851ae7406a0ea893738c6bb3f322377004b557a
Instruction ID: a8494b8ce8d67d0390c56db9e1f9416f084e7faca3aa8a619dca744cdb4ef2f8
Opcode Fuzzy Hash: a601418571e23d01f6546a3de851ae7406a0ea893738c6bb3f322377004b557a
Instruction Fuzzy Hash: 8F1145B5744208FBDB109B98CE4AFDE7674EB04345F108437B641EA2C0CAB8E5859B5E

Function 00407BD8 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00407BF9
EnableMenuItem.USER32(00000000), ref: 00407C00
GetParent.USER32(?), ref: 00407C20
EnableWindow.USER32(00000000), ref: 00407C27
DestroyWindow.USER32(?), ref: 00407C31

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: EnableMenuWindow$DestroyItemParentSystem
String ID:
API String ID: 1413011598-0
Opcode ID: 6ea07f3a698f66855fd6fdea9e0a43d7ab759e22c5c8cad49d5ffa30fc496c5d
Instruction ID: 28e43c82da88eb0d77e1a04a80c36df64266bafe3d2003a8da91512f4485498c
Opcode Fuzzy Hash: 6ea07f3a698f66855fd6fdea9e0a43d7ab759e22c5c8cad49d5ffa30fc496c5d
Instruction Fuzzy Hash: D3016775A0C204FBEB109FA8DD4DFDA7B68AB44345F108432F602EB2D0C6B9E580D75A

Function 00409660 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?,?,?), ref: 004096CB
GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 004096DD

Strings

:, xrefs: 004096B5
., xrefs: 004096BA

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: CurrentDirectoryFullNamePath
String ID: .$:
API String ID: 2420862269-4202072812
Opcode ID: 0957c085dc6d846c3977b3dad98b3c065f136ac92ff8d13bdd4e31eeca82f3b6
Instruction ID: e9c145d67ecf57654f3f6f1097c7083a87760825626b6e7079ce8eab8ff63a24
Opcode Fuzzy Hash: 0957c085dc6d846c3977b3dad98b3c065f136ac92ff8d13bdd4e31eeca82f3b6
Instruction Fuzzy Hash: 3031F1B63442018BE324CB28E841BEB77D5EBC0354F44493EED80D32D2E6BD994DC6A6

Function 0040E2A0 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040E333
GetLastError.KERNEL32 ref: 0040E33D

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 7a0f7c288ef8232c95e871063bc716807f070020ab83a52b4ea19bdfcaf201e0
Instruction ID: 5f0fa87c05154c4a0ad7d1c3b52c4cbc7f137325f1c1272b765a8b34ac25fcc5
Opcode Fuzzy Hash: 7a0f7c288ef8232c95e871063bc716807f070020ab83a52b4ea19bdfcaf201e0
Instruction Fuzzy Hash: BE7112706083818FD720CF29D8447AABBD0AF81324F58496BE894973E2D37CD859CB5B

Function 00407520 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040767A
wsprintfA.USER32 ref: 004076B3

Strings

[AddItem("%s","%s",,,,,%s)], xrefs: 004076A7
[DeleteItem("%s")], xrefs: 0040766E

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: wsprintf
String ID: [AddItem("%s","%s",,,,,%s)]$[DeleteItem("%s")]
API String ID: 2111968516-1022342587
Opcode ID: c2a574ce4cd0ed9ca31cb88fb9c8601ec8ea4500154d0e8f8e94d78954fa737d
Instruction ID: 0a378a6d5ba89b566c62370b102a4ab9f6d8293d9e11d580a742a697c3edc40a
Opcode Fuzzy Hash: c2a574ce4cd0ed9ca31cb88fb9c8601ec8ea4500154d0e8f8e94d78954fa737d
Instruction Fuzzy Hash: 704185B6D00218ABCB10DF64DC85EDA33AC9B14345F0444B7FA49E7281E639EB84CB65

Function 00407B56 Relevance: 6.0, APIs: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00407B70
SendMessageA.USER32(00000000,0000000E,00000000,00000000), ref: 00407B9B
SendMessageA.USER32(00000000,000000B1,?,?), ref: 00407BB5
SendMessageA.USER32(00000000,000000C2,00000000,?), ref: 00407BCD

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: 168b189ad32b49376ed876055be928609ccca7b8a4bf6fcf7fbc78f3f2c9934e
Instruction ID: adc191d792fbb935d880431208752fa1ce8fdfc19e35e2f95068d89bcd2dd8eb
Opcode Fuzzy Hash: 168b189ad32b49376ed876055be928609ccca7b8a4bf6fcf7fbc78f3f2c9934e
Instruction Fuzzy Hash: 6301F4B5A00208FBEB10DF94DC49FDE77BCEB44745F108461BB09EB181D674EA448BA5

Function 00407C7D Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00407C9F
IsDialogMessageA.USER32(00000000,?), ref: 00407CC4
TranslateMessage.USER32(?), ref: 00407CD6
DispatchMessageA.USER32(?), ref: 00407CE0

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 828a95049949d1e81e90df1b984d936887855c5d6d12cfbe4ba3716805861f1f
Instruction ID: 89da36b6c07d2bfef1e012b455bc53dc6e945cb9608e9ca69301cd7857373b29
Opcode Fuzzy Hash: 828a95049949d1e81e90df1b984d936887855c5d6d12cfbe4ba3716805861f1f
Instruction Fuzzy Hash: 3601FFB1E0C209EAEB10ABA4EC49FE7776DBB40745F108432A601E11D0D77CA545D76A

Function 004034D5 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004034EA
IsDialogMessageA.USER32(00000000,?), ref: 0040350F
TranslateMessage.USER32(?), ref: 00403521
DispatchMessageA.USER32(?), ref: 0040352B

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 55a25bff51ada454a4a6c33e2680b6f506e9ffaabfa4f002dd955a5c1c9c78b4
Instruction ID: 6b1a62db69ded8486f455de7b28f768663142c3d2bc36f820e632d5b0a417cda
Opcode Fuzzy Hash: 55a25bff51ada454a4a6c33e2680b6f506e9ffaabfa4f002dd955a5c1c9c78b4
Instruction Fuzzy Hash: 06F01D72A00209FBDB109BA5AC49FEB7BAE9780746F508036F201E60E4E678D5458B2D

Function 00401000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00400000,?,0000273B,00000000), ref: 0040102F
wsprintfA.USER32 ref: 0040104D

Strings

%u DEBUG - Unable to load string, xrefs: 00401041

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: LoadStringwsprintf
String ID: %u DEBUG - Unable to load string
API String ID: 104907563-2889721916
Opcode ID: f6ef7403e169275a9386566625940d9c2bfa81a19b92dc43be4b0c2e92cbd491
Instruction ID: 36e22fd1533719a5dd052d596b9bacd3a86f0f77aa0c6a2930f2b08d4bce87d5
Opcode Fuzzy Hash: f6ef7403e169275a9386566625940d9c2bfa81a19b92dc43be4b0c2e92cbd491
Instruction Fuzzy Hash: 1D015E75604148EFCB00EE98EC44FEB37ECBB48344F008436F999D7250D638D9948BA5

Function 004077BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

DdeInitializeA.USER32(0041329C,00000000,00000010,00000000), ref: 004077E9
wsprintfA.USER32 ref: 00407817

Strings

[CreateGroup(%s)], xrefs: 0040780B

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: Initializewsprintf
String ID: [CreateGroup(%s)]
API String ID: 1732171167-1026996935
Opcode ID: cbd129e154290ecd0829113dfd2a4013204256ba18d2220915a0e691fe11e447
Instruction ID: bafd85f7f6af00c3b4dc71afe8dc4a11df51c4194ce1148af8674bb07da65984
Opcode Fuzzy Hash: cbd129e154290ecd0829113dfd2a4013204256ba18d2220915a0e691fe11e447
Instruction Fuzzy Hash: D2F0AFB5A04224ABD710BB58FC4EFD63BAC9704349F008076BA04E71D1D2B9E584CBAA

Function 00409790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 004097BE

Strings

\, xrefs: 004097A9
:, xrefs: 004097A4

Memory Dump Source

Source File: 00000002.00000002.1903864814.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1903849291.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903880866.000000000040F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000410000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903895489.0000000000415000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903957792.0000000000416000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000417000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1903974295.0000000000426000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_SFS5D75.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 29fe5de7842d006cf34979e8decc33015f719c8fb271513b456ab2d2861ceef1
Instruction ID: 4b99833ff3da754e2bfaf8fe1eadcca4019a0bac2f963a5af54d9eca75909fd0
Opcode Fuzzy Hash: 29fe5de7842d006cf34979e8decc33015f719c8fb271513b456ab2d2861ceef1
Instruction Fuzzy Hash: E6E065A55083809BF7018A38950574B7AD46B91744F8C847AE489C6352F27ED80CC357

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ws_ftp le 508.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\SFS5D46.tmp

C:\Users\user\Desktop\SFS5D75.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: ws_ftp le 508.exePID: 6704, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
ws_ftp le 508.exe

Function 004014D6 Relevance: 66.8, APIs: 31, Strings: 7, Instructions: 256
stringlibraryloaderCOMMON

Function 00401000 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 102
registrystringCOMMON

Function 00401342 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139
fileCOMMON

Function 00401842 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Function 004011BB Relevance: 9.1, APIs: 6, Instructions: 60
fileCOMMON

Function 004012CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
fileCOMMON

Function 00401248 Relevance: 7.6, APIs: 6, Instructions: 59
stringCOMMON

Function 004064E3 Relevance: 51.0, APIs: 23, Strings: 6, Instructions: 298
windowstringregistryCOMMON

Function 00406A45 Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 122
stringwindowCOMMON

Function 00403AAF Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 191
COMMON

Function 00405C60 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 105
COMMON

Function 0040D140 Relevance: 13.8, APIs: 9, Instructions: 307
COMMON

Function 00403931 Relevance: 10.6, APIs: 7, Instructions: 96
COMMON

Function 0040EC20 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48
COMMON

Function 00403D71 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105
COMMON

Function 00403FFB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Function 004099D0 Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Function 0040AD70 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 00405E17 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
COMMON

Function 00404116 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Function 00409150 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 0040BE00 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON