Play interactive tour

Edit tour

Analysis Report 001982_Invoice_confirmation.exe

Overview

General Information

Sample Name:	001982_Invoice_confirmation.exe
Analysis ID:	337597
MD5:	e0167e6a13fea0d69a43e377fba75af4
SHA1:	03b36796e30e11ebae69edf59fc135fdb6c69233
SHA256:	f67020d5de462a963aeeaae1afe2bba3ba629da38a85a035a9389c454a402d0a
Tags:	exeGuLoader
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Potential malicious icon found

Yara detected GuLoader

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

001982_Invoice_confirmation.exe (PID: 7120 cmdline: 'C:\Users\user\Desktop\001982_Invoice_confirmation.exe' MD5: E0167E6A13FEA0D69A43E377FBA75AF4)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 001982_Invoice_confirmation.exe PID: 7120	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: 001982_Invoice_confirmation.exe PID: 7120	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: 001982_Invoice_confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: 001982_Invoice_confirmation.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: 001982_Invoice_confirmation.exe

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Code function: 0_2_00401600

0_2_00401600

Source: 001982_Invoice_confirmation.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRaala.exe vs 001982_Invoice_confirmation.exe
Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1427161222.0000000002090000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 001982_Invoice_confirmation.exe
Source: 001982_Invoice_confirmation.exe	Binary or memory string: OriginalFilenameRaala.exe vs 001982_Invoice_confirmation.exe

Source: 001982_Invoice_confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal76.rans.troj.evad.winEXE@1/0@0/0

Source: 001982_Invoice_confirmation.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: 001982_Invoice_confirmation.exe PID: 7120, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: 001982_Invoice_confirmation.exe PID: 7120, type: MEMORY

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Code function: 0_2_0040597E push AAA4CA0Bh; retf

0_2_004059C0

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

RDTSC instruction interceptor: First address: 000000000040433A second address: 000000000040433A instructions: 0x00000000 rdtsc 0x00000002 wait 0x00000003 nop 0x00000004 dec esi 0x00000005 nop 0x00000006 nop 0x00000007 cmp esi, 00000000h 0x0000000a jne 00007FCAB4A39366h 0x0000000c rdtsc

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Code function: 0_2_004F1060 rdtsc

0_2_004F1060

Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe

Code function: 0_2_004F1060 rdtsc

0_2_004F1060

Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F1C6F mov eax, dword ptr fs:[00000030h]	0_2_004F1C6F
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F1C6D mov eax, dword ptr fs:[00000030h]	0_2_004F1C6D
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F4CC8 mov eax, dword ptr fs:[00000030h]	0_2_004F4CC8
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F516B mov eax, dword ptr fs:[00000030h]	0_2_004F516B
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F2D97 mov eax, dword ptr fs:[00000030h]	0_2_004F2D97
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F164F mov eax, dword ptr fs:[00000030h]	0_2_004F164F
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F1ED7 mov eax, dword ptr fs:[00000030h]	0_2_004F1ED7
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F1ED1 mov eax, dword ptr fs:[00000030h]	0_2_004F1ED1
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F5AEA mov eax, dword ptr fs:[00000030h]	0_2_004F5AEA
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F5AE0 mov eax, dword ptr fs:[00000030h]	0_2_004F5AE0
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F5B46 mov eax, dword ptr fs:[00000030h]	0_2_004F5B46
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F5B06 mov eax, dword ptr fs:[00000030h]	0_2_004F5B06
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F1F00 mov eax, dword ptr fs:[00000030h]	0_2_004F1F00
Source: C:\Users\user\Desktop\001982_Invoice_confirmation.exe	Code function: 0_2_004F5B27 mov eax, dword ptr fs:[00000030h]	0_2_004F5B27

Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426938215.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426938215.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426938215.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: 001982_Invoice_confirmation.exe, 00000000.00000002.1426938215.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Process Injection1	OS Credential Dumping	Security Software Discovery211	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	System Information Discovery11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	337597
Start date:	08.01.2021
Start time:	20:08:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	001982_Invoice_confirmation.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10% (good quality ratio 4.2%) Quality average: 26.6% Quality standard deviation: 33%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.801454519311096
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	001982_Invoice_confirmation.exe
File size:	90112
MD5:	e0167e6a13fea0d69a43e377fba75af4
SHA1:	03b36796e30e11ebae69edf59fc135fdb6c69233
SHA256:	f67020d5de462a963aeeaae1afe2bba3ba629da38a85a035a9389c454a402d0a
SHA512:	7bf1c10dbeb8dbc8388219eeef61b43143d0e385f292a03590e3b60c69d1fbc0e7de94b245e3235d74e304c5131ff10c5ec61d7abd6d961f4dc64b2b39785344
SSDEEP:	1536:z+XxmD5xOJi1Hz9EH9WFaqW/k2Vu48dL:zCyzgo5Exuv
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W...K...W...u...W...q...W..Rich.W..........................PE..L...;.._.................0...0...............@....@

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401600
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5FF88E3B [Fri Jan 8 16:54:19 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	690ed9eee3aab240a93936dee17050b4

Entrypoint Preview

Instruction
push 00401C68h
call 00007FCAB4906215h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov bl, B7h
and edx, dword ptr [edi+481470A7h]
scasd
out E2h, al
into
loop 00007FCAB49061EAh
cli
sbb dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+54h], dl
inc ecx
inc ecx
dec esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
sbb dword ptr [D26DBC53h], edi
inc esi
jc 00007FCAB4906268h
mov fs, di
lahf
cmp dword ptr [ecx-7C98128Dh], edx
and dword ptr [4615E840h], edi
wait
lea edx, dword ptr [esi-7745B4A3h]
idiv byte ptr [edx]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cli
add eax, dword ptr [eax]
add byte ptr [edx+00h], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [ebx+74h], dl
popad
je 00007FCAB490628Bh
outsd
add byte ptr [44000701h], cl
insb
je 00007FCAB4906294h
popad
xor al, 00h
sbb dword ptr [ecx], eax
add byte ptr [edx+00h], al
and al, byte ptr [00000724h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x139d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x894	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x184	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12fb8	0x13000	False	0.415989925987	data	6.26715450621	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0x14b0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x894	0x1000	False	0.159423828125	data	1.84292323273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x16764	0x130	data
RT_ICON	0x1647c	0x2e8	data
RT_ICON	0x16354	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x16324	0x30	data
RT_VERSION	0x16150	0x1d4	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaHresultCheck, __vbaVarMove, __vbaFreeVar, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaExitProc, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaR4Str, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaDateVar, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarDup, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaUI1Str, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
ProductVersion	1.00
InternalName	Raala
FileVersion	1.00
OriginalFilename	Raala.exe
ProductName	Logaritm

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: 001982_Invoice_confirmation.exe PID: 7120 Parent PID: 5936

General

Start time:	20:09:39
Start date:	08/01/2021
Path:	C:\Users\user\Desktop\001982_Invoice_confirmation.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\001982_Invoice_confirmation.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	E0167E6A13FEA0D69A43E377FBA75AF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 001982_Invoice_confirmation.exe PID: 7120 Parent PID: 5936 001982_Invoice_confirmation.exeCOMMON

Executed Functions

Function 00401600, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 526COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401605

Strings

VB5!6&*, xrefs: 00401600

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: b7d35993496275f4d602764f95d5a0f1f6b8ac3607594358e1391e5f2de0108f
Instruction ID: 4cf55085aaa6abaf20537c19c98e9e236523d258bfb0b803a4356d04494bd7c0
Opcode Fuzzy Hash: b7d35993496275f4d602764f95d5a0f1f6b8ac3607594358e1391e5f2de0108f
Instruction Fuzzy Hash: 3402AB7284E3C18FC7138B709DA56957FB1AE2332571E05DBD8C08B1A3E26C8A5AD717

Uniqueness

Uniqueness Score: -1.00%

Function 004111AE, Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 233
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004111AE(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				char _v36;
				void* _v40;
				char* _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				char _v104;
				char* _v112;
				char _v120;
				char _v172;
				short _v176;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				short _v192;
				intOrPtr* _v204;
				signed int _v208;
				signed int _v212;
				signed int _t102;
				signed int _t107;
				char* _t111;
				short _t115;
				signed int _t124;
				short _t130;
				void* _t154;
				void* _t156;
				intOrPtr _t157;
				char* _t167;

				_t157 = _t156 - 0xc;
				 *[fs:0x0] = _t157;
				L004013C0();
				_v16 = _t157;
				_v12 = 0x401308;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t154);
				if( *0x4145f8 != 0) {
					_v204 = 0x4145f8;
				} else {
					_push(0x4145f8);
					_push(0x4028e4);
					L00401558();
					_v204 = 0x4145f8;
				}
				_v176 =  *_v204;
				_t102 =  *((intOrPtr*)( *_v176 + 0x14))(_v176,  &_v40);
				asm("fclex");
				_v180 = _t102;
				if(_v180 >= 0) {
					_v208 = _v208 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4028d4);
					_push(_v176);
					_push(_v180);
					L00401552();
					_v208 = _t102;
				}
				_v184 = _v40;
				_t107 =  *((intOrPtr*)( *_v184 + 0x100))(_v184,  &_v172);
				asm("fclex");
				_v188 = _t107;
				if(_v188 >= 0) {
					_v212 = _v212 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x4028f4);
					_push(_v184);
					_push(_v188);
					L00401552();
					_v212 = _t107;
				}
				_v192 =  ~(0 | _v172 == 0x00400000);
				L0040152E();
				_t111 = _v192;
				if(_t111 != 0) {
					_push(0x402908);
					_push(0x402910);
					L004015AC();
					_v48 = _t111;
					_v56 = 8;
					_push( &_v56);
					_push( &_v72);
					L0040151C();
					_v112 = 0x402910;
					_v120 = 0x8008;
					_push( &_v72);
					_t115 =  &_v120;
					_push(_t115);
					L004015DC();
					_v176 = _t115;
					_push( &_v72);
					_push( &_v56);
					_push(2);
					L004015BE();
					_t111 = _v176;
					if(_t111 != 0) {
						_push(2);
						_push(0x4026bc);
						_push(0x4026c4);
						L004015AC();
						L004015B2();
						_push(_t111);
						_push(0x4026cc);
						L004015AC();
						L004015B2();
						_push(_t111);
						_push(0x4026cc);
						_push(0);
						L00401516();
						asm("sbb eax, eax");
						_v176 =  ~( ~(_t111 - 3) + 1);
						_push( &_v36);
						_push( &_v32);
						_push(2);
						L004015A6();
						_t111 = _v176;
						_t167 = _t111;
						if(_t167 != 0) {
							L00401510();
							L004015A0();
							asm("fcomp qword [0x401250]");
							asm("fnstsw ax");
							asm("sahf");
							if(_t167 == 0) {
								_v112 = 0x80020004;
								_v120 = 0xa;
								_t124 = 0x10;
								L004013C0();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_push(L"oliemalinger");
								_push(L"stourness");
								_push(L"Sgsmaalsgrunds7"); // executed
								L0040157C(); // executed
								L004015B2();
								_push(_t124);
								_push(0);
								L00401582();
								asm("sbb eax, eax");
								_v176 =  ~( ~_t124 + 1);
								L004015C4();
								_t111 = _v176;
								if(_t111 != 0) {
									_push(0x402ab8);
									L00401576();
									if(_t111 == 1) {
										_push( &_v56);
										L00401570();
										_v112 = L"prnumerant";
										_v120 = 0x8008;
										_push( &_v56);
										_t130 =  &_v120;
										_push(_t130);
										L004015DC();
										_v176 = _t130;
										L0040156A();
										_t111 = _v176;
										if(_t111 != 0) {
											_v96 = 0x80020004;
											_v104 = 0xa;
											_v80 = 0x80020004;
											_v88 = 0xa;
											_v64 = 0x80020004;
											_v72 = 0xa;
											_v112 = L"Topforhandlernes";
											_v120 = 8;
											L0040158E();
											_push( &_v104);
											_push( &_v88);
											_push( &_v72);
											_push(0);
											_push( &_v56);
											L00401564();
											_push( &_v104);
											_push( &_v88);
											_push( &_v72);
											_t111 =  &_v56;
											_push(_t111);
											_push(4);
											L004015BE();
										}
									}
								}
							}
						}
					}
				}
				asm("wait");
				_push(0x41156b);
				return _t111;
			}

0x004111b1
0x004111c0
0x004111cc
0x004111d4
0x004111d7
0x004111de
0x004111ed
0x004111f7
0x00411214
0x004111f9
0x004111f9
0x004111fe
0x00411203
0x00411208
0x00411208
0x00411226
0x0041123e
0x00411241
0x00411243
0x00411250
0x00411272
0x00411252
0x00411252
0x00411254
0x00411259
0x0041125f
0x00411265
0x0041126a
0x0041126a
0x0041127c
0x00411297
0x0041129d
0x0041129f
0x004112ac
0x004112d1
0x004112ae
0x004112ae
0x004112b3
0x004112b8
0x004112be
0x004112c4
0x004112c9
0x004112c9
0x004112e9
0x004112f3
0x004112f8
0x00411301
0x00411307
0x0041130c
0x00411311
0x00411316
0x00411319
0x00411323
0x00411327
0x00411328
0x0041132d
0x00411334
0x0041133e
0x0041133f
0x00411342
0x00411343
0x00411348
0x00411352
0x00411356
0x00411357
0x00411359
0x00411361
0x0041136a
0x00411370
0x00411372
0x00411377
0x0041137c
0x00411386
0x0041138b
0x0041138c
0x00411391
0x0041139b
0x004113a0
0x004113a1
0x004113a6
0x004113a8
0x004113b2
0x004113b7
0x004113c1
0x004113c5
0x004113c6
0x004113c8
0x004113d0
0x004113d7
0x004113d9
0x004113e5
0x004113ea
0x004113ef
0x004113f5
0x004113f7
0x004113f8
0x004113fe
0x00411405
0x0041140e
0x0041140f
0x00411419
0x0041141a
0x0041141b
0x0041141c
0x0041141d
0x00411422
0x00411427
0x0041142c
0x00411436
0x0041143b
0x0041143c
0x0041143e
0x00411445
0x0041144a
0x00411454
0x00411459
0x00411462
0x00411468
0x0041146d
0x00411475
0x0041147e
0x0041147f
0x00411484
0x0041148b
0x00411495
0x00411496
0x00411499
0x0041149a
0x0041149f
0x004114a9
0x004114ae
0x004114b7
0x004114b9
0x004114c0
0x004114c7
0x004114ce
0x004114d5
0x004114dc
0x004114e3
0x004114ea
0x004114f7
0x004114ff
0x00411503
0x00411507
0x00411508
0x0041150d
0x0041150e
0x00411516
0x0041151a
0x0041151e
0x0041151f
0x00411522
0x00411523
0x00411525
0x0041152a
0x004114b7
0x00411475
0x00411462
0x004113f8
0x004113d9
0x0041136a
0x0041152d
0x0041152e
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004111CC
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,?,?,004013C6), ref: 00411203
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 00411265
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000100), ref: 004112C4
__vbaFreeObj.MSVBVM60 ref: 004112F3
__vbaStrCat.MSVBVM60(00402910,00402908), ref: 00411311
#522.MSVBVM60(?,00000008,00402910,00402908), ref: 00411328
__vbaVarTstEq.MSVBVM60(00008008,?,?,00000008,00402910,00402908), ref: 00411343
__vbaFreeVarList.MSVBVM60(00000002,00000008,?,00008008,?,?,00000008,00402910,00402908), ref: 00411359
__vbaStrCat.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0041137C
__vbaStrMove.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 00411386
__vbaStrCat.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 00411391
__vbaStrMove.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0041139B
__vbaInStr.MSVBVM60(00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004113A8
__vbaFreeStrList.MSVBVM60(00000002,00000002,004026BC,00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004113C8
__vbaFPInt.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 004113E5
__vbaFpR8.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 004113EA
__vbaChkstk.MSVBVM60 ref: 0041140F
#689.MSVBVM60(Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041142C
__vbaStrMove.MSVBVM60(Sgsmaalsgrunds7,stourness,oliemalinger), ref: 00411436
__vbaStrCmp.MSVBVM60(00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041143E
__vbaFreeStr.MSVBVM60(00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 00411454
__vbaLenBstr.MSVBVM60(00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041146D
#670.MSVBVM60(?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041147F
__vbaVarTstEq.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041149A
__vbaFreeVar.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004114A9
__vbaVarDup.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004114F7
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A,00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041150E
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A,00008008,?,?,00402AB8,00000000,00000000), ref: 00411525

Strings

prnumerant, xrefs: 00411484
stourness, xrefs: 00411422
Topforhandlernes, xrefs: 004114E3
oliemalinger, xrefs: 0041141D
Sgsmaalsgrunds7, xrefs: 00411427

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ListMove$CheckChkstkHresult$#522#595#670#689BstrNew2
String ID: Sgsmaalsgrunds7$Topforhandlernes$oliemalinger$prnumerant$stourness
API String ID: 1585906448-2475824071
Opcode ID: 531f2af8a486367a48dce64500ca154ff6a0e465dfa6d71e140b385e6779d00e
Instruction ID: 31284393ca8cf76a902cbbba73c49a5c0e072b0fd5f0e774116d822f8a32e783
Opcode Fuzzy Hash: 531f2af8a486367a48dce64500ca154ff6a0e465dfa6d71e140b385e6779d00e
Instruction Fuzzy Hash: F7914F71940218EADB10EBA1CD45FDEB7B9AF44704F1041BBE106BB1E1DB789A84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD54, Relevance: 56.2, APIs: 28, Strings: 4, Instructions: 215
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040FD54(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				intOrPtr _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				char* _v116;
				char _v124;
				void* _v160;
				signed int _v164;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				intOrPtr _t84;
				short _t88;
				char* _t91;
				signed int _t98;
				short _t104;
				char* _t108;
				signed int _t112;
				void* _t139;
				void* _t141;
				intOrPtr _t142;
				char* _t147;

				_t142 = _t141 - 0xc;
				 *[fs:0x0] = _t142;
				L004013C0();
				_v16 = _t142;
				_v12 = 0x401260;
				_v8 = 0;
				_t84 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t139);
				_push(0x402908);
				_push(0x402910);
				L004015AC();
				_v52 = _t84;
				_v60 = 8;
				_push( &_v60);
				_push( &_v76);
				L0040151C();
				_v116 = 0x402910;
				_v124 = 0x8008;
				_push( &_v76);
				_t88 =  &_v124;
				_push(_t88);
				L004015DC();
				_v160 = _t88;
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L004015BE();
				_t91 = _v160;
				if(_t91 != 0) {
					_push(2);
					_push(0x4026bc);
					_push(0x4026c4);
					L004015AC();
					L004015B2();
					_push(_t91);
					_push(0x4026cc);
					L004015AC();
					L004015B2();
					_push(_t91);
					_push(0x4026cc);
					_push(0);
					L00401516();
					asm("sbb eax, eax");
					_v160 =  ~( ~(_t91 - 3) + 1);
					_push( &_v40);
					_push( &_v36);
					_push(2);
					L004015A6();
					_t91 = _v160;
					_t147 = _t91;
					if(_t147 != 0) {
						L00401510();
						L004015A0();
						asm("fcomp qword [0x401250]");
						asm("fnstsw ax");
						asm("sahf");
						if(_t147 == 0) {
							_v116 = 0x80020004;
							_v124 = 0xa;
							_t98 = 0x10;
							L004013C0();
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_push(L"HABITABLE");
							_push(L"Stengun2");
							_push(L"misbrugere"); // executed
							L0040157C(); // executed
							L004015B2();
							_push(_t98);
							_push(0);
							L00401582();
							asm("sbb eax, eax");
							_v160 =  ~( ~_t98 + 1);
							L004015C4();
							_t91 = _v160;
							if(_t91 != 0) {
								_push(0x402964);
								L00401576();
								if(_t91 == 1) {
									_push( &_v60);
									L00401570();
									_v116 = L"Dizaine";
									_v124 = 0x8008;
									_push( &_v60);
									_t104 =  &_v124;
									_push(_t104);
									L004015DC();
									_v160 = _t104;
									L0040156A();
									_t91 = _v160;
									if(_t91 != 0) {
										_v100 = 0x80020004;
										_v108 = 0xa;
										_v84 = 0x80020004;
										_v92 = 0xa;
										_v68 = 0x80020004;
										_v76 = 0xa;
										if( *0x414010 != 0) {
											_v180 = 0x414010;
										} else {
											_push(0x414010);
											_push(0x4030f8);
											L00401558();
											_v180 = 0x414010;
										}
										_t108 =  &_v44;
										L0040155E();
										_v160 = _t108;
										_t112 =  *((intOrPtr*)( *_v160 + 0x48))(_v160,  &_v36, _t108,  *((intOrPtr*)( *((intOrPtr*)( *_v180)) + 0x35c))( *_v180));
										asm("fclex");
										_v164 = _t112;
										if(_v164 >= 0) {
											_v184 = _v184 & 0x00000000;
										} else {
											_push(0x48);
											_push(0x40275c);
											_push(_v160);
											_push(_v164);
											L00401552();
											_v184 = _t112;
										}
										_v176 = _v36;
										_v36 = _v36 & 0x00000000;
										_v52 = _v176;
										_v60 = 8;
										_push( &_v108);
										_push( &_v92);
										_push( &_v76);
										_push(0);
										_push( &_v60);
										L00401564();
										L0040152E();
										_push( &_v108);
										_push( &_v92);
										_push( &_v76);
										_t91 =  &_v60;
										_push(_t91);
										_push(4);
										L004015BE();
									}
								}
							}
						}
					}
				}
				asm("wait");
				_push(0x4100ae);
				return _t91;
			}

0x0040fd57
0x0040fd66
0x0040fd72
0x0040fd7a
0x0040fd7d
0x0040fd84
0x0040fd93
0x0040fd96
0x0040fd9b
0x0040fda0
0x0040fda5
0x0040fda8
0x0040fdb2
0x0040fdb6
0x0040fdb7
0x0040fdbc
0x0040fdc3
0x0040fdcd
0x0040fdce
0x0040fdd1
0x0040fdd2
0x0040fdd7
0x0040fde1
0x0040fde5
0x0040fde6
0x0040fde8
0x0040fdf0
0x0040fdf9
0x0040fdff
0x0040fe01
0x0040fe06
0x0040fe0b
0x0040fe15
0x0040fe1a
0x0040fe1b
0x0040fe20
0x0040fe2a
0x0040fe2f
0x0040fe30
0x0040fe35
0x0040fe37
0x0040fe41
0x0040fe46
0x0040fe50
0x0040fe54
0x0040fe55
0x0040fe57
0x0040fe5f
0x0040fe66
0x0040fe68
0x0040fe74
0x0040fe79
0x0040fe7e
0x0040fe84
0x0040fe86
0x0040fe87
0x0040fe8d
0x0040fe94
0x0040fe9d
0x0040fe9e
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feab
0x0040feac
0x0040feb1
0x0040feb6
0x0040febb
0x0040fec5
0x0040feca
0x0040fecb
0x0040fecd
0x0040fed4
0x0040fed9
0x0040fee3
0x0040fee8
0x0040fef1
0x0040fef7
0x0040fefc
0x0040ff04
0x0040ff0d
0x0040ff0e
0x0040ff13
0x0040ff1a
0x0040ff24
0x0040ff25
0x0040ff28
0x0040ff29
0x0040ff2e
0x0040ff38
0x0040ff3d
0x0040ff46
0x0040ff4c
0x0040ff53
0x0040ff5a
0x0040ff61
0x0040ff68
0x0040ff6f
0x0040ff7d
0x0040ff9a
0x0040ff7f
0x0040ff7f
0x0040ff84
0x0040ff89
0x0040ff8e
0x0040ff8e
0x0040ffbe
0x0040ffc2
0x0040ffc7
0x0040ffdf
0x0040ffe2
0x0040ffe4
0x0040fff1
0x00410013
0x0040fff3
0x0040fff3
0x0040fff5
0x0040fffa
0x00410000
0x00410006
0x0041000b
0x0041000b
0x0041001d
0x00410023
0x0041002d
0x00410030
0x0041003a
0x0041003e
0x00410042
0x00410043
0x00410048
0x00410049
0x00410051
0x00410059
0x0041005d
0x00410061
0x00410062
0x00410065
0x00410066
0x00410068
0x0041006d
0x0040ff46
0x0040ff04
0x0040fef1
0x0040fe87
0x0040fe68
0x00410070
0x00410071
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0040FD72
__vbaStrCat.MSVBVM60(00402910,00402908,?,?,?,?,004013C6), ref: 0040FDA0
#522.MSVBVM60(?,00000008), ref: 0040FDB7
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0040FDD2
__vbaFreeVarList.MSVBVM60(00000002,00000008,?,00008008,?), ref: 0040FDE8
__vbaStrCat.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE0B
__vbaStrMove.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE15
__vbaStrCat.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE20
__vbaStrMove.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE2A
__vbaInStr.MSVBVM60(00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE37
__vbaFreeStrList.MSVBVM60(00000002,004026BC,004026C4,00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE57
__vbaFPInt.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE74
__vbaFpR8.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0040FE79
__vbaChkstk.MSVBVM60 ref: 0040FE9E
#689.MSVBVM60(misbrugere,Stengun2,HABITABLE), ref: 0040FEBB
__vbaStrMove.MSVBVM60(misbrugere,Stengun2,HABITABLE), ref: 0040FEC5
__vbaStrCmp.MSVBVM60(00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FECD
__vbaFreeStr.MSVBVM60(00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FEE3
__vbaLenBstr.MSVBVM60(00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FEFC
#670.MSVBVM60(?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FF0E
__vbaVarTstEq.MSVBVM60(00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FF29
__vbaFreeVar.MSVBVM60(00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FF38
__vbaNew2.MSVBVM60(004030F8,00414010,00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FF89
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0040FFC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,00000048,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000,misbrugere), ref: 00410006
#595.MSVBVM60(00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000), ref: 00410049
__vbaFreeObj.MSVBVM60(00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000), ref: 00410051
__vbaFreeVarList.MSVBVM60(00000004,00000008,0000000A,0000000A,0000000A,00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008), ref: 00410068

Strings

Dizaine, xrefs: 0040FF13
misbrugere, xrefs: 0040FEB6
HABITABLE, xrefs: 0040FEAC
Stengun2, xrefs: 0040FEB1

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ListMove$Chkstk$#522#595#670#689BstrCheckHresultNew2
String ID: Dizaine$HABITABLE$Stengun2$misbrugere
API String ID: 3850225901-803909472
Opcode ID: 278a2beeb6a1e41782d8a7672f1d290ccfd0938bfa630a5cabba2131d975c10c
Instruction ID: 7c421ab3a05930befdff4b48723c4b6f0a37a4a9ce7ae853d4d53909da41fa0b
Opcode Fuzzy Hash: 278a2beeb6a1e41782d8a7672f1d290ccfd0938bfa630a5cabba2131d975c10c
Instruction Fuzzy Hash: 38813CB1950218EADB10EFA1CC45BDEBBB8BF44704F10416BF506BB1D1DBB899848F69

Uniqueness

Uniqueness Score: -1.00%

Function 004101B1, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E004101B1(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				char _v52;
				char _v68;
				intOrPtr _v76;
				char _v84;
				short _v104;
				intOrPtr _t29;
				char* _t31;
				short _t33;
				short _t37;
				void* _t47;
				void* _t49;
				intOrPtr _t50;

				_t50 = _t49 - 0xc;
				 *[fs:0x0] = _t50;
				L004013C0();
				_v16 = _t50;
				_v12 = 0x401280;
				_v8 = 0;
				_t29 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x4013c6, _t47);
				L0040154C();
				_push(0x402908);
				_push(0x402980);
				L004015AC();
				L004015B2();
				_push(_t29);
				_push(0x402980);
				L004015AC();
				_v44 = _t29;
				_v52 = 8;
				_push( &_v52);
				_t31 =  &_v68;
				_push(_t31);
				L00401504();
				_push(0x402980);
				_push(0x402980);
				L004015AC();
				_v76 = _t31;
				_v84 = 0x8008;
				_push( &_v68);
				_t33 =  &_v84;
				_push(_t33);
				L004015DC();
				_v104 = _t33;
				L004015C4();
				_push( &_v84);
				_push( &_v68);
				_push( &_v52);
				_push(3);
				L004015BE();
				_t37 = _v104;
				if(_t37 != 0) {
					_push(L"prenominate");
					_push(L"Karseklippet");
					_push(L"Oculus");
					_push(L"unwall"); // executed
					L004014FE(); // executed
				}
				_push(0x4102d3);
				L004015C4();
				return _t37;
			}

0x004101b4
0x004101c3
0x004101cd
0x004101d5
0x004101d8
0x004101df
0x004101ee
0x004101f7
0x004101fc
0x00410201
0x00410206
0x00410210
0x00410215
0x00410216
0x0041021b
0x00410220
0x00410223
0x0041022d
0x0041022e
0x00410231
0x00410232
0x00410237
0x0041023c
0x00410241
0x00410246
0x00410249
0x00410253
0x00410254
0x00410257
0x00410258
0x0041025d
0x00410264
0x0041026c
0x00410270
0x00410274
0x00410275
0x00410277
0x0041027f
0x00410285
0x00410287
0x0041028c
0x00410291
0x00410296
0x0041029b
0x0041029b
0x004102a0
0x004102cd
0x004102d2

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004101CD
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004101F7
__vbaStrCat.MSVBVM60(00402980,00402908,?,?,?,?,004013C6), ref: 00410206
__vbaStrMove.MSVBVM60(00402980,00402908,?,?,?,?,004013C6), ref: 00410210
__vbaStrCat.MSVBVM60(00402980,00000000,00402980,00402908,?,?,?,?,004013C6), ref: 0041021B
#520.MSVBVM60(?,00000008), ref: 00410232
__vbaStrCat.MSVBVM60(00402980,00402980,?,00000008), ref: 00410241
__vbaVarTstEq.MSVBVM60(00008008,00402980), ref: 00410258
__vbaFreeStr.MSVBVM60(00008008,00402980), ref: 00410264
__vbaFreeVarList.MSVBVM60(00000003,00000008,00402980,00008008,00008008,00402980), ref: 00410277
#690.MSVBVM60(unwall,Oculus,Karseklippet,prenominate,?,?,?,004013C6), ref: 0041029B
__vbaFreeStr.MSVBVM60(004102D3,?,?,?,004013C6), ref: 004102CD

Strings

Oculus, xrefs: 00410291
Karseklippet, xrefs: 0041028C
prenominate, xrefs: 00410287
unwall, xrefs: 00410296

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#520#690ChkstkCopyListMove
String ID: Karseklippet$Oculus$prenominate$unwall
API String ID: 1353531886-1380899336
Opcode ID: 219ed9380fe5eeb09bdfd0972244660aa20a558d0836d1a4cf29b007b43818b2
Instruction ID: 498675eeadeb957f38c2004096b09c6973aa91027881f4790ffa6ddbada303db
Opcode Fuzzy Hash: 219ed9380fe5eeb09bdfd0972244660aa20a558d0836d1a4cf29b007b43818b2
Instruction Fuzzy Hash: 0B211CB1A40208BACB00EBD1CD46FDEB7B8BB44704F54403BF405BA1E1DAB899498B58

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004F5AE0, Relevance: 4.3, Strings: 3, Instructions: 591COMMON

Download Yara Rule

Strings

c@, xrefs: 004F24FE
,;, xrefs: 004F2A35
"(, xrefs: 004F28A0

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID: "($,;$c@
API String ID: 0-3051425108
Opcode ID: 8ee476f6185188078e007767d7db69d0ce261e785725fd752fe5df3bea1f44fe
Instruction ID: 8f2dc255f00ef564dec01a63248ba606f0c896d73becc642bed7edf136d90287
Opcode Fuzzy Hash: 8ee476f6185188078e007767d7db69d0ce261e785725fd752fe5df3bea1f44fe
Instruction Fuzzy Hash: 4112277060474DEEEF208E14CD94BBA7691AF12314F64825BEB525B2D5C3BD8882D71F

Uniqueness

Uniqueness Score: -1.00%

Function 004F164F, Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

mcK|, xrefs: 004F1C9D

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID: mcK|
API String ID: 0-3903270498
Opcode ID: 95b3bef8eb4f66ef5b9c7c7268f9f4d2f2118ecd2832fdf87c0ee3a6e9cfe928
Instruction ID: 2924b2d683e61da0dc5371a96f0bf56474fcf2414b51a41a153cdaf728a5b7cb
Opcode Fuzzy Hash: 95b3bef8eb4f66ef5b9c7c7268f9f4d2f2118ecd2832fdf87c0ee3a6e9cfe928
Instruction Fuzzy Hash: 61E1387070470ADFE7149E24CD90BF673A0FF54354F24422BEE9A93261C72CA842DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004F1C6F, Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

mcK|, xrefs: 004F1C9D

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID: mcK|
API String ID: 0-3903270498
Opcode ID: 9101316acf81d0a5bd394c0bb743cec377b918ab689a70c10ef40d36453db9d7
Instruction ID: 3eb4292db9a9e603b604b9504027b198027ed2971a6a00d0fe3d401bc0c5b918
Opcode Fuzzy Hash: 9101316acf81d0a5bd394c0bb743cec377b918ab689a70c10ef40d36453db9d7
Instruction Fuzzy Hash: 91313931644609EFD7549E18CC51BF533A5BF00390F25422BEEA9932A1C72DA846AB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004F1C6D, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

mcK|, xrefs: 004F1C9D

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID: mcK|
API String ID: 0-3903270498
Opcode ID: 2f2144577ac849862355fa0ff604044f04d2f26dcbe1fc45125c5473414e9117
Instruction ID: 2a811f2fedea0d8932389d10a9dc9cf45f0e51d78206044dc65b5432fa99fc9e
Opcode Fuzzy Hash: 2f2144577ac849862355fa0ff604044f04d2f26dcbe1fc45125c5473414e9117
Instruction Fuzzy Hash: 50313B31B4420DEFD7689A18CD41BF533B5BF00350F25422BFE65932A1D72DA8459B4A

Uniqueness

Uniqueness Score: -1.00%

Function 004F5AEA, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27536a792cf4b99aea52cb5ff329a24ae3638ba34d57183e4082b76b371a6b93
Instruction ID: 3825aa258c5fa4939219ef1ffcb2bec9bc28a3c342efce71b516035f7b53433d
Opcode Fuzzy Hash: 27536a792cf4b99aea52cb5ff329a24ae3638ba34d57183e4082b76b371a6b93
Instruction Fuzzy Hash: 6851D830508B8ACECB24CF248594775B6D19F62310F69C29BDB978B2D6C32C8543D71B

Uniqueness

Uniqueness Score: -1.00%

Function 004F5B06, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69f65e967758f5f9e55db55e73ed01743e2bef75fb36ac1be1936ee4795db24
Instruction ID: 0de73251dc6680184257e5e36bb323e9e766176258316cf67b073fb30c140b53
Opcode Fuzzy Hash: d69f65e967758f5f9e55db55e73ed01743e2bef75fb36ac1be1936ee4795db24
Instruction Fuzzy Hash: A351C730908B8ACEDB24CF248594775B6D19F22310F69C29BDB978B2D6D32D8543D71B

Uniqueness

Uniqueness Score: -1.00%

Function 004F5B27, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b46d947df4a07eb37d05304372e208b1ea7a4f491d34f0382ab8ae722b63313
Instruction ID: 0bb2c5225e8a3da86693bc507806893e714a27f43978eefb4deccfd8b152d7fb
Opcode Fuzzy Hash: 1b46d947df4a07eb37d05304372e208b1ea7a4f491d34f0382ab8ae722b63313
Instruction Fuzzy Hash: 6051B830908B89CEDB24CF288594775B6D19F22320F69C29BCB974B2D6D32D8547D61B

Uniqueness

Uniqueness Score: -1.00%

Function 004F5B46, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9a995d5b8141dbe85553cfd50294a1a3c546db13df85976b964090864f7392
Instruction ID: b70b0e96abb546e993c8c2cf42630d2f4ee659ac264abb9e4e453a512376dc5e
Opcode Fuzzy Hash: cb9a995d5b8141dbe85553cfd50294a1a3c546db13df85976b964090864f7392
Instruction Fuzzy Hash: 7151B830908B89CECB248F188594775B6D19F22310F69C29BDB978B2D6D32C8543D71B

Uniqueness

Uniqueness Score: -1.00%

Function 004F1ED1, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4e7e88bb39ba46014dd29ff814dbbaa479ea3dc69a78ff283da4c661992e14
Instruction ID: 3d7f92ed4e25b64e6157a9779696743094cc30cb9db810e51f0905bb83785e39
Opcode Fuzzy Hash: ce4e7e88bb39ba46014dd29ff814dbbaa479ea3dc69a78ff283da4c661992e14
Instruction Fuzzy Hash: A041F73020430CEFEB249E248E94BB96291EF05395F31426BEF52971E1D7AC8982D61B

Uniqueness

Uniqueness Score: -1.00%

Function 004F1ED7, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db7d7b913047c4a643317d3761836bf6d8620b343ec0e0943bf327bbd226e26
Instruction ID: 4ae113641c10018253593ae89c75aaaaeb638fd6cd7ec5d36ed45a1aa80bb348
Opcode Fuzzy Hash: 4db7d7b913047c4a643317d3761836bf6d8620b343ec0e0943bf327bbd226e26
Instruction Fuzzy Hash: 8B21FB3010834CEEEB205E148E54BB56691AF01754F25416BEF436B1E1D7AD8942E61F

Uniqueness

Uniqueness Score: -1.00%

Function 004F1F00, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60317251ef9d0cde6c49ab126f66f25655670c91da8640f6d4cc7d59e310addd
Instruction ID: 8261c33acab292768b08084e2150f050f7b06dbed918f4db4a218b3ff9898e6f
Opcode Fuzzy Hash: 60317251ef9d0cde6c49ab126f66f25655670c91da8640f6d4cc7d59e310addd
Instruction Fuzzy Hash: 6D21063024430CEBEB20AE118E55FB56295AF00754F21826BAF026A0E2D7ADC942E51F

Uniqueness

Uniqueness Score: -1.00%

Function 004F1060, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b0712b1298d96145709bd933d1dd927df37e5f71fc023e06a370498c0ddc0c
Instruction ID: 340117b7063e1a734fff9ebcd3581e0ae5e6b5463975a7ee41055c02eb8eec39
Opcode Fuzzy Hash: 49b0712b1298d96145709bd933d1dd927df37e5f71fc023e06a370498c0ddc0c
Instruction Fuzzy Hash: E7014931504248EBDF3659118E40BFF3A23ABC63A0F25013ABE4523515C67B8A91FA0A

Uniqueness

Uniqueness Score: -1.00%

Function 004F516B, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c43530a17c7aff261b8a74967a6795b1a30be041544965e34da51041bd0051d
Instruction ID: ac4ffc9eba21ac3bb9b318878f8bb4e66d333461a7a3def724b5feb3772f6ba0
Opcode Fuzzy Hash: 3c43530a17c7aff261b8a74967a6795b1a30be041544965e34da51041bd0051d
Instruction Fuzzy Hash: 43F08C30B0AA08CFD724CA08CBC8F7273A1AF14350F224597EF1287211D729FC42DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004F4CC8, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8907f24da5c54f869f27ce7c9471f2530d5cc12c7813d9026715243d6c6f8e29
Instruction ID: 71a1043189d9dfa2c30642903d05da472eeb52dd05ed8b55777255b9406cb7e2
Opcode Fuzzy Hash: 8907f24da5c54f869f27ce7c9471f2530d5cc12c7813d9026715243d6c6f8e29
Instruction Fuzzy Hash: 16C01236246688CFC6598E088190BA233B0BBA1340B922082ED024B655C72CD802E90A

Uniqueness

Uniqueness Score: -1.00%

Function 004F2D97, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426657754.00000000004F0000.00000040.00000001.sdmp, Offset: 004F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f416f750b4a15c70283d2d11e93227f6f15dfe62ed0ca799c5be7985ab7f5a23
Instruction ID: 5890d216365aa49a06dd324f57a9248f07d31a1b92b78dfba9d34bfd956927e5
Opcode Fuzzy Hash: f416f750b4a15c70283d2d11e93227f6f15dfe62ed0ca799c5be7985ab7f5a23
Instruction Fuzzy Hash: 61C092B6241681DFEF86DE08C691F5073B0FB45B88F0804E0E842EB712D328FD01DA01

Uniqueness

Uniqueness Score: -1.00%

Function 0041315A, Relevance: 179.0, APIs: 94, Strings: 8, Instructions: 493
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E0041315A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				signed int _v120;
				char _v128;
				char _v144;
				signed int _v168;
				char _v176;
				char* _v184;
				intOrPtr _v192;
				void* _v212;
				signed int _v216;
				signed int _v220;
				signed int _v228;
				intOrPtr* _v232;
				signed int _v236;
				signed int _t155;
				signed int _t162;
				signed int _t166;
				char* _t169;
				signed int _t184;
				signed int _t188;
				char* _t192;
				signed int _t193;
				signed int _t194;
				intOrPtr _t301;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t301;
				L004013C0();
				_v12 = _t301;
				_v8 = 0x401398;
				_push(0x402a08);
				_push(0x402c58);
				L004015AC();
				L004015B2();
				_push(0xd8);
				_push(0x402a08);
				L004015AC();
				L004015B2();
				_push(0xd8);
				_push(0x402c58);
				L004015AC();
				L004015B2();
				_push(0xd8);
				_push(0x402a08);
				L004015AC();
				L004015B2();
				_push(0xd8);
				_push(0x4026d4);
				L004015AC();
				_v120 = 0xd8;
				_v128 = 8;
				_push( &_v128);
				_push( &_v144);
				L004014AA();
				_v168 = 0xc;
				_v176 = 0x8002;
				_push( &_v144);
				_t155 =  &_v176;
				_push(_t155);
				L004015DC();
				_v216 = _t155;
				_push( &_v48);
				_push( &_v44);
				_push( &_v40);
				_push( &_v36);
				_push(4);
				L004015A6();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L004015BE();
				_t162 = _v216;
				if(_t162 != 0) {
					L004015AC();
					L004015B2();
					L004015AC();
					L004015B2();
					L004015AC();
					L004015B2();
					L004015AC();
					L004015B2();
					L004015AC();
					L004015B2();
					L004015AC();
					_v120 = _t162;
					_v128 = 8;
					_v184 = L"BERUFSVERBOT";
					_v192 = 8;
					_t166 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v112, 0x402a30, _t162, 0x402b2c, _t162, 0x402b24, _t162, 0x402b1c, _t162, 0x402b14, _t162, 0x4026c4, 0x402b0c);
					asm("fclex");
					_v216 = _t166;
					if(_v216 >= 0) {
						_v228 = _v228 & 0x00000000;
					} else {
						_push(0x218);
						_push(0x402434);
						_push(_a4);
						_push(_v216);
						L00401552();
						_v228 = _t166;
					}
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(2);
					_push(L"Add");
					_push(_v112);
					_t169 =  &_v144;
					_push(_t169);
					L00401498();
					_push(_t169);
					L0040149E();
					_push(_t169);
					_push( &_v24);
					L004014A4();
					_push( &_v52);
					_push( &_v48);
					_push( &_v44);
					_push( &_v40);
					_push( &_v36);
					_push(5);
					L004015A6();
					L0040152E();
					_push( &_v144);
					_push( &_v128);
					_push(2);
					L004015BE();
					_v168 = 0x470d;
					_v176 = 2;
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(L"X1");
					_push(_v24);
					L00401492();
					_v168 = 0x878;
					_v176 = 2;
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(L"X2");
					_push(_v24);
					L00401492();
					_v168 = 0x2c0e;
					_v176 = 2;
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(L"Y1");
					_push(_v24);
					L00401492();
					if( *0x414010 != 0) {
						_v232 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x4030f8);
						L00401558();
						_v232 = 0x414010;
					}
					_t184 =  &_v112;
					L0040155E();
					_v216 = _t184;
					_t188 =  *((intOrPtr*)( *_v216 + 0x108))(_v216,  &_v212, _t184,  *((intOrPtr*)( *((intOrPtr*)( *_v232)) + 0x35c))( *_v232));
					asm("fclex");
					_v220 = _t188;
					if(_v220 >= 0) {
						_v236 = _v236 & 0x00000000;
					} else {
						_push(0x108);
						_push(0x40275c);
						_push(_v216);
						_push(_v220);
						L00401552();
						_v236 = _t188;
					}
					_v168 = _v212;
					_v176 = 2;
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(L"Y2");
					_push(_v24);
					L00401492();
					L0040152E();
					_v168 = _v168 | 0xffffffff;
					_v176 = 0xb;
					_push(0x10);
					L004013C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(L"Visible");
					_push(_v24);
					L00401492();
					_v168 = 1;
					_v176 = 0x8002;
					_push(0);
					_push(L"BorderStyle");
					_push(_v24);
					_t192 =  &_v128;
					_push(_t192);
					L00401498();
					_push(_t192);
					_t193 =  &_v176;
					_push(_t193);
					L004015DC();
					_v216 = _t193;
					L0040156A();
					_t162 = _v216;
					if(_t162 != 0) {
						_v120 = 0xe;
						_v128 = 2;
						_t194 =  &_v128;
						_push(_t194);
						L0040148C();
						L004015B2();
						_push(_t194);
						_push(0x402728);
						_push(0x402b94);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402980);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402908);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402b9c);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402ba4);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402908);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402bac);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402980);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402a38);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402b24);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402b2c);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402bb4);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402908);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402bac);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402bbc);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402a00);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402a28);
						L004015AC();
						L004015B2();
						_push(_t194);
						_push(0x402a30);
						L004015AC();
						L004015B2();
						_push(_t194);
						L00401582();
						asm("sbb eax, eax");
						_v216 =  ~( ~_t194 + 1);
						_push( &_v108);
						_push( &_v104);
						_push( &_v100);
						_push( &_v96);
						_push( &_v92);
						_push( &_v88);
						_t134 =  &_v84; // 0x402a30
						_push( &_v80);
						_t136 =  &_v76; // 0x402b2c
						_push( &_v72);
						_t138 =  &_v68; // 0x402b24
						_push( &_v64);
						_push( &_v60);
						_push( &_v56);
						_push( &_v52);
						_push( &_v48);
						_push( &_v44);
						_push( &_v40);
						_push( &_v36);
						_push(0x13);
						L004015A6();
						L0040156A();
						_t162 = _v216;
						if(_t162 != 0) {
							L00401486();
						}
					}
				}
				asm("wait");
				_push(0x41389d);
				L0040152E();
				return _t162;
			}

0x0041315f
0x0041316a
0x0041316b
0x00413177
0x0041317f
0x00413182
0x00413189
0x0041318e
0x00413193
0x0041319d
0x004131a2
0x004131a3
0x004131a8
0x004131b2
0x004131b7
0x004131b8
0x004131bd
0x004131c7
0x004131cc
0x004131cd
0x004131d2
0x004131dc
0x004131e1
0x004131e2
0x004131e7
0x004131ec
0x004131ef
0x004131f9
0x00413200
0x00413201
0x00413206
0x00413210
0x00413220
0x00413221
0x00413227
0x00413228
0x0041322d
0x00413237
0x0041323b
0x0041323f
0x00413243
0x00413244
0x00413246
0x00413254
0x00413258
0x00413259
0x0041325b
0x00413263
0x0041326c
0x0041327c
0x00413286
0x00413291
0x0041329b
0x004132a6
0x004132b0
0x004132bb
0x004132c5
0x004132d0
0x004132da
0x004132e5
0x004132ea
0x004132ed
0x004132f4
0x004132fe
0x00413314
0x0041331a
0x0041331c
0x00413329
0x0041334b
0x0041332b
0x0041332b
0x00413330
0x00413335
0x00413338
0x0041333e
0x00413343
0x00413343
0x00413352
0x00413355
0x0041335f
0x00413360
0x00413361
0x00413362
0x00413363
0x00413366
0x00413373
0x00413374
0x00413375
0x00413376
0x00413377
0x00413379
0x0041337e
0x00413381
0x00413387
0x00413388
0x00413390
0x00413391
0x00413396
0x0041339a
0x0041339b
0x004133a3
0x004133a7
0x004133ab
0x004133af
0x004133b3
0x004133b4
0x004133b6
0x004133c1
0x004133cc
0x004133d0
0x004133d1
0x004133d3
0x004133db
0x004133e5
0x004133ef
0x004133f2
0x004133ff
0x00413400
0x00413401
0x00413402
0x00413403
0x00413408
0x0041340b
0x00413410
0x0041341a
0x00413424
0x00413427
0x00413434
0x00413435
0x00413436
0x00413437
0x00413438
0x0041343d
0x00413440
0x00413445
0x0041344f
0x00413459
0x0041345c
0x00413469
0x0041346a
0x0041346b
0x0041346c
0x0041346d
0x00413472
0x00413475
0x00413481
0x0041349e
0x00413483
0x00413483
0x00413488
0x0041348d
0x00413492
0x00413492
0x004134c2
0x004134c6
0x004134cb
0x004134e6
0x004134ec
0x004134ee
0x004134fb
0x00413520
0x004134fd
0x004134fd
0x00413502
0x00413507
0x0041350d
0x00413513
0x00413518
0x00413518
0x0041352e
0x00413535
0x0041353f
0x00413542
0x0041354f
0x00413550
0x00413551
0x00413552
0x00413553
0x00413558
0x0041355b
0x00413563
0x00413568
0x0041356f
0x00413579
0x0041357c
0x00413589
0x0041358a
0x0041358b
0x0041358c
0x0041358d
0x00413592
0x00413595
0x0041359a
0x004135a4
0x004135ae
0x004135b0
0x004135b5
0x004135b8
0x004135bb
0x004135bc
0x004135c4
0x004135c5
0x004135cb
0x004135cc
0x004135d1
0x004135db
0x004135e0
0x004135e9
0x004135ef
0x004135f6
0x004135fd
0x00413600
0x00413601
0x0041360b
0x00413610
0x00413611
0x00413616
0x0041361b
0x00413625
0x0041362a
0x0041362b
0x00413630
0x0041363a
0x0041363f
0x00413640
0x00413645
0x0041364f
0x00413654
0x00413655
0x0041365a
0x00413664
0x00413669
0x0041366a
0x0041366f
0x00413679
0x0041367e
0x0041367f
0x00413684
0x0041368e
0x00413693
0x00413694
0x00413699
0x004136a3
0x004136a8
0x004136a9
0x004136ae
0x004136b8
0x004136bd
0x004136be
0x004136c3
0x004136cd
0x004136d2
0x004136d3
0x004136d8
0x004136e2
0x004136e7
0x004136e8
0x004136ed
0x004136f7
0x004136fc
0x004136fd
0x00413702
0x0041370c
0x00413711
0x00413712
0x00413717
0x00413721
0x00413726
0x00413727
0x0041372c
0x00413736
0x0041373b
0x0041373c
0x00413741
0x0041374b
0x00413750
0x00413751
0x00413756
0x00413760
0x00413765
0x00413766
0x0041376b
0x00413775
0x0041377a
0x0041377b
0x00413780
0x0041378a
0x0041378f
0x00413790
0x00413797
0x0041379c
0x004137a6
0x004137aa
0x004137ae
0x004137b2
0x004137b6
0x004137ba
0x004137bb
0x004137c2
0x004137c3
0x004137ca
0x004137cb
0x004137d2
0x004137d6
0x004137da
0x004137de
0x004137e2
0x004137e6
0x004137ea
0x004137ee
0x004137ef
0x004137f1
0x004137fc
0x00413801
0x0041380a
0x0041380c
0x0041380c
0x0041380a
0x004135e9
0x00413811
0x00413812
0x00413897
0x0041389c

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 00413177
__vbaStrCat.MSVBVM60(00402C58,00402A08,?,?,?,?,004013C6), ref: 00413193
__vbaStrMove.MSVBVM60(00402C58,00402A08,?,?,?,?,004013C6), ref: 0041319D
__vbaStrCat.MSVBVM60(00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131A8
__vbaStrMove.MSVBVM60(00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131B2
__vbaStrCat.MSVBVM60(00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131BD
__vbaStrMove.MSVBVM60(00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131C7
__vbaStrCat.MSVBVM60(00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131D2
__vbaStrMove.MSVBVM60(00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131DC
__vbaStrCat.MSVBVM60(004026D4,00000000,00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 004131E7
#544.MSVBVM60(?,00000008), ref: 00413201
__vbaVarTstEq.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 00413228
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00008002,?), ref: 00413246
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041325B
__vbaStrCat.MSVBVM60(004026C4,00402B0C), ref: 0041327C
__vbaStrMove.MSVBVM60(004026C4,00402B0C), ref: 00413286
__vbaStrCat.MSVBVM60(00402B14,00000000,004026C4,00402B0C), ref: 00413291
__vbaStrMove.MSVBVM60(00402B14,00000000,004026C4,00402B0C), ref: 0041329B
__vbaStrCat.MSVBVM60(00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132A6
__vbaStrMove.MSVBVM60(00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132B0
__vbaStrCat.MSVBVM60(00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132BB
__vbaStrMove.MSVBVM60(00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132C5
__vbaStrCat.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132D0
__vbaStrMove.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132DA
__vbaStrCat.MSVBVM60(00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 004132E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,00000218), ref: 0041333E
__vbaChkstk.MSVBVM60 ref: 00413355
__vbaChkstk.MSVBVM60 ref: 00413366
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00413388
__vbaObjVar.MSVBVM60(00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413391
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 0041339B
__vbaFreeStrList.MSVBVM60(00000005,?,00402B0C,004026C4,00000000,00402B14,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C), ref: 004133B6
__vbaFreeObj.MSVBVM60(?,?,?,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000), ref: 004133C1
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C), ref: 004133D3
__vbaChkstk.MSVBVM60 ref: 004133F2
__vbaLateMemSt.MSVBVM60(?,00402B54), ref: 0041340B
__vbaChkstk.MSVBVM60(?,00402B54), ref: 00413427
__vbaLateMemSt.MSVBVM60(?,00402B5C,?,00402B54), ref: 00413440
__vbaChkstk.MSVBVM60(?,00402B5C,?,00402B54), ref: 0041345C
__vbaLateMemSt.MSVBVM60(?,00402B64,?,00402B5C,?,00402B54), ref: 00413475
__vbaNew2.MSVBVM60(004030F8,00414010,?,00402B64,?,00402B5C,?,00402B54), ref: 0041348D
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 004134C6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,00000108,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C), ref: 00413513
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 00413542
__vbaLateMemSt.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 0041355B
__vbaFreeObj.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 00413563
__vbaChkstk.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 0041357C
__vbaLateMemSt.MSVBVM60(?,Visible,?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C), ref: 00413595
__vbaLateMemCallLd.MSVBVM60(?,?,BorderStyle,00000000,?,Visible,?,00402B6C), ref: 004135BC
__vbaVarTstEq.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00402A30), ref: 004135CC
__vbaFreeVar.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00402A30), ref: 004135DB
#651.MSVBVM60(00000002,?,00000000), ref: 00413601
__vbaStrMove.MSVBVM60(00000002,?,00000000), ref: 0041360B
__vbaStrCat.MSVBVM60(00402B94,00402728,00000000,00000002,?,00000000), ref: 0041361B
__vbaStrMove.MSVBVM60(00402B94,00402728,00000000,00000002,?,00000000), ref: 00413625
__vbaStrCat.MSVBVM60(00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413630
__vbaStrMove.MSVBVM60(00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041363A
__vbaStrCat.MSVBVM60(00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413645
__vbaStrMove.MSVBVM60(00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041364F
__vbaStrCat.MSVBVM60(00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041365A
__vbaStrMove.MSVBVM60(00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413664
__vbaStrCat.MSVBVM60(00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041366F
__vbaStrMove.MSVBVM60(00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413679
__vbaStrCat.MSVBVM60(00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413684
__vbaStrMove.MSVBVM60(00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041368E
__vbaStrCat.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002), ref: 00413699
__vbaStrMove.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002), ref: 004136A3
__vbaStrCat.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 004136AE
__vbaStrMove.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 004136B8
__vbaStrCat.MSVBVM60(00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000), ref: 004136C3
__vbaStrMove.MSVBVM60(00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000), ref: 004136CD
__vbaStrCat.MSVBVM60(00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000), ref: 004136D8
__vbaStrMove.MSVBVM60(00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000), ref: 004136E2
__vbaStrCat.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000), ref: 004136ED
__vbaStrMove.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000), ref: 004136F7
__vbaStrCat.MSVBVM60(00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000), ref: 00413702
__vbaStrMove.MSVBVM60(00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000), ref: 0041370C
__vbaStrCat.MSVBVM60(00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000), ref: 00413717
__vbaStrMove.MSVBVM60(00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000), ref: 00413721
__vbaStrCat.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000), ref: 0041372C
__vbaStrMove.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000), ref: 00413736
__vbaStrCat.MSVBVM60(00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000), ref: 00413741
__vbaStrMove.MSVBVM60(00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000), ref: 0041374B
__vbaStrCat.MSVBVM60(00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000), ref: 00413756
__vbaStrMove.MSVBVM60(00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000), ref: 00413760
__vbaStrCat.MSVBVM60(00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000), ref: 0041376B
__vbaStrMove.MSVBVM60(00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000), ref: 00413775
__vbaStrCat.MSVBVM60(00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000), ref: 00413780
__vbaStrMove.MSVBVM60(00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000), ref: 0041378A
__vbaStrCmp.MSVBVM60(00000000,00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C), ref: 00413790
__vbaFreeStrList.MSVBVM60(00000013,?,00402B0C,004026C4,00000000,00402B14,00000000,00402B1C,00000000,$+@,00000000,,+@,00000000,0*@,00000000,00000000), ref: 004137F1
__vbaFreeVar.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 004137FC
#554.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 0041380C
__vbaFreeObj.MSVBVM60(0041389D), ref: 00413897

Strings

0*@, xrefs: 0041371E, 004137BB, 004137BE
G, xrefs: 004133DB
Add, xrefs: 00413379
BERUFSVERBOT, xrefs: 004132F4
BorderStyle, xrefs: 004135B0
$+@, xrefs: 004136CA, 004137CB, 004137CE
Visible, xrefs: 0041358D
,+@, xrefs: 004136F4, 004137C3, 004137C6

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$Free$Chkstk$Late$List$CallCheckHresult$#544#554#651AddrefNew2
String ID: G$$+@$,+@$0*@$Add$BERUFSVERBOT$BorderStyle$Visible
API String ID: 2720917139-36511939
Opcode ID: ad1415acbff7fd1880173b69e7534d7d4c3498f55b1e661f53abb2d2b7858af6
Instruction ID: d24d276756a7d1c2e0788f2fb7465a9605d2ae7289fedfd37fb82f57316672f7
Opcode Fuzzy Hash: ad1415acbff7fd1880173b69e7534d7d4c3498f55b1e661f53abb2d2b7858af6
Instruction Fuzzy Hash: C9023071E40208AADB11EFA1CC46FDE7778AF44704F50817BB506BB1E1DAB89A448F69

Uniqueness

Uniqueness Score: -1.00%

Function 00410F05, Relevance: 45.2, APIs: 30, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00410F05(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				long long* _v12;
				long long* _v36;
				char _v48;
				void* _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				char _v88;
				signed int _v92;
				signed int _v96;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _t62;
				signed int _t66;
				char* _t68;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				char* _t93;
				long long* _t110;
				signed int _t111;
				void* _t112;
				signed int _t113;
				long long _t117;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t110;
				_push(0x5c);
				L004013C0();
				_v12 = _t110;
				_v8 = 0x4012f8;
				L0040154C();
				_push(5);
				_push(0x402a40);
				_t62 =  &_v48;
				_push(_t62);
				L004014CE();
				_push(0x402a28);
				_push(0x402a30);
				L004015AC();
				L004015B2();
				_push(_t62);
				_push(0x402a38);
				L004015AC();
				L004015B2();
				L004015C4();
				_push(0);
				_push(0xffffffff);
				_push(1);
				_push(0);
				_push(0x402a30);
				_push(_v60);
				L004014C8();
				L004015B2();
				_push(_v60);
				_push(0x402a28);
				_push(0x402a38);
				L004015AC();
				L004015B2();
				_push(_t62);
				L00401582();
				asm("sbb eax, eax");
				_v92 =  ~( ~_t62 + 1);
				_t93 =  &_v64;
				L004015C4();
				_t66 = _v92;
				_t111 = _t66;
				if(_t111 != 0) {
					asm("fld1");
					L00401432();
					L004015A0();
					asm("fcomp qword [0x4012f0]");
					asm("fnstsw ax");
					asm("sahf");
					if(_t111 == 0) {
						_push(0x402a00);
						L004014C2();
						_t112 = _t66 - 0x61;
						if(_t112 == 0) {
							asm("fld1");
							 *_v36 = __fp0;
							_t117 =  *0x4012e8;
							 *((long long*)(_v36 + 8)) = _t117;
							_v88 =  &_v48;
							_push( &_v88);
							asm("fld1");
							_push(_t93);
							_push(_t93);
							 *_t110 = _t117;
							L004014BC();
							L004015A0();
							asm("fcomp qword [0x4012e0]");
							asm("fnstsw ax");
							asm("sahf");
							if(_t112 == 0) {
								_push(0x402a08);
								L004014EC();
								asm("fcomp dword [0x4012ac]");
								asm("fnstsw ax");
								asm("sahf");
								if(_t112 == 0) {
									_t76 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v88);
									asm("fclex");
									_v92 = _t76;
									_t113 = _v92;
									if(_t113 >= 0) {
										_v104 = _v104 & 0x00000000;
									} else {
										_push(0xb0);
										_push(0x402434);
										_push(_a4);
										_push(_v92);
										L00401552();
										_v104 = _t76;
									}
									asm("fcomp dword [0x4012a8]");
									asm("fnstsw ax");
									asm("sahf");
									if(_t113 == 0) {
										if( *0x414010 != 0) {
											_v108 = 0x414010;
										} else {
											_push(0x414010);
											_push(0x4030f8);
											L00401558();
											_v108 = 0x414010;
										}
										_t80 =  &_v68;
										L0040155E();
										_v92 = _t80;
										_t84 =  *((intOrPtr*)( *_v92 + 0xb8))(_v92,  &_v64, _t80,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x35c))( *_v108));
										asm("fclex");
										_v96 = _t84;
										if(_v96 >= 0) {
											_v112 = _v112 & 0x00000000;
										} else {
											_push(0xb8);
											_push(0x40275c);
											_push(_v92);
											_push(_v96);
											L00401552();
											_v112 = _t84;
										}
										_push(_v64);
										_push(0x60);
										_push(0xffffffff);
										_push(0x20);
										L004014E6();
										L004015C4();
										L0040152E();
									}
								}
							}
						}
					}
				}
				asm("wait");
				_push(0x411191);
				_v88 =  &_v48;
				_t68 =  &_v88;
				_push(_t68);
				_push(0);
				L004014D4();
				L004015C4();
				L004015C4();
				return _t68;
			}

0x00410f0a
0x00410f15
0x00410f16
0x00410f1d
0x00410f20
0x00410f28
0x00410f2b
0x00410f38
0x00410f3d
0x00410f3f
0x00410f44
0x00410f47
0x00410f48
0x00410f4d
0x00410f52
0x00410f57
0x00410f61
0x00410f66
0x00410f67
0x00410f6c
0x00410f76
0x00410f7e
0x00410f83
0x00410f85
0x00410f87
0x00410f89
0x00410f8b
0x00410f90
0x00410f93
0x00410f9d
0x00410fa2
0x00410fa5
0x00410faa
0x00410faf
0x00410fb9
0x00410fbe
0x00410fbf
0x00410fc6
0x00410fcb
0x00410fcf
0x00410fd2
0x00410fd7
0x00410fdb
0x00410fdd
0x00410fe3
0x00410fe5
0x00410fea
0x00410fef
0x00410ff5
0x00410ff7
0x00410ff8
0x00410ffe
0x00411003
0x00411008
0x0041100c
0x00411015
0x00411017
0x0041101c
0x00411022
0x00411028
0x0041102e
0x0041102f
0x00411031
0x00411032
0x00411033
0x00411036
0x0041103b
0x00411040
0x00411046
0x00411048
0x00411049
0x0041104f
0x00411054
0x00411059
0x0041105f
0x00411061
0x00411062
0x00411074
0x0041107a
0x0041107c
0x0041107f
0x00411083
0x0041109f
0x00411085
0x00411085
0x0041108a
0x0041108f
0x00411092
0x00411095
0x0041109a
0x0041109a
0x004110a6
0x004110ac
0x004110ae
0x004110af
0x004110bc
0x004110d6
0x004110be
0x004110be
0x004110c3
0x004110c8
0x004110cd
0x004110cd
0x004110f1
0x004110f5
0x004110fa
0x00411109
0x0041110f
0x00411111
0x00411118
0x00411134
0x0041111a
0x0041111a
0x0041111f
0x00411124
0x00411127
0x0041112a
0x0041112f
0x0041112f
0x00411138
0x0041113b
0x0041113d
0x0041113f
0x00411141
0x00411149
0x00411151
0x00411151
0x004110af
0x00411062
0x00411049
0x0041100c
0x00410ff8
0x00411156
0x00411157
0x00411172
0x00411175
0x00411178
0x00411179
0x0041117b
0x00411183
0x0041118b
0x00411190

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 00410F20
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 00410F38
__vbaAryConstruct2.MSVBVM60(?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F48
__vbaStrCat.MSVBVM60(00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F57
__vbaStrMove.MSVBVM60(00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F61
__vbaStrCat.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F6C
__vbaStrMove.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F76
__vbaFreeStr.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00410F7E
#712.MSVBVM60(?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00410F93
__vbaStrMove.MSVBVM60(?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00410F9D
__vbaStrCat.MSVBVM60(00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00410FAF
__vbaStrMove.MSVBVM60(00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00410FB9
__vbaStrCmp.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00410FBF
__vbaFreeStr.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00410FD2
_CIlog.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00410FE5
__vbaFpR8.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00410FEA
#516.MSVBVM60(00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?), ref: 00411003
#684.MSVBVM60(?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000), ref: 00411036
__vbaFpR8.MSVBVM60(?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000), ref: 0041103B
__vbaR4Str.MSVBVM60(00402A08,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38), ref: 00411054
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,000000B0,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 00411095
__vbaNew2.MSVBVM60(004030F8,00414010,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000), ref: 004110C8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000), ref: 004110F5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040275C,000000B8,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 0041112A
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 00411141
__vbaFreeStr.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 00411149
__vbaFreeObj.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 00411151
__vbaAryDestruct.MSVBVM60(00000000,?,00411191,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 0041117B
__vbaFreeStr.MSVBVM60(00000000,?,00411191,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 00411183
__vbaFreeStr.MSVBVM60(00000000,?,00411191,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 0041118B

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$CheckHresult$#516#684#712ChkstkConstruct2CopyDestructFileIlogNew2Open
String ID:
API String ID: 2720509884-0
Opcode ID: 89a8b8c03987db323ca65b4be2cffbec01b23c2a676d08c49234ce7623bd20d7
Instruction ID: c543f47f5a097055ac7e50f90e3833e32438bfd983de0689a2d5ab2b72709a21
Opcode Fuzzy Hash: 89a8b8c03987db323ca65b4be2cffbec01b23c2a676d08c49234ce7623bd20d7
Instruction Fuzzy Hash: 4B610770A50248BECB10EBE1DD86BDEBBB4AF44704F50413AF116BA1F5DB785985CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00412103, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00412103(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v52;
				char _v60;
				short _v80;
				intOrPtr _t22;
				char* _t23;
				char* _t28;
				intOrPtr _t46;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_t22 = 0x40;
				L004013C0();
				_v12 = _t46;
				_v8 = 0x401348;
				L0040158E();
				L0040154C();
				_push("12-");
				_push(L"12-12");
				L004015AC();
				_v52 = _t22;
				_v60 = 8;
				_t23 =  &_v60;
				_push(_t23);
				L0040147A();
				asm("sbb eax, eax");
				_v80 =  ~( ~(_t23 - 0xffff) + 1);
				L0040156A();
				_t28 = _v80;
				if(_t28 != 0) {
					_v52 = 1;
					_v60 = 2;
					_push(0);
					_t28 =  &_v60;
					_push(_t28);
					L00401474();
					L004015B2();
					L0040156A();
				}
				_push(0x4121dc);
				L0040156A();
				L004015C4();
				L004015C4();
				return _t28;
			}

0x00412108
0x00412113
0x00412114
0x0041211d
0x0041211e
0x00412126
0x00412129
0x00412136
0x00412141
0x00412146
0x0041214b
0x00412150
0x00412155
0x00412158
0x0041215f
0x00412162
0x00412163
0x0041216f
0x00412174
0x0041217b
0x00412180
0x00412186
0x00412188
0x0041218f
0x00412196
0x00412198
0x0041219b
0x0041219c
0x004121a6
0x004121ae
0x004121ae
0x004121b3
0x004121c6
0x004121ce
0x004121d6
0x004121db

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0041211E
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00412136
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 00412141
__vbaStrCat.MSVBVM60(12-12,12-,?,?,?,?,004013C6), ref: 00412150
#557.MSVBVM60(00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 00412163
__vbaFreeVar.MSVBVM60(00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041217B
#705.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041219C
__vbaStrMove.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004121A6
__vbaFreeVar.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004121AE
__vbaFreeVar.MSVBVM60(004121DC,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004121C6
__vbaFreeStr.MSVBVM60(004121DC,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004121CE
__vbaFreeStr.MSVBVM60(004121DC,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004121D6

Strings

12-12, xrefs: 0041214B
12-, xrefs: 00412146

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#557#705ChkstkCopyMove
String ID: 12-$12-12
API String ID: 1093160486-3531647454
Opcode ID: 831d301e61f6806214e3bebf9ebaadffc4dbc5f39d10bdc48ae79f4d0f739302
Instruction ID: 19d9fa852ef73bf2366a2bf146d1713e1c21e88f144a7c43272c69329a1fada1
Opcode Fuzzy Hash: 831d301e61f6806214e3bebf9ebaadffc4dbc5f39d10bdc48ae79f4d0f739302
Instruction Fuzzy Hash: 5D111D71910248BADB04EFA1CD96FEDBBB8AF44708F50453AB402B71E1EB7C6945CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004102FA, Relevance: 22.6, APIs: 15, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E004102FA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v36;
				void* _v52;
				signed int _v56;
				void* _v60;
				char _v76;
				char _v92;
				intOrPtr _v116;
				intOrPtr _v124;
				intOrPtr _v132;
				char _v140;
				void* _v144;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				intOrPtr _v168;
				intOrPtr* _v172;
				signed int _v176;
				signed int _v180;
				short _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				void* _t101;
				void* _t103;
				intOrPtr _t104;

				_t104 = _t103 - 0xc;
				 *[fs:0x0] = _t104;
				L004013C0();
				_v16 = _t104;
				_v12 = 0x401290;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t101);
				L0040158E();
				L0040154C();
				_v116 = 0x4026bc;
				_v124 = 8;
				L0040158E();
				_push( &_v76);
				_push( &_v92);
				L004014F8();
				_v132 = 0x402a00;
				_v140 = 0x8008;
				_push( &_v92);
				_t71 =  &_v140;
				_push(_t71);
				L004015DC();
				_v144 = _t71;
				_push( &_v92);
				_push( &_v76);
				_push(2);
				L004015BE();
				_t74 = _v144;
				if(_t74 != 0) {
					if( *0x4145f8 != 0) {
						_v172 = 0x4145f8;
					} else {
						_push(0x4145f8);
						_push(0x4028e4);
						L00401558();
						_v172 = 0x4145f8;
					}
					_v144 =  *_v172;
					_t80 =  *((intOrPtr*)( *_v144 + 0x14))(_v144,  &_v60);
					asm("fclex");
					_v148 = _t80;
					if(_v148 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4028d4);
						_push(_v144);
						_push(_v148);
						L00401552();
						_v176 = _t80;
					}
					_v152 = _v60;
					_t85 =  *((intOrPtr*)( *_v152 + 0x110))(_v152,  &_v56);
					asm("fclex");
					_v156 = _t85;
					if(_v156 >= 0) {
						_v180 = _v180 & 0x00000000;
					} else {
						_push(0x110);
						_push(0x4028f4);
						_push(_v152);
						_push(_v156);
						L00401552();
						_v180 = _t85;
					}
					_t74 = _v56;
					_v168 = _t74;
					_v56 = _v56 & 0x00000000;
					L004015B2();
					L0040152E();
				}
				_push(0x410510);
				L004015C4();
				L004015C4();
				L0040156A();
				return _t74;
			}

0x004102fd
0x0041030c
0x00410318
0x00410320
0x00410323
0x0041032a
0x00410339
0x00410342
0x0041034d
0x00410352
0x00410359
0x00410366
0x0041036e
0x00410372
0x00410373
0x00410378
0x0041037f
0x0041038c
0x0041038d
0x00410393
0x00410394
0x00410399
0x004103a3
0x004103a7
0x004103a8
0x004103aa
0x004103b2
0x004103bb
0x004103c8
0x004103e5
0x004103ca
0x004103ca
0x004103cf
0x004103d4
0x004103d9
0x004103d9
0x004103f7
0x0041040f
0x00410412
0x00410414
0x00410421
0x00410443
0x00410423
0x00410423
0x00410425
0x0041042a
0x00410430
0x00410436
0x0041043b
0x0041043b
0x0041044d
0x00410465
0x0041046b
0x0041046d
0x0041047a
0x0041049f
0x0041047c
0x0041047c
0x00410481
0x00410486
0x0041048c
0x00410492
0x00410497
0x00410497
0x004104a6
0x004104a9
0x004104af
0x004104bc
0x004104c4
0x004104c4
0x004104c9
0x004104fa
0x00410502
0x0041050a
0x0041050f

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 00410318
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00410342
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 0041034D
__vbaVarDup.MSVBVM60 ref: 00410366
#518.MSVBVM60(?,?), ref: 00410373
__vbaVarTstEq.MSVBVM60(00008008,?,?,?,?,?), ref: 00410394
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 004103AA
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,004013C6), ref: 004103D4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 00410436
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000110), ref: 00410492
__vbaStrMove.MSVBVM60(00000000,?,004028F4,00000110), ref: 004104BC
__vbaFreeObj.MSVBVM60(00000000,?,004028F4,00000110), ref: 004104C4
__vbaFreeStr.MSVBVM60(00410510,?,?,004013C6), ref: 004104FA
__vbaFreeStr.MSVBVM60(00410510,?,?,004013C6), ref: 00410502
__vbaFreeVar.MSVBVM60(00410510,?,?,004013C6), ref: 0041050A

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$#518ChkstkCopyListMoveNew2
String ID:
API String ID: 1459133440-0
Opcode ID: 77b1114697cf1f390cf1521999d1b235816f586f4e1bc89b4dae7a1ca4d10851
Instruction ID: 7b071d0170398bdb0f52a6c3bdfab82a663c86185e70b471678afd905e5abfd0
Opcode Fuzzy Hash: 77b1114697cf1f390cf1521999d1b235816f586f4e1bc89b4dae7a1ca4d10851
Instruction Fuzzy Hash: DD51C971900218EFDB10EFA5CD85FDDB7B5BF44304F1081AAE10ABB1A1DB785A898F55

Uniqueness

Uniqueness Score: -1.00%

Function 004121EF, Relevance: 19.6, APIs: 13, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004121EF(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long long _v32;
				void* _v48;
				char _v52;
				char _v56;
				signed short _v64;
				char _v72;
				char _v88;
				signed char _t26;
				signed short _t27;
				void* _t44;
				void* _t46;
				intOrPtr _t47;

				_t47 = _t46 - 0xc;
				 *[fs:0x0] = _t47;
				L004013C0();
				_v16 = _t47;
				_v12 = 0x401358;
				_v8 = 0;
				_t26 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4013c6, _t44);
				L0040158E();
				_push(0x4026d4);
				L0040146E();
				_t27 = _t26 & 0x000000ff;
				if(_t27 == 2) {
					_push(0x402be0);
					_push(0x402be8);
					L004015AC();
					L004015B2();
					_push(_t27);
					_push(0x402bf0);
					L004015AC();
					L004015B2();
					_push(_t27);
					_push(0x402be0);
					L004015AC();
					_v64 = _t27;
					_v72 = 8;
					_push( &_v72);
					_push( &_v88);
					L00401462();
					_push( &_v88);
					L00401468();
					_v32 = __fp0;
					_push( &_v56);
					_push( &_v52);
					_push(2);
					L004015A6();
					_push( &_v88);
					_t27 =  &_v72;
					_push(_t27);
					_push(2);
					L004015BE();
				}
				asm("wait");
				_push(0x412308);
				L0040156A();
				return _t27;
			}

0x004121f2
0x00412201
0x0041220b
0x00412213
0x00412216
0x0041221d
0x0041222c
0x00412235
0x0041223a
0x0041223f
0x00412244
0x0041224c
0x00412252
0x00412257
0x0041225c
0x00412266
0x0041226b
0x0041226c
0x00412271
0x0041227b
0x00412280
0x00412281
0x00412286
0x0041228b
0x0041228e
0x00412298
0x0041229c
0x0041229d
0x004122a5
0x004122a6
0x004122ab
0x004122b1
0x004122b5
0x004122b6
0x004122b8
0x004122c3
0x004122c4
0x004122c7
0x004122c8
0x004122ca
0x004122cf
0x004122d2
0x004122d3
0x00412302
0x00412307

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0041220B
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00412235
__vbaUI1Str.MSVBVM60(004026D4,?,?,?,?,004013C6), ref: 0041223F
__vbaStrCat.MSVBVM60(00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 0041225C
__vbaStrMove.MSVBVM60(00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 00412266
__vbaStrCat.MSVBVM60(00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 00412271
__vbaStrMove.MSVBVM60(00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 0041227B
__vbaStrCat.MSVBVM60(00402BE0,00000000,00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 00412286
#687.MSVBVM60(?,00000008), ref: 0041229D
__vbaDateVar.MSVBVM60(?,?,00000008), ref: 004122A6
__vbaFreeStrList.MSVBVM60(00000002,00000000,00402BF0,?,?,00000008), ref: 004122B8
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,004013C6), ref: 004122CA
__vbaFreeVar.MSVBVM60(00412308,004026D4,?,?,?,?,004013C6), ref: 00412302

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ListMove$#687ChkstkDate
String ID:
API String ID: 2912548229-0
Opcode ID: d7f98349592ca8207d14ef9a5fd6ad4c3423a6dea65181098cadaaf74a426dd5
Instruction ID: 71f63a4a29832dbfea1c6166c16b8544dfa7b926ef6b2e8f6ace07993221d26e
Opcode Fuzzy Hash: d7f98349592ca8207d14ef9a5fd6ad4c3423a6dea65181098cadaaf74a426dd5
Instruction Fuzzy Hash: 3F21ED71940208BBDB00EFA1CD46EDE7778AB44704F50853BB506BA1E1DABC6A498B69

Uniqueness

Uniqueness Score: -1.00%

Function 004138B8, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E004138B8(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a32, void* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v52;
				char _v72;
				signed int _v76;
				signed int _v88;
				signed int _t29;
				void* _t42;
				void* _t44;
				intOrPtr _t45;
				signed int _t47;

				_t45 = _t44 - 0xc;
				 *[fs:0x0] = _t45;
				L004013C0();
				_v16 = _t45;
				_v12 = 0x4013a8;
				_v8 = 0;
				_t29 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x40,  *[fs:0x0], 0x4013c6, _t42);
				L0040154C();
				L0040158E();
				_push(0x402a08);
				L004014EC();
				asm("fcomp dword [0x4012ac]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags == 0) {
					_t29 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v72);
					asm("fclex");
					_v76 = _t29;
					_t47 = _v76;
					if(_t47 >= 0) {
						_t20 =  &_v88;
						 *_t20 = _v88 & 0x00000000;
						__eflags =  *_t20;
					} else {
						_push(0xb0);
						_push(0x402434);
						_push(_a4);
						_push(_v76);
						L00401552();
						_v88 = _t29;
					}
					asm("fcomp dword [0x4012a8]");
					asm("fnstsw ax");
					asm("sahf");
					if(_t47 == 0) {
						_push(L"GEOSIDE");
						_push(0xb4);
						_push(0xffffffff);
						_push(0x20);
						L004014E6();
					}
				}
				asm("wait");
				_push(0x413996);
				L004015C4();
				L0040156A();
				return _t29;
			}

0x004138bb
0x004138ca
0x004138d4
0x004138dc
0x004138df
0x004138e6
0x004138f5
0x004138fe
0x00413909
0x0041390e
0x00413913
0x00413918
0x0041391e
0x00413920
0x00413921
0x0041392f
0x00413935
0x00413937
0x0041393a
0x0041393e
0x0041395a
0x0041395a
0x0041395a
0x00413940
0x00413940
0x00413945
0x0041394a
0x0041394d
0x00413950
0x00413955
0x00413955
0x00413961
0x00413967
0x00413969
0x0041396a
0x0041396c
0x00413971
0x00413976
0x00413978
0x0041397a
0x0041397a
0x0041396a
0x0041397f
0x00413980
0x00413988
0x00413990
0x00413995

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004138D4
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004138FE
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00413909
__vbaR4Str.MSVBVM60(00402A08,?,?,?,?,004013C6), ref: 00413913
__vbaHresultCheckObj.MSVBVM60(00000000,004013A8,00402434,000000B0), ref: 00413950
__vbaFileOpen.MSVBVM60(00000020,000000FF,000000B4,GEOSIDE), ref: 0041397A
__vbaFreeStr.MSVBVM60(00413996,00402A08,?,?,?,?,004013C6), ref: 00413988
__vbaFreeVar.MSVBVM60(00413996,00402A08,?,?,?,?,004013C6), ref: 00413990

Strings

GEOSIDE, xrefs: 0041396C

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyFileHresultOpen
String ID: GEOSIDE
API String ID: 311016274-2913397203
Opcode ID: d91c5edbe6cdfc2c9134a2def390319fb7a2f5e844100da4869c7c9fc395a074
Instruction ID: 4f1123677368e2c5971f3ce6a628f8902e8d13376f9256586bafcd62c55b588a
Opcode Fuzzy Hash: d91c5edbe6cdfc2c9134a2def390319fb7a2f5e844100da4869c7c9fc395a074
Instruction Fuzzy Hash: 95213870910209FFDB10EF95CA4ABCD7BB4BF44749F50416AF4067A1E1C7B85A858B48

Uniqueness

Uniqueness Score: -1.00%

Function 004100DB, Relevance: 15.0, APIs: 10, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E004100DB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20, void* _a40, void* _a48, signed int* _a64) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				void* _v64;
				void* _v80;
				signed int* _t24;
				void* _t40;
				void* _t42;
				intOrPtr _t43;

				_t43 = _t42 - 0xc;
				 *[fs:0x0] = _t43;
				L004013C0();
				_v16 = _t43;
				_v12 = 0x401270;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x40,  *[fs:0x0], 0x4013c6, _t40);
				L0040158E();
				L0040154C();
				L0040158E();
				_t24 = _a64;
				 *_t24 =  *_t24 & 0x00000000;
				_push(0);
				_push(0);
				_push(1);
				L0040150A();
				L004015B2();
				_push(0x410188);
				L0040156A();
				L004015C4();
				L004015C4();
				L0040156A();
				return _t24;
			}

0x004100de
0x004100ed
0x004100f7
0x004100ff
0x00410102
0x00410109
0x00410118
0x00410121
0x0041012c
0x00410137
0x0041013c
0x0041013f
0x00410142
0x00410144
0x00410146
0x00410148
0x00410152
0x00410157
0x0041016a
0x00410172
0x0041017a
0x00410182
0x00410187

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004100F7
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00410121
__vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 0041012C
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00410137
#706.MSVBVM60(00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410148
__vbaStrMove.MSVBVM60(00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410152
__vbaFreeVar.MSVBVM60(00410188,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 0041016A
__vbaFreeStr.MSVBVM60(00410188,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410172
__vbaFreeStr.MSVBVM60(00410188,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 0041017A
__vbaFreeVar.MSVBVM60(00410188,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410182

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#706ChkstkCopyMove
String ID:
API String ID: 3345532518-0
Opcode ID: a35acc030eb900ea760036b0fa133370889fd2d73e76ff8d2696328a35c1cf6c
Instruction ID: ae18c423bd8e9807c65714946a84572beb13efd59162ca3e506b349bf6b06ce6
Opcode Fuzzy Hash: a35acc030eb900ea760036b0fa133370889fd2d73e76ff8d2696328a35c1cf6c
Instruction Fuzzy Hash: E9110A31900248BBCB14EF61CD52FDD7BB4AF40748F50802AF4027B1E1DB78AA458B98

Uniqueness

Uniqueness Score: -1.00%

Function 00410689, Relevance: 13.6, APIs: 9, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00410689(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _v80;
				char* _t57;
				signed int _t61;
				signed int _t67;
				signed int _t71;
				char* _t73;
				intOrPtr _t84;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t84;
				_push(0x3c);
				L004013C0();
				_v12 = _t84;
				_v8 = 0x4012c0;
				if( *0x414010 != 0) {
					_v64 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x4030f8);
					L00401558();
					_v64 = 0x414010;
				}
				_t57 =  &_v28;
				L0040155E();
				_v36 = _t57;
				_t61 =  *((intOrPtr*)( *_v36 + 0x13c))(_v36,  &_v24, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x35c))( *_v64));
				asm("fclex");
				_v40 = _t61;
				if(_v40 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x13c);
					_push(0x40275c);
					_push(_v36);
					_push(_v40);
					L00401552();
					_v68 = _t61;
				}
				if( *0x4145f8 != 0) {
					_v72 = 0x4145f8;
				} else {
					_push(0x4145f8);
					_push(0x4028e4);
					L00401558();
					_v72 = 0x4145f8;
				}
				_v44 =  *_v72;
				_t67 =  *((intOrPtr*)( *_v44 + 0x14))(_v44,  &_v32);
				asm("fclex");
				_v48 = _t67;
				if(_v48 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4028d4);
					_push(_v44);
					_push(_v48);
					L00401552();
					_v76 = _t67;
				}
				_v52 = _v32;
				_t71 =  *((intOrPtr*)( *_v52 + 0x138))(_v52, _v24, 1);
				asm("fclex");
				_v56 = _t71;
				if(_v56 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x4028f4);
					_push(_v52);
					_push(_v56);
					L00401552();
					_v80 = _t71;
				}
				L004015C4();
				_push( &_v32);
				_t73 =  &_v28;
				_push(_t73);
				_push(2);
				L00401546();
				_push(0x41081d);
				return _t73;
			}

0x0041068e
0x00410699
0x0041069a
0x004106a1
0x004106a4
0x004106ac
0x004106af
0x004106bd
0x004106d7
0x004106bf
0x004106bf
0x004106c4
0x004106c9
0x004106ce
0x004106ce
0x004106f2
0x004106f6
0x004106fb
0x0041070a
0x00410710
0x00410712
0x00410719
0x00410735
0x0041071b
0x0041071b
0x00410720
0x00410725
0x00410728
0x0041072b
0x00410730
0x00410730
0x00410740
0x0041075a
0x00410742
0x00410742
0x00410747
0x0041074c
0x00410751
0x00410751
0x00410766
0x00410775
0x00410778
0x0041077a
0x00410781
0x0041079a
0x00410783
0x00410783
0x00410785
0x0041078a
0x0041078d
0x00410790
0x00410795
0x00410795
0x004107a1
0x004107b1
0x004107b7
0x004107b9
0x004107c0
0x004107dc
0x004107c2
0x004107c2
0x004107c7
0x004107cc
0x004107cf
0x004107d2
0x004107d7
0x004107d7
0x004107e3
0x004107eb
0x004107ec
0x004107ef
0x004107f0
0x004107f2
0x004107fa
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004106A4
__vbaNew2.MSVBVM60(004030F8,00414010,?,?,?,?,004013C6), ref: 004106C9
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 004106F6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,0000013C), ref: 0041072B
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 0041074C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 00410790
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000138), ref: 004107D2
__vbaFreeStr.MSVBVM60 ref: 004107E3
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004107F2

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$ChkstkList
String ID:
API String ID: 3534970231-0
Opcode ID: 2b43084d6aebb6ceba8605820960cb7419c42074414f94e484802e886b496b57
Instruction ID: deca3a3a6570c093d5167b1dd99c32d76f6e2ac81c66748ba98b4f66cbcc21f2
Opcode Fuzzy Hash: 2b43084d6aebb6ceba8605820960cb7419c42074414f94e484802e886b496b57
Instruction Fuzzy Hash: A2410471D00218EFDB00EF95C989BEDBBB4BF48705F10402AF112BA2A0D7B95985DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040FADA, Relevance: 13.6, APIs: 9, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040FADA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a40) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v52;
				short _v56;
				void* _v60;
				void* _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v88;
				signed int _v92;
				signed int _v96;
				signed int _t47;
				signed int _t52;
				short _t53;
				intOrPtr _t67;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t67;
				_push(0x4c);
				L004013C0();
				_v12 = _t67;
				_v8 = 0x401230;
				L0040158E();
				L0040158E();
				if( *0x4145f8 != 0) {
					_v88 = 0x4145f8;
				} else {
					_push(0x4145f8);
					_push(0x4028e4);
					L00401558();
					_v88 = 0x4145f8;
				}
				_v68 =  *_v88;
				_t47 =  *((intOrPtr*)( *_v68 + 0x14))(_v68,  &_v60);
				asm("fclex");
				_v72 = _t47;
				if(_v72 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4028d4);
					_push(_v68);
					_push(_v72);
					L00401552();
					_v92 = _t47;
				}
				_v76 = _v60;
				_t52 =  *((intOrPtr*)( *_v76 + 0xc0))(_v76,  &_v64);
				asm("fclex");
				_v80 = _t52;
				if(_v80 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0xc0);
					_push(0x4028f4);
					_push(_v76);
					_push(_v80);
					L00401552();
					_v96 = _t52;
				}
				_t53 = _v64;
				_v56 = _t53;
				L0040152E();
				_push(0x40fbf4);
				L0040156A();
				L0040156A();
				return _t53;
			}

0x0040fadf
0x0040faea
0x0040faeb
0x0040faf2
0x0040faf5
0x0040fafd
0x0040fb00
0x0040fb0d
0x0040fb18
0x0040fb24
0x0040fb3e
0x0040fb26
0x0040fb26
0x0040fb2b
0x0040fb30
0x0040fb35
0x0040fb35
0x0040fb4a
0x0040fb59
0x0040fb5c
0x0040fb5e
0x0040fb65
0x0040fb7e
0x0040fb67
0x0040fb67
0x0040fb69
0x0040fb6e
0x0040fb71
0x0040fb74
0x0040fb79
0x0040fb79
0x0040fb85
0x0040fb94
0x0040fb9a
0x0040fb9c
0x0040fba3
0x0040fbbf
0x0040fba5
0x0040fba5
0x0040fbaa
0x0040fbaf
0x0040fbb2
0x0040fbb5
0x0040fbba
0x0040fbba
0x0040fbc3
0x0040fbc7
0x0040fbce
0x0040fbd3
0x0040fbe6
0x0040fbee
0x0040fbf3

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0040FAF5
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FB0D
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FB18
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,?,?,004013C6), ref: 0040FB30
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 0040FB74
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000000C0), ref: 0040FBB5
__vbaFreeObj.MSVBVM60(00000000,?,004028F4,000000C0), ref: 0040FBCE
__vbaFreeVar.MSVBVM60(0040FBF4), ref: 0040FBE6
__vbaFreeVar.MSVBVM60(0040FBF4), ref: 0040FBEE

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ChkstkNew2
String ID:
API String ID: 1237124366-0
Opcode ID: 496dd13df7a9289bfce18f4d23b314e9cdb9cd302386eddf8dfcc014b804cb70
Instruction ID: 094d7e770be411cea4a56ebe526614d7a291cb7c35443e33ea5bbf8f1b08a488
Opcode Fuzzy Hash: 496dd13df7a9289bfce18f4d23b314e9cdb9cd302386eddf8dfcc014b804cb70
Instruction Fuzzy Hash: 9231ED71910248EFCB10EF95C956BDDBBB4BF48708F10403AF012BA2A0D778694A9B19

Uniqueness

Uniqueness Score: -1.00%

Function 0041059B, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0041059B(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				signed int _v60;
				signed int _v68;
				signed int _t19;
				intOrPtr _t32;
				signed int _t34;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t32;
				_t19 = 0x30;
				L004013C0();
				_v12 = _t32;
				_v8 = 0x4012b0;
				L0040158E();
				_push(0x402a08);
				L004014EC();
				asm("fcomp dword [0x4012ac]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags == 0) {
					_t19 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v56);
					asm("fclex");
					_v60 = _t19;
					_t34 = _v60;
					if(_t34 >= 0) {
						_t14 =  &_v68;
						 *_t14 = _v68 & 0x00000000;
						__eflags =  *_t14;
					} else {
						_push(0xb0);
						_push(0x402434);
						_push(_a4);
						_push(_v60);
						L00401552();
						_v68 = _t19;
					}
					asm("fcomp dword [0x4012a8]");
					asm("fnstsw ax");
					asm("sahf");
					if(_t34 == 0) {
						_push(L"Wattape2");
						_push(0x8e);
						_push(0xffffffff);
						_push(0x20);
						L004014E6();
					}
				}
				asm("wait");
				_push(0x410653);
				L0040156A();
				return _t19;
			}

0x004105a0
0x004105ab
0x004105ac
0x004105b5
0x004105b6
0x004105be
0x004105c1
0x004105ce
0x004105d3
0x004105d8
0x004105dd
0x004105e3
0x004105e5
0x004105e6
0x004105f4
0x004105fa
0x004105fc
0x004105ff
0x00410603
0x0041061f
0x0041061f
0x0041061f
0x00410605
0x00410605
0x0041060a
0x0041060f
0x00410612
0x00410615
0x0041061a
0x0041061a
0x00410626
0x0041062c
0x0041062e
0x0041062f
0x00410631
0x00410636
0x0041063b
0x0041063d
0x0041063f
0x0041063f
0x0041062f
0x00410644
0x00410645
0x0041064d
0x00410652

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004105B6
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004105CE
__vbaR4Str.MSVBVM60(00402A08,?,?,?,?,004013C6), ref: 004105D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,000000B0,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 00410615
__vbaFileOpen.MSVBVM60(00000020,000000FF,0000008E,Wattape2), ref: 0041063F
__vbaFreeVar.MSVBVM60(00410653,00402A08,?,?,?,?,004013C6), ref: 0041064D

Strings

Wattape2, xrefs: 00410631

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFileFreeHresultOpen
String ID: Wattape2
API String ID: 2751570938-2362924395
Opcode ID: 24b97f99b3b62958337d5d413b1545838b8f3a85084dfd7af00fbdab1dde2b29
Instruction ID: af5480e6378b2e6668a90a28c8ad3d61d7cd40ae016f22ec4b7b35f953cc2af1
Opcode Fuzzy Hash: 24b97f99b3b62958337d5d413b1545838b8f3a85084dfd7af00fbdab1dde2b29
Instruction Fuzzy Hash: C2116670900208FFCB10EF91CE8ABCD7BB8FB54B54F10422AF005BA1E1C7B819908B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC07, Relevance: 10.6, APIs: 7, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040FC07(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v36;
				void* _v52;
				void* _v56;
				void* _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v88;
				signed int _v92;
				signed int _v96;
				signed int _t45;
				signed int _t46;
				signed int _t52;
				signed int _t57;
				void* _t65;
				void* _t67;
				intOrPtr _t68;

				_t68 = _t67 - 0xc;
				 *[fs:0x0] = _t68;
				L004013C0();
				_v16 = _t68;
				_v12 = 0x401240;
				_v8 = 0;
				_t45 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4013c6, _t65);
				L0040158E();
				_t46 = _t45 | 0xffffffff;
				if(_t46 != 0) {
					if( *0x4145f8 != 0) {
						_v88 = 0x4145f8;
					} else {
						_push(0x4145f8);
						_push(0x4028e4);
						L00401558();
						_v88 = 0x4145f8;
					}
					_v64 =  *_v88;
					_t52 =  *((intOrPtr*)( *_v64 + 0x14))(_v64,  &_v56);
					asm("fclex");
					_v68 = _t52;
					if(_v68 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4028d4);
						_push(_v64);
						_push(_v68);
						L00401552();
						_v92 = _t52;
					}
					_v72 = _v56;
					_t57 =  *((intOrPtr*)( *_v72 + 0xb8))(_v72,  &_v60);
					asm("fclex");
					_v76 = _t57;
					if(_v76 >= 0) {
						_v96 = _v96 & 0x00000000;
					} else {
						_push(0xb8);
						_push(0x4028f4);
						_push(_v72);
						_push(_v76);
						L00401552();
						_v96 = _t57;
					}
					_t46 = _v60;
					_v36 = _t46;
					L0040152E();
				}
				asm("wait");
				_push(0x40fd2d);
				L0040156A();
				return _t46;
			}

0x0040fc0a
0x0040fc19
0x0040fc23
0x0040fc2b
0x0040fc2e
0x0040fc35
0x0040fc44
0x0040fc4d
0x0040fc52
0x0040fc57
0x0040fc64
0x0040fc7e
0x0040fc66
0x0040fc66
0x0040fc6b
0x0040fc70
0x0040fc75
0x0040fc75
0x0040fc8a
0x0040fc99
0x0040fc9c
0x0040fc9e
0x0040fca5
0x0040fcbe
0x0040fca7
0x0040fca7
0x0040fca9
0x0040fcae
0x0040fcb1
0x0040fcb4
0x0040fcb9
0x0040fcb9
0x0040fcc5
0x0040fcd4
0x0040fcda
0x0040fcdc
0x0040fce3
0x0040fcff
0x0040fce5
0x0040fce5
0x0040fcea
0x0040fcef
0x0040fcf2
0x0040fcf5
0x0040fcfa
0x0040fcfa
0x0040fd03
0x0040fd07
0x0040fd0e
0x0040fd0e
0x0040fd13
0x0040fd14
0x0040fd27
0x0040fd2c

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0040FC23
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FC4D
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,?,?,004013C6), ref: 0040FC70
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 0040FCB4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000000B8), ref: 0040FCF5
__vbaFreeObj.MSVBVM60 ref: 0040FD0E
__vbaFreeVar.MSVBVM60(0040FD2D,?,?,?,?,004013C6), ref: 0040FD27

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2
String ID:
API String ID: 304406766-0
Opcode ID: 051ed9be5659fa8b4c6be47d883d9802fc822d1c3304a7adcc752f71f2ca7647
Instruction ID: c7625abd0a2577b8f0a182237d5f5f9e59eb42bc9d38ba0c1856450940d577c9
Opcode Fuzzy Hash: 051ed9be5659fa8b4c6be47d883d9802fc822d1c3304a7adcc752f71f2ca7647
Instruction Fuzzy Hash: F331F475900248EFDB10EF95C946BCDBBB5BF04704F20413AF412BB2A0D7785949DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00413039, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00413039(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				signed int _v64;
				signed int _t45;
				signed int _t49;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t57 = _t56 - 0xc;
				 *[fs:0x0] = _t57;
				L004013C0();
				_v16 = _t57;
				_v12 = 0x401388;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4013c6, _t54);
				if( *0x4145f8 != 0) {
					_v56 = 0x4145f8;
				} else {
					_push(0x4145f8);
					_push(0x4028e4);
					L00401558();
					_v56 = 0x4145f8;
				}
				_v32 =  *_v56;
				_t45 =  *((intOrPtr*)( *_v32 + 0x14))(_v32,  &_v28);
				asm("fclex");
				_v36 = _t45;
				if(_v36 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4028d4);
					_push(_v32);
					_push(_v36);
					L00401552();
					_v60 = _t45;
				}
				_v40 = _v28;
				_t49 =  *((intOrPtr*)( *_v40 + 0x138))(_v40, L"Spinetternes5", 1);
				asm("fclex");
				_v44 = _t49;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x4028f4);
					_push(_v40);
					_push(_v44);
					L00401552();
					_v64 = _t49;
				}
				L0040152E();
				_push(0x41313b);
				return _t49;
			}

0x0041303c
0x0041304b
0x00413055
0x0041305d
0x00413060
0x00413067
0x00413076
0x00413080
0x0041309a
0x00413082
0x00413082
0x00413087
0x0041308c
0x00413091
0x00413091
0x004130a6
0x004130b5
0x004130b8
0x004130ba
0x004130c1
0x004130da
0x004130c3
0x004130c3
0x004130c5
0x004130ca
0x004130cd
0x004130d0
0x004130d5
0x004130d5
0x004130e1
0x004130f3
0x004130f9
0x004130fb
0x00413102
0x0041311e
0x00413104
0x00413104
0x00413109
0x0041310e
0x00413111
0x00413114
0x00413119
0x00413119
0x00413125
0x0041312a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 00413055
__vbaNew2.MSVBVM60(004028E4,004145F8,?,?,?,?,004013C6), ref: 0041308C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 004130D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000138), ref: 00413114
__vbaFreeObj.MSVBVM60 ref: 00413125

Strings

Spinetternes5, xrefs: 004130E6

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID: Spinetternes5
API String ID: 1616694062-1097852325
Opcode ID: c9878eecaaa7b2aeeb61d8d2dd2aed8f23a2fa92b6748e4a7462b001af08d719
Instruction ID: 0278f86792022d3f4294379d0e4637f1713e3c1500de07769f6ceccdced67f75
Opcode Fuzzy Hash: c9878eecaaa7b2aeeb61d8d2dd2aed8f23a2fa92b6748e4a7462b001af08d719
Instruction Fuzzy Hash: DB312771900208FFDB00EF95C989BDDBBF1FB08715F204026F101BA2A0C7B85A819B69

Uniqueness

Uniqueness Score: -1.00%

Function 00411FF1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00411FF1(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a40, signed int* _a64) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				signed int* _v44;
				signed int* _t17;
				void* _t24;
				void* _t26;
				intOrPtr _t27;

				_t27 = _t26 - 0xc;
				 *[fs:0x0] = _t27;
				L004013C0();
				_v16 = _t27;
				_v12 = 0x401328;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4013c6, _t24);
				L0040158E();
				_t17 = _a64;
				 *_t17 =  *_t17 & 0x00000000;
				L004014E0();
				_v44 = _t17;
				_push(0x412063);
				L0040156A();
				return _t17;
			}

0x00411ff4
0x00412003
0x0041200d
0x00412015
0x00412018
0x0041201f
0x0041202e
0x00412037
0x0041203c
0x0041203f
0x00412042
0x00412047
0x0041204a
0x0041205d
0x00412062

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 0041200D
__vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00412037
#615.MSVBVM60(?,?,?,?,004013C6), ref: 00412042
__vbaFreeVar.MSVBVM60(00412063,?,?,?,?,004013C6), ref: 0041205D

Strings

c A, xrefs: 0041205A

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#615ChkstkFree
String ID: c A
API String ID: 4276791933-563083727
Opcode ID: aceac035c15738309906371b3fb0349b19f17168d0cc78d8f9eec2bb15407c74
Instruction ID: c26e05876e6512ad8127a76103e5e3310c534d6fd6fd48312f0f790c040ffade
Opcode Fuzzy Hash: aceac035c15738309906371b3fb0349b19f17168d0cc78d8f9eec2bb15407c74
Instruction Fuzzy Hash: 9CF03C71500248EFDB00EF65CA86B9D7BB4EB04748F10446AF805BB2A0C7789D40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041208C, Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0041208C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				char* _t9;
				intOrPtr _t19;

				_push(0x4013c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t19;
				_push(0x28);
				L004013C0();
				_v12 = _t19;
				_v8 = 0x401338;
				_t9 =  &_v56;
				_push(_t9);
				L00401480();
				L0040153A();
				_push(0x4120e6);
				L0040156A();
				return _t9;
			}

0x00412091
0x0041209c
0x0041209d
0x004120a4
0x004120a7
0x004120af
0x004120b2
0x004120b9
0x004120bc
0x004120bd
0x004120c8
0x004120cd
0x004120e0
0x004120e5

APIs

__vbaChkstk.MSVBVM60(?,004013C6), ref: 004120A7
#546.MSVBVM60(?,?,?,?,?,004013C6), ref: 004120BD
__vbaVarMove.MSVBVM60(?,?,?,?,?,004013C6), ref: 004120C8
__vbaFreeVar.MSVBVM60(004120E6,?,?,?,?,?,004013C6), ref: 004120E0

Memory Dump Source

Source File: 00000000.00000002.1426251663.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426235934.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1426298297.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1426308273.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#546ChkstkFreeMove
String ID:
API String ID: 3298562087-0
Opcode ID: 13701ad1ebaa4dabe45001092faf9c1c8eff0e4fc15abbc47e68cf7648559b52
Instruction ID: 93c70da2017ab2e6301445be601ede342d0c0f6e922663d43b175350c728b6f2
Opcode Fuzzy Hash: 13701ad1ebaa4dabe45001092faf9c1c8eff0e4fc15abbc47e68cf7648559b52
Instruction Fuzzy Hash: 5DF03071951248BADB00EB91CD46FDDBB7CFB14B44F50452BB101B75A0D7BC2A448769

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 001982_Invoice_confirmation.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 001982_Invoice_confirmation.exe PID: 7120 Parent PID: 5936

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: 001982_Invoice_confirmation.exe PID: 7120 Parent PID: 5936 001982_Invoice_confirmation.exeCOMMON

Executed Functions

Function 00401600, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 526COMMON

Function 004111AE, Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 233COMMON

Function 0040FD54, Relevance: 56.2, APIs: 28, Strings: 4, Instructions: 215COMMON

Function 004101B1, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 74COMMON

Non-executed Functions

Function 004F5AE0, Relevance: 4.3, Strings: 3, Instructions: 591COMMON

Function 004111AE, Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 233
COMMON

Function 0040FD54, Relevance: 56.2, APIs: 28, Strings: 4, Instructions: 215
COMMON

Function 004101B1, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 74
COMMON

Function 0041315A, Relevance: 179.0, APIs: 94, Strings: 8, Instructions: 493
COMMON

Function 00410F05, Relevance: 45.2, APIs: 30, Instructions: 188
COMMON

Function 00412103, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 61
COMMON

Function 004102FA, Relevance: 22.6, APIs: 15, Instructions: 119
COMMON

Function 004121EF, Relevance: 19.6, APIs: 13, Instructions: 74
COMMON

Function 004138B8, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 67
COMMON

Function 004100DB, Relevance: 15.0, APIs: 10, Instructions: 49
COMMON

Function 00410689, Relevance: 13.6, APIs: 9, Instructions: 115
COMMON

Function 0040FADA, Relevance: 13.6, APIs: 9, Instructions: 82
COMMON

Function 0041059B, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Function 0040FC07, Relevance: 10.6, APIs: 7, Instructions: 85
COMMON

Function 00413039, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
COMMON

Function 00411FF1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
COMMON

Function 0041208C, Relevance: 6.0, APIs: 4, Instructions: 27
COMMON