Play interactive tour

Edit tour

Analysis Report PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Overview

General Information

Sample Name:	PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
Analysis ID:	342204
MD5:	7d9a5b92d4e287b92d7f4c46f40c3155
SHA1:	01b5226ea9a4bc9ee01edbf73b0ddb6463b29a25
SHA256:	43af4469aaafbb8d24b8d0da831e494952db00c649d1888458594a6b8ef1284b
Tags:	exeGuLoader
Most interesting Screenshot:

Detection

GuLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

PO1001910 Sample Arrive Tracking No_SINI0068206497.exe (PID: 7100 cmdline: 'C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe' MD5: 7D9A5B92D4E287B92D7F4C46F40C3155)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Virustotal: Detection: 23%			Perma Link
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Show sources

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_00404BEE	0_2_00404BEE
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_00404C48	0_2_00404C48
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_00404C21	0_2_00404C21
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_00404C80	0_2_00404C80

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000000.331338295.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamelseferier.exe vs PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000002.1367508550.00000000021D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Binary or memory string: OriginalFilenamelseferier.exe vs PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal80.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

File created: C:\Users\user\AppData\Local\Temp\~DF496457654F946C01.TMP

Jump to behavior

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Virustotal: Detection: 23%
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	ReversingLabs: Detection: 24%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100, type: MEMORY

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Code function: 0_2_00404592 push ebp; iretd

0_2_0040459B

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02212459	0_2_02212459
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02216EA1	0_2_02216EA1
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_022124A7	0_2_022124A7
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_022168E1	0_2_022168E1
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02216AF5	0_2_02216AF5
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_022168D4	0_2_022168D4
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02211D88	0_2_02211D88

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221713A second address: 000000000221713A instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221651C second address: 0000000002216527 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pushad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 0000000002216527 second address: 0000000002216527 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022165EC second address: 0000000002216603 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp esi, 0000F000h 0x00000010 je 00007F1D7CF4B320h 0x00000016 pushad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 0000000002216603 second address: 0000000002216603 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022166BF second address: 00000000022166D0 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp dword ptr [edi+14h], 40h 0x0000000e je 00007F1D7CF4B002h 0x00000010 pushad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022166D0 second address: 00000000022166D0 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022167BD second address: 00000000022167CA instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor eax, eax 0x0000000c pushad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022167CA second address: 00000000022167CA instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221064F second address: 00000000022162B1 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ax, 0000701Dh 0x0000000e call 00007F1D7CF509D9h 0x00000013 cmp ebx, ebx 0x00000015 cmp ecx, ecx 0x00000017 call 00007F1D7CF4B190h 0x0000001c test dh, bh 0x0000001e cmp ax, bx 0x00000021 xor edi, edi 0x00000023 test esi, 5B8401F4h 0x00000029 mov dword ptr [ebp+000000F8h], 00A95F60h 0x00000033 test al, 09h 0x00000035 test ah, 00000068h 0x00000038 cmp dh, ah 0x0000003a test ch, 0000007Bh 0x0000003d call 00007F1D7CF4B05Eh 0x00000042 call 00007F1D7CF4AFF8h 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221713A second address: 000000000221713A instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221651C second address: 0000000002216527 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pushad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 0000000002216527 second address: 0000000002216527 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022165EC second address: 0000000002216603 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp esi, 0000F000h 0x00000010 je 00007F1D7CF4B320h 0x00000016 pushad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 0000000002216603 second address: 0000000002216603 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022166BF second address: 00000000022166D0 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp dword ptr [edi+14h], 40h 0x0000000e je 00007F1D7CF4B002h 0x00000010 pushad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022166D0 second address: 00000000022166D0 instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022167BD second address: 00000000022167CA instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor eax, eax 0x0000000c pushad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022167CA second address: 00000000022167CA instructions:
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 000000000221064F second address: 00000000022162B1 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ax, 0000701Dh 0x0000000e call 00007F1D7CF509D9h 0x00000013 cmp ebx, ebx 0x00000015 cmp ecx, ecx 0x00000017 call 00007F1D7CF4B190h 0x0000001c test dh, bh 0x0000001e cmp ax, bx 0x00000021 xor edi, edi 0x00000023 test esi, 5B8401F4h 0x00000029 mov dword ptr [ebp+000000F8h], 00A95F60h 0x00000033 test al, 09h 0x00000035 test ah, 00000068h 0x00000038 cmp dh, ah 0x0000003a test ch, 0000007Bh 0x0000003d call 00007F1D7CF4B05Eh 0x00000042 call 00007F1D7CF4AFF8h 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	RDTSC instruction interceptor: First address: 00000000022162B1 second address: 00000000022162B1 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F1D7C8FA428h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dh, bh 0x0000001f add edi, edx 0x00000021 cmp ax, bx 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp dword ptr [ebp+000000F8h], 00000000h 0x00000031 jne 00007F1D7C8FA402h 0x00000033 cmp dh, ah 0x00000035 test ch, 0000007Bh 0x00000038 call 00007F1D7C8FA49Eh 0x0000003d call 00007F1D7C8FA438h 0x00000042 lfence 0x00000045 mov edx, dword ptr [7FFE0014h] 0x0000004b lfence 0x0000004e ret 0x0000004f mov esi, edx 0x00000051 pushad 0x00000052 rdtsc

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Code function: 0_2_02216056 rdtsc

0_2_02216056

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Code function: 0_2_02216056 rdtsc

0_2_02216056

Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_022126B7 mov eax, dword ptr fs:[00000030h]	0_2_022126B7
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02216AE8 mov eax, dword ptr fs:[00000030h]	0_2_02216AE8
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02216AF5 mov eax, dword ptr fs:[00000030h]	0_2_02216AF5
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02216B35 mov eax, dword ptr fs:[00000030h]	0_2_02216B35
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02215F3E mov eax, dword ptr fs:[00000030h]	0_2_02215F3E
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02213567 mov eax, dword ptr fs:[00000030h]	0_2_02213567
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_02211D88 mov eax, dword ptr fs:[00000030h]	0_2_02211D88
Source: C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	Code function: 0_2_022159EE mov eax, dword ptr fs:[00000030h]	0_2_022159EE

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000002.1367435282.0000000000DB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000002.1367435282.0000000000DB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000002.1367435282.0000000000DB0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe, 00000000.00000002.1367435282.0000000000DB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery511	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	24%	Virustotal		Browse
PO1001910 Sample Arrive Tracking No_SINI0068206497.exe	24%	ReversingLabs	Win32.Trojan.Vebzenpak

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	342204
Start date:	20.01.2021
Start time:	16:44:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 29.5% (good quality ratio 19.8%) Quality average: 37.2% Quality standard deviation: 31.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.799072194766734
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
File size:	90112
MD5:	7d9a5b92d4e287b92d7f4c46f40c3155
SHA1:	01b5226ea9a4bc9ee01edbf73b0ddb6463b29a25
SHA256:	43af4469aaafbb8d24b8d0da831e494952db00c649d1888458594a6b8ef1284b
SHA512:	17346e4847c43285cd6930063ae6e965ea4343101325b79dc899f70fd974f596fa02758a8b3631f8481372e7fd2e8de8480b720af32b7db89b722c2f81ad5153
SSDEEP:	768:0D3V/h6zJfdg459JOIbyswtOMe6d8+kkG8RB2EMlUlQ9vL+LK:gl/hMJV557OTPdv4alId
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...". J.................0...0...............@....@................

File Icon


Icon Hash:	f030f0c6f030b100

Static PE Info

General
Entrypoint:	0x4015d4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4A201A22 [Fri May 29 17:23:46 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9546a0aa3a7ac8c2e4587b9c0a1704ee

Entrypoint Preview

Instruction
push 0040225Ch
call 00007F1D7CE08085h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+492EB203h], dh
jecxz 00007F1D7CE080E4h
inc ebx
xchg eax, ebp
pop ss
jno 00007F1D7CE080F6h
xchg eax, ecx
out F7h, eax
test byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
push cs
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax+72h], dl
outsd
push 00000065h
arpl word ptr [ecx+esi+00h], si
add byte ptr [eax], al
add al, cl
call 00007F1D7CE0838Ch
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add al, B7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13104	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x938	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x15c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x126e0	0x13000	False	0.429957339638	data	6.2966491779	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0x11b4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x938	0x1000	False	0.142578125	data	1.43341804636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x163d0	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x163bc	0x14	data
RT_VERSION	0x160f0	0x2cc	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaBoolStr, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaCyStr, __vbaVarTstLt, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaFpCmpCy, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, __vbaUI1Str, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Calc Theory
InternalName	lseferier
FileVersion	1.00
CompanyName	Calc Theory
Comments	Calc Theory
ProductName	Calc Theory
ProductVersion	1.00
FileDescription	Calc Theory
OriginalFilename	lseferier.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100 Parent PID: 5736

General

Start time:	16:45:25
Start date:	20/01/2021
Path:	C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO1001910 Sample Arrive Tracking No_SINI0068206497.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	7D9A5B92D4E287B92D7F4C46F40C3155
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100 Parent PID: 5736 PO1001910 Sample Arrive Tracking No_SINI0068206497.exeCOMMON

Executed Functions

Function 00404BEE, Relevance: 1.5, APIs: 1, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecdd95612fc5099be55046ca1b7332f47407523210c6a1ad30b4309f66f23ca
Instruction ID: 11878d886118e31af347c143357546504eb57499ac79b6ca0f89faf0a0edf5da
Opcode Fuzzy Hash: 3ecdd95612fc5099be55046ca1b7332f47407523210c6a1ad30b4309f66f23ca
Instruction Fuzzy Hash: 1B418AE166B242FBD7210E78ECA15767794EF82F04720657BCA46E7388DE2D49C3D10A

Uniqueness

Uniqueness Score: -1.00%

Function 00404C21, Relevance: 1.5, APIs: 1, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b1a417be6e3ba18e81ef19aa27a0882e7dd9ec3154db86925cbd957df04b26c
Instruction ID: d195bd192d168863d42755c63e984e9a57d28674ebad994788d6c5ab11adc5c2
Opcode Fuzzy Hash: 9b1a417be6e3ba18e81ef19aa27a0882e7dd9ec3154db86925cbd957df04b26c
Instruction Fuzzy Hash: 37418BE162B241F7D7210E78D8A55767794EF82F40720697BCA4AE7384DE2C09C3D10A

Uniqueness

Uniqueness Score: -1.00%

Function 00404C48, Relevance: 1.5, APIs: 1, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d9e6ef882ccba847af167f5fd51c32fabebb0463c009f6dbb4afeecfbb20fe
Instruction ID: b493db7e0fb1befceca36fc5259362918234dd6bd5d1b98d6407345cde866d2e
Opcode Fuzzy Hash: d9d9e6ef882ccba847af167f5fd51c32fabebb0463c009f6dbb4afeecfbb20fe
Instruction Fuzzy Hash: BD418BE162B281F7D7250A78DCA11763795EF82F04720697BCA4AE7384DE2D09C3D10A

Uniqueness

Uniqueness Score: -1.00%

Function 00404C80, Relevance: 1.5, APIs: 1, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224701c6698bb2ae25a8a294364760823f267f4784169eba31765c2905d227db
Instruction ID: 8f79ba79524e43cecdf6d0b32b564d963c33b51d843faf5562bb774a906f624f
Opcode Fuzzy Hash: 224701c6698bb2ae25a8a294364760823f267f4784169eba31765c2905d227db
Instruction Fuzzy Hash: FD419DE1A17241F7D7310B78EC956667794EF82F4071059BBCA86E7398DE2C09C3D206

Uniqueness

Uniqueness Score: -1.00%

Function 00411BD7, Relevance: 84.3, APIs: 38, Strings: 10, Instructions: 309
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00411BD7(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v28;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v56;
				char _v72;
				signed int _v80;
				char _v88;
				char* _v96;
				intOrPtr _v104;
				char _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v144;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				intOrPtr* _v168;
				signed int _v172;
				signed int _v176;
				signed int _t135;
				char* _t138;
				signed int _t145;
				signed int _t149;
				signed int _t157;
				signed int _t161;
				char* _t165;
				signed int _t166;
				signed int _t167;
				signed int _t171;
				signed int _t175;
				void* _t213;
				intOrPtr _t215;

				 *[fs:0x0] = _t215;
				L004013D0();
				_v12 = _t215;
				_v8 = 0x4012d8;
				L00401556();
				L004015A4();
				_v48 = 0x9c;
				_v56 = 8;
				_v96 =  &M00403498;
				_v104 = 8;
				_t135 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v40, L"onButton", L"VB.Opti", __edi, __esi, __ebx,  *[fs:0x0], 0x4013d6, __ecx, __ecx, _t213);
				asm("fclex");
				_v128 = _t135;
				if(_v128 >= 0) {
					_v148 = _v148 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x402fec);
					_push(_a4);
					_push(_v128);
					L0040158C();
					_v148 = _t135;
				}
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(2);
				_push(L"Add");
				_push(_v40);
				_t138 =  &_v72;
				_push(_t138); // executed
				L004014D8(); // executed
				_push(_t138);
				L004014DE();
				_push(_t138);
				_push( &_v24);
				L004014E4();
				L0040156E();
				_push( &_v72);
				_push( &_v56);
				_push(2);
				L00401574();
				if( *0x414010 != 0) {
					_v152 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v152 = 0x414010;
				}
				_t145 =  &_v40;
				L00401586();
				_v128 = _t145;
				_t149 =  *((intOrPtr*)( *_v128 + 0x198))(_v128,  &_v36, _t145,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x2fc))( *_v152));
				asm("fclex");
				_v132 = _t149;
				if(_v132 >= 0) {
					_v156 = _v156 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x4031c0);
					_push(_v128);
					_push(_v132);
					L0040158C();
					_v156 = _t149;
				}
				_v144 = _v36;
				_v36 = _v36 & 0x00000000;
				_v48 = _v144;
				_v56 = 8;
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Caption");
				_push(_v24);
				L004014D2();
				L0040156E();
				L00401598();
				_v80 = 0xc30;
				_v88 = 2;
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Left");
				_push(_v24);
				L004014D2();
				if( *0x414010 != 0) {
					_v160 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v160 = 0x414010;
				}
				_t157 =  &_v40;
				L00401586();
				_v128 = _t157;
				_t161 =  *((intOrPtr*)( *_v128 + 0xe0))(_v128,  &_v124, _t157,  *((intOrPtr*)( *((intOrPtr*)( *_v160)) + 0x2fc))( *_v160));
				asm("fclex");
				_v132 = _t161;
				if(_v132 >= 0) {
					_v164 = _v164 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x4031c0);
					_push(_v128);
					_push(_v132);
					L0040158C();
					_v164 = _t161;
				}
				_v80 = _v124;
				_v88 = 2;
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Top");
				_push(_v24);
				L004014D2();
				L0040156E();
				_v80 = _v80 | 0xffffffff;
				_v88 = 0xb;
				_push(0x10);
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Visible");
				_push(_v24);
				L004014D2();
				_v80 = L"flerpartisystemets";
				_v88 = 0x8008;
				_push(0);
				_push(L"Caption");
				_push(_v24);
				_t165 =  &_v56;
				_push(_t165);
				L004014D8();
				_push(_t165);
				_t166 =  &_v88;
				_push(_t166);
				L004014CC();
				_v128 = _t166;
				L00401598();
				_t167 = _v128;
				if(_t167 != 0) {
					if( *0x414010 != 0) {
						_v168 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v168 = 0x414010;
					}
					_t171 =  &_v40;
					L00401586();
					_v128 = _t171;
					_t175 =  *((intOrPtr*)( *_v128 + 0x100))(_v128,  &_v124, _t171,  *((intOrPtr*)( *((intOrPtr*)( *_v168)) + 0x304))( *_v168));
					asm("fclex");
					_v132 = _t175;
					if(_v132 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x100);
						_push(0x4031c0);
						_push(_v128);
						_push(_v132);
						L0040158C();
						_v172 = _t175;
					}
					_t167 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, _v124);
					asm("fclex");
					_v136 = _t167;
					if(_v136 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x15c);
						_push(0x402fec);
						_push(_a4);
						_push(_v136);
						L0040158C();
						_v176 = _t167;
					}
					L0040156E();
				}
				_push(0x412041);
				L0040156E();
				L00401568();
				return _t167;
			}

0x00411be8
0x00411bf4
0x00411bfc
0x00411bff
0x00411c0c
0x00411c1b
0x00411c20
0x00411c23
0x00411c2a
0x00411c31
0x00411c44
0x00411c4a
0x00411c4c
0x00411c53
0x00411c72
0x00411c55
0x00411c55
0x00411c5a
0x00411c5f
0x00411c62
0x00411c65
0x00411c6a
0x00411c6a
0x00411c79
0x00411c7c
0x00411c86
0x00411c87
0x00411c88
0x00411c89
0x00411c8a
0x00411c8d
0x00411c97
0x00411c98
0x00411c99
0x00411c9a
0x00411c9b
0x00411c9d
0x00411ca2
0x00411ca5
0x00411ca8
0x00411ca9
0x00411cb1
0x00411cb2
0x00411cb7
0x00411cbb
0x00411cbc
0x00411cc4
0x00411ccc
0x00411cd0
0x00411cd1
0x00411cd3
0x00411ce2
0x00411cff
0x00411ce4
0x00411ce4
0x00411ce9
0x00411cee
0x00411cf3
0x00411cf3
0x00411d23
0x00411d27
0x00411d2c
0x00411d3b
0x00411d41
0x00411d43
0x00411d4a
0x00411d69
0x00411d4c
0x00411d4c
0x00411d51
0x00411d56
0x00411d59
0x00411d5c
0x00411d61
0x00411d61
0x00411d73
0x00411d79
0x00411d83
0x00411d86
0x00411d8d
0x00411d90
0x00411d9a
0x00411d9b
0x00411d9c
0x00411d9d
0x00411d9e
0x00411da3
0x00411da6
0x00411dae
0x00411db6
0x00411dbb
0x00411dc2
0x00411dc9
0x00411dcc
0x00411dd6
0x00411dd7
0x00411dd8
0x00411dd9
0x00411dda
0x00411ddf
0x00411de2
0x00411dee
0x00411e0b
0x00411df0
0x00411df0
0x00411df5
0x00411dfa
0x00411dff
0x00411dff
0x00411e2f
0x00411e33
0x00411e38
0x00411e47
0x00411e4d
0x00411e4f
0x00411e56
0x00411e75
0x00411e58
0x00411e58
0x00411e5d
0x00411e62
0x00411e65
0x00411e68
0x00411e6d
0x00411e6d
0x00411e80
0x00411e84
0x00411e8b
0x00411e8e
0x00411e98
0x00411e99
0x00411e9a
0x00411e9b
0x00411e9c
0x00411ea1
0x00411ea4
0x00411eac
0x00411eb1
0x00411eb5
0x00411ebc
0x00411ebf
0x00411ec9
0x00411eca
0x00411ecb
0x00411ecc
0x00411ecd
0x00411ed2
0x00411ed5
0x00411eda
0x00411ee1
0x00411ee8
0x00411eea
0x00411eef
0x00411ef2
0x00411ef5
0x00411ef6
0x00411efe
0x00411eff
0x00411f02
0x00411f03
0x00411f08
0x00411f0f
0x00411f14
0x00411f1a
0x00411f27
0x00411f44
0x00411f29
0x00411f29
0x00411f2e
0x00411f33
0x00411f38
0x00411f38
0x00411f68
0x00411f6c
0x00411f71
0x00411f80
0x00411f86
0x00411f88
0x00411f8f
0x00411fae
0x00411f91
0x00411f91
0x00411f96
0x00411f9b
0x00411f9e
0x00411fa1
0x00411fa6
0x00411fa6
0x00411fc0
0x00411fc6
0x00411fc8
0x00411fd5
0x00411ff7
0x00411fd7
0x00411fd7
0x00411fdc
0x00411fe1
0x00411fe4
0x00411fea
0x00411fef
0x00411fef
0x00412001
0x00412001
0x00412006
0x00412033
0x0041203b
0x00412040

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00411BF4
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00411C0C
__vbaStrCat.MSVBVM60(onButton,VB.Opti,?,?,?,?,004013D6), ref: 00411C1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FEC,00000218), ref: 00411C65
__vbaChkstk.MSVBVM60(00000000,?,00402FEC,00000218), ref: 00411C7C
__vbaChkstk.MSVBVM60(00000000,?,00402FEC,00000218), ref: 00411C8D
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00411CA9
__vbaObjVar.MSVBVM60(00000000), ref: 00411CB2
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000), ref: 00411CBC
__vbaFreeObj.MSVBVM60(?,00000000,00000000), ref: 00411CC4
__vbaFreeVarList.MSVBVM60(00000002,00000000,?,?,00000000,00000000), ref: 00411CD3
__vbaNew2.MSVBVM60(004029C8, b,?,00000000,00000000), ref: 00411CEE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411D27
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000198), ref: 00411D5C
__vbaChkstk.MSVBVM60(00000000,?,004031C0,00000198), ref: 00411D90
__vbaLateMemSt.MSVBVM60(?,Caption), ref: 00411DA6
__vbaFreeObj.MSVBVM60(?,Caption), ref: 00411DAE
__vbaFreeVar.MSVBVM60(?,Caption), ref: 00411DB6
__vbaChkstk.MSVBVM60(?,Caption), ref: 00411DCC
__vbaLateMemSt.MSVBVM60(?,Left,?,Caption), ref: 00411DE2
__vbaNew2.MSVBVM60(004029C8, b,?,Left,?,Caption), ref: 00411DFA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411E33
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000000E0), ref: 00411E68
__vbaChkstk.MSVBVM60(00000000,?,004031C0,000000E0), ref: 00411E8E
__vbaLateMemSt.MSVBVM60(?,Top), ref: 00411EA4
__vbaFreeObj.MSVBVM60(?,Top), ref: 00411EAC
__vbaChkstk.MSVBVM60(?,Top), ref: 00411EBF
__vbaLateMemSt.MSVBVM60(?,Visible,?,Top), ref: 00411ED5
__vbaLateMemCallLd.MSVBVM60(00000008,?,Caption,00000000,?,Visible,?,Top), ref: 00411EF6
__vbaVarTstEq.MSVBVM60(?,00000000), ref: 00411F03
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00411F0F
__vbaNew2.MSVBVM60(004029C8, b,?,00000000), ref: 00411F33
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411F6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000100), ref: 00411FA1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FEC,0000015C), ref: 00411FEA
__vbaFreeObj.MSVBVM60(00000000,?,00402FEC,0000015C), ref: 00412001
__vbaFreeObj.MSVBVM60(00412041,?,00000000), ref: 00412033
__vbaFreeStr.MSVBVM60(00412041,?,00000000), ref: 0041203B

Strings

VB.Opti, xrefs: 00411C11
b, xrefs: 00411CDB, 00411CE4, 00411CF3, 00411CFF, 00411DE7, 00411DF0, 00411DFF, 00411E0B, 00411F20, 00411F29, 00411F38, 00411F44
Add, xrefs: 00411C9D
Visible, xrefs: 00411ECD
onButton, xrefs: 00411C16
Wanhap6, xrefs: 00411C2A
Top, xrefs: 00411E9C
Caption, xrefs: 00411D9E, 00411EEA
flerpartisystemets, xrefs: 00411EDA
Left, xrefs: 00411DDA

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$Late$CheckHresult$New2$Call$AddrefCopyList
String ID: b$Add$Caption$Left$Top$VB.Opti$Visible$Wanhap6$flerpartisystemets$onButton
API String ID: 4289394206-2204394660
Opcode ID: 5e2a7cbdff5a427fcfa5f654b9c0ddb412d039e0a6e5cef90ffab3e8ab283320
Instruction ID: df1919906954e292aa0380a4741c0dc53c014ef6549b1360522b045e2d8e0bf7
Opcode Fuzzy Hash: 5e2a7cbdff5a427fcfa5f654b9c0ddb412d039e0a6e5cef90ffab3e8ab283320
Instruction Fuzzy Hash: 17C14A70D00208AFDB21DFA1CD46BDDBBB5BF09704F20446AF505BB2A2CBB95A448F59

Uniqueness

Uniqueness Score: -1.00%

Function 00412AD3, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00412AD3(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v40;
				void* _v64;
				signed int _v68;
				char _v72;
				intOrPtr _v80;
				char _v88;
				char _v104;
				char _v108;
				signed int _v116;
				char _v124;
				void* _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				char _v160;
				signed int _v164;
				short _t74;
				char* _t76;
				char* _t80;
				signed int _t84;
				signed int _t94;
				intOrPtr _t122;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t122;
				L004013D0();
				_v12 = _t122;
				_v8 = 0x401378;
				L0040154A();
				L0040154A();
				_push(L"Sprjtenes");
				_push(L"TREMETOL");
				_push( &_v88); // executed
				L0040148A(); // executed
				_v116 = _v116 & 0x00000000;
				_v124 = 0x8008;
				_push( &_v88);
				_t74 =  &_v124;
				_push(_t74);
				L00401520();
				_v128 = _t74;
				L00401598();
				if(_v128 != 0) {
					if( *0x414010 != 0) {
						_v152 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v152 = 0x414010;
					}
					_t80 =  &_v72;
					L00401586();
					_v128 = _t80;
					_t84 =  *((intOrPtr*)( *_v128 + 0x48))(_v128,  &_v68, _t80,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x308))( *_v152));
					asm("fclex");
					_v132 = _t84;
					if(_v132 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4031d0);
						_push(_v128);
						_push(_v132);
						L0040158C();
						_v156 = _t84;
					}
					if( *0x41433c != 0) {
						_v160 = 0x41433c;
					} else {
						_push(0x41433c);
						_push(0x4033d8);
						L00401580();
						_v160 = 0x41433c;
					}
					_t36 =  &_v160; // 0x41433c
					_v136 =  *((intOrPtr*)( *_t36));
					_v148 = _v68;
					_v68 = _v68 & 0x00000000;
					_v80 = _v148;
					_v88 = 8;
					_v116 = 0xc2;
					_v124 = 2;
					L004013D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004013D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t94 =  *((intOrPtr*)( *_v136 + 0x38))(_v136, 0x10, 0x10,  &_v104);
					asm("fclex");
					_v140 = _t94;
					if(_v140 >= 0) {
						_v164 = _v164 & 0x00000000;
					} else {
						_push(0x38);
						_push(0x4033c8);
						_push(_v136);
						_push(_v140);
						L0040158C();
						_v164 = _t94;
					}
					_push( &_v104);
					_push( &_v108);
					L0040147E();
					_push( &_v108);
					_push( &_v40);
					L00401484();
					L0040156E();
					_push( &_v104);
					_push( &_v88);
					_push(2);
					L00401574();
				}
				asm("wait");
				_push(0x412d46);
				L00401598();
				_t76 =  &_v40;
				_push(_t76);
				_push(0);
				L00401496();
				L00401598();
				return _t76;
			}

0x00412ad8
0x00412ae3
0x00412ae4
0x00412af0
0x00412af8
0x00412afb
0x00412b08
0x00412b13
0x00412b18
0x00412b1d
0x00412b25
0x00412b26
0x00412b2b
0x00412b2f
0x00412b39
0x00412b3a
0x00412b3d
0x00412b3e
0x00412b43
0x00412b4a
0x00412b55
0x00412b62
0x00412b7f
0x00412b64
0x00412b64
0x00412b69
0x00412b6e
0x00412b73
0x00412b73
0x00412ba3
0x00412ba7
0x00412bac
0x00412bbb
0x00412bbe
0x00412bc0
0x00412bc7
0x00412be3
0x00412bc9
0x00412bc9
0x00412bcb
0x00412bd0
0x00412bd3
0x00412bd6
0x00412bdb
0x00412bdb
0x00412bf1
0x00412c0e
0x00412bf3
0x00412bf3
0x00412bf8
0x00412bfd
0x00412c02
0x00412c02
0x00412c18
0x00412c20
0x00412c29
0x00412c2f
0x00412c39
0x00412c3c
0x00412c43
0x00412c4a
0x00412c58
0x00412c62
0x00412c63
0x00412c64
0x00412c65
0x00412c69
0x00412c73
0x00412c74
0x00412c75
0x00412c76
0x00412c85
0x00412c88
0x00412c8a
0x00412c97
0x00412cb9
0x00412c99
0x00412c99
0x00412c9b
0x00412ca0
0x00412ca6
0x00412cac
0x00412cb1
0x00412cb1
0x00412cc3
0x00412cc7
0x00412cc8
0x00412cd0
0x00412cd4
0x00412cd5
0x00412cdd
0x00412ce5
0x00412ce9
0x00412cea
0x00412cec
0x00412cf1
0x00412cf4
0x00412cf5
0x00412d2d
0x00412d32
0x00412d35
0x00412d36
0x00412d38
0x00412d40
0x00412d45

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412AF0
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412B08
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412B13
#692.MSVBVM60(?,TREMETOL,Sprjtenes,?,?,?,?,004013D6), ref: 00412B26
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 00412B3E
__vbaFreeVar.MSVBVM60(00008008,?), ref: 00412B4A
__vbaNew2.MSVBVM60(004029C8, b,00008008,?), ref: 00412B6E
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00008008,?), ref: 00412BA7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,00000048,?,?,?,?,?,00008008,?), ref: 00412BD6
__vbaNew2.MSVBVM60(004033D8,0041433C,?,?,?,?,?,00008008,?), ref: 00412BFD
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,00008008,?), ref: 00412C58
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,00008008,?), ref: 00412C69
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,00000038,?,?,?,?,?,?,?,00008008,?), ref: 00412CAC
__vbaVar2Vec.MSVBVM60(?,?,?,?,?,?,?,?,?,00008008,?), ref: 00412CC8
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00412CD5
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00412CDD
__vbaFreeVarList.MSVBVM60(00000002,00000008,?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00412CEC
__vbaFreeVar.MSVBVM60(00412D46,00008008,?), ref: 00412D2D
__vbaAryDestruct.MSVBVM60(00000000,?,00412D46,00008008,?), ref: 00412D38
__vbaFreeVar.MSVBVM60(00000000,?,00412D46,00008008,?), ref: 00412D40

Strings

TREMETOL, xrefs: 00412B1D
b, xrefs: 00412B5B, 00412B64, 00412B73, 00412B7F
Sprjtenes, xrefs: 00412B18
<CA, xrefs: 00412C18

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$CheckHresultNew2$#692DestructListMoveVar2
String ID: b$<CA$Sprjtenes$TREMETOL
API String ID: 2413103220-3435099201
Opcode ID: 73f3187d69eeac61f2aa2f5380c8072de32872b6e50ecb436a5d0083d11575c0
Instruction ID: 5d917dfb2448c02c833db03dafc2701ea6aedced72bf2169ce36469f93f4b3bc
Opcode Fuzzy Hash: 73f3187d69eeac61f2aa2f5380c8072de32872b6e50ecb436a5d0083d11575c0
Instruction Fuzzy Hash: CC611A71900218AFDB10DFA1CD46BDDB7B8BF08704F10446AF505BB2A1DBB86A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411513, Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00411513(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				intOrPtr _v44;
				char _v52;
				char* _t21;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t35 = _t34 - 0xc;
				 *[fs:0x0] = _t35;
				L004013D0();
				_v16 = _t35;
				_v12 = 0x401268;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x4013d6, _t32);
				L00401556();
				_v44 = 1;
				_v52 = 2;
				_push(0);
				_t21 =  &_v52;
				_push(_t21); // executed
				L00401508(); // executed
				L004015B0();
				L00401598();
				_push(0x4115aa);
				L00401568();
				L00401568();
				return _t21;
			}

0x00411516
0x00411525
0x0041152f
0x00411537
0x0041153a
0x00411541
0x00411550
0x00411559
0x0041155e
0x00411565
0x0041156c
0x0041156e
0x00411571
0x00411572
0x0041157c
0x00411584
0x00411589
0x0041159c
0x004115a4
0x004115a9

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 0041152F
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00411559
#705.MSVBVM60(00000002,00000000), ref: 00411572
__vbaStrMove.MSVBVM60(00000002,00000000), ref: 0041157C
__vbaFreeVar.MSVBVM60(00000002,00000000), ref: 00411584
__vbaFreeStr.MSVBVM60(004115AA,00000002,00000000), ref: 0041159C
__vbaFreeStr.MSVBVM60(004115AA,00000002,00000000), ref: 004115A4

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#705ChkstkCopyMove
String ID:
API String ID: 3591744543-0
Opcode ID: fb80807f2cfbffaac7d27a8c32890b4b62c97590d52c518ca64aad0a1c76c7d7
Instruction ID: caa5e6178d48dbdf269e620a6261d391f135fbe938c27ceeb4ccb4bf6d48ee8c
Opcode Fuzzy Hash: fb80807f2cfbffaac7d27a8c32890b4b62c97590d52c518ca64aad0a1c76c7d7
Instruction Fuzzy Hash: E9010C70940208BBDB00EFA5DC46FDEBB78AF54744F50802AF506BB1E1DB78A945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004015D4, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 421
COMMON

Download Yara Rule

C-Code - Quality: 91%

			_entry_(signed int __eax, void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, signed int __esi) {
				intOrPtr* _t48;
				intOrPtr* _t49;
				signed char _t51;
				intOrPtr* _t52;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				intOrPtr* _t59;
				intOrPtr* _t64;
				intOrPtr* _t70;
				signed char _t71;
				signed char _t72;
				signed int _t74;
				signed int _t77;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				intOrPtr* _t81;
				intOrPtr _t82;
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr* _t89;
				signed int _t90;
				intOrPtr* _t95;
				signed int* _t96;
				void* _t98;
				void* _t101;
				intOrPtr* _t104;
				signed int _t112;
				signed int* _t116;
				void* _t118;
				intOrPtr* _t119;
				intOrPtr* _t124;
				intOrPtr* _t125;
				void* _t126;
				void* _t132;
				void* _t134;

				_t121 = __esi;
				_t120 = __edi;
				_t114 = __edx;
				_t100 = __ecx;
				_push("VB5!6&*"); // executed
				L004015CE(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t48 = __eax + 1;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				 *((intOrPtr*)(__ebx + 0x492eb203)) =  *((intOrPtr*)(__ebx + 0x492eb203)) + __edx;
				asm("jecxz 0x54");
				_t95 = __ebx + 1;
				_t49 = _t124;
				_t125 = _t48;
				_pop(ss);
				if(_t95 >= 0) {
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					 *_t49 =  *_t49 + _t49;
					_t51 = _t49 + __edx |  *(_t49 + __edx);
					 *((intOrPtr*)(_t95 + 0xb)) =  *((intOrPtr*)(_t95 + 0xb)) + _t51;
					 *_t51 =  *_t51 + _t51;
					 *__esi =  *__esi + _t51;
					_t12 = __edi + 0x61;
					 *_t12 =  *((intOrPtr*)(__edi + 0x61)) + _t51;
					__eflags =  *_t12;
					if( *_t12 > 0) {
						 *[ss:0x53000e01] =  *[ss:0x53000e01] + __ecx;
						_pop(_t86);
						_t100 = _t95;
						_t118 = __edx + 1;
						_t120 = __edi - 1;
						_t132 = _t132 - 1;
						_push(_t118);
						_t121 = __esi - 1;
						_t125 = _t125 + 1 - 1 + 2;
						_push(_t95);
						 *__ecx =  *__ecx + _t95;
						 *_t86 =  *_t86 + _t86;
						_t119 = _t118 + 1;
						 *_t119 =  *_t119 + _t86;
						 *_t95 =  *_t95 + _t132;
						asm("out dx, al");
						_t87 = _t86 |  *_t86;
						 *((intOrPtr*)(_t132 + _t121 * 2)) =  *((intOrPtr*)(_t132 + _t121 * 2)) + __ecx;
						_t114 = _t119 + _t87;
						_t51 = _t87 |  *_t87;
						 *_t51 =  *_t51 + _t51;
						 *__ecx =  *__ecx + _t51;
						 *__ecx =  *__ecx + _t51;
						 *_t51 =  *_t51 + _t114;
						asm("adc [eax], al");
						 *__ecx =  *__ecx + _t51;
						 *_t51 =  *_t51 + __ecx;
						 *((intOrPtr*)(_t51 + 5)) =  *((intOrPtr*)(_t51 + 5)) + __ecx;
						 *_t51 =  *_t51 + _t51;
						_push(ss);
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + __ecx;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t114;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *__ecx =  *__ecx + _t51;
						 *_t51 =  *_t51 + __ecx;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						 *_t51 =  *_t51 + _t51;
						_t20 = _t120 - 0x5eff6061;
						 *_t20 =  *((intOrPtr*)(_t120 - 0x5eff6061)) + _t95;
						__eflags =  *_t20;
					}
					asm("lahf");
					asm("lahf");
					asm("lahf");
					 *((intOrPtr*)(_t100 - 0x5aff5e5f)) =  *((intOrPtr*)(_t100 - 0x5aff5e5f)) + _t51;
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t114 - 0x4dff5556)) =  *((intOrPtr*)(_t114 - 0x4dff5556)) + _t100;
					 *((intOrPtr*)(_t132 + _t121 * 4 - 0x4141ff4c)) =  *((intOrPtr*)(_t132 + _t121 * 4 - 0x4141ff4c)) + 0xb2;
					_t101 = _t100 + _t100;
					_pop(_t126);
					_t134 = _t126;
					_t116 = 0xb2 + _t101;
					asm("into");
					asm("into");
					asm("rcl ecx, 1");
					asm("aad 0xd5");
					_t104 = _t101 + 0x164 + _t51;
					asm("loope 0xffffffe3");
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					__eflags =  *_t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					_t96 = _t95 + _t95;
					asm("invalid");
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t51 =  *_t51 + _t51;
					 *_t116 =  *_t116 + _t51;
					_t52 = _t51 +  *_t116;
					 *_t52 =  *_t52 + _t52;
					 *_t52 =  *_t52 + _t52;
					 *_t52 =  *_t52 + _t52;
					 *_t52 =  *_t52 + _t52;
					 *_t52 =  *_t52 + _t52;
					 *_t52 =  *_t52 + _t52;
					_push(es);
					_push(es);
					_t54 = _t52 +  *0xc3c3c300 +  *((intOrPtr*)(_t52 +  *0xc3c3c300));
					 *_t54 =  *_t54 + _t54;
					 *_t54 =  *_t54 + _t54;
					 *_t54 =  *_t54 + _t54;
					 *_t54 =  *_t54 + _t54;
					 *_t54 =  *_t54 + _t54;
					_t55 = _t54 +  *_t104;
					 *_t104 =  *_t104 + _t55;
					_t56 = _t55 +  *_t55;
					 *_t56 =  *_t56 + _t56;
					 *_t56 =  *_t56 + _t56;
					 *_t56 =  *_t56 + _t56;
					 *_t56 =  *_t56 + _t56;
					 *_t56 =  *_t56 + _t56;
					_t59 = _t56 +  *_t116 +  *_t116 +  *((intOrPtr*)(_t56 +  *_t116 +  *_t116));
					 *_t59 =  *_t59 + _t59;
					 *_t59 =  *_t59 + _t59;
					 *_t59 =  *_t59 + _t59;
					 *_t116 =  *_t116 + _t59;
					_t64 = _t59 +  *_t116 +  *_t116 +  *((intOrPtr*)(_t116 + _t59 +  *_t116 +  *_t116)) +  *_t116 +  *((intOrPtr*)(_t59 +  *_t116 +  *_t116 +  *((intOrPtr*)(_t116 + _t59 +  *_t116 +  *_t116)) +  *_t116));
					 *_t64 =  *_t64 + _t64;
					 *_t116 =  *_t116 + _t64;
					_t70 = _t64 + 0x16;
					 *_t70 =  *_t70 + _t70;
					 *_t116 =  *_t116 + _t70;
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_push(es);
					_t71 = _t70 +  *_t70;
					 *_t71 =  *_t71 + _t71;
					es = es;
					_t72 = _t71 |  *_t116;
					 *_t72 =  *_t72 + _t72;
					 *_t72 =  *_t72 + _t72;
					_t74 = _t72 +  *_t116 +  *_t116;
					_t77 = (_t74 |  *_t116) +  *_t116 +  *((intOrPtr*)((_t74 |  *_t116) +  *_t116));
					 *_t77 =  *_t77 + _t77;
					 *_t77 =  *_t77 + _t77;
					 *_t77 =  *_t77 + _t77;
					 *_t116 =  *_t116 + _t77;
					_t78 = _t77 |  *_t116;
					 *_t78 =  *_t78 + _t78;
					 *_t78 =  *_t78 + _t78;
					 *_t78 =  *_t78 + _t78;
					 *_t78 =  *_t78 + _t78;
					 *_t78 =  *_t78 + _t78;
					 *_t116 =  *_t116 + _t78;
					_t112 = _t104 +  *_t96 |  *_t96 |  *_t71 |  *_t116 |  *_t96 |  *_t74 |  *_t116 |  *_t116;
					_t79 = _t78 |  *_t116;
					 *_t79 =  *_t79 + _t79;
					 *_t79 =  *_t79 + _t79;
					 *_t79 =  *_t79 + _t79;
					 *_t79 =  *_t79 + _t79;
					 *_t79 =  *_t79 + _t79;
					 *_t116 =  *_t116 + _t79;
					_t80 = _t79 | 0x00020d0d;
					 *_t80 =  *_t80 + _t80;
					 *_t80 =  *_t80 + _t80;
					 *_t80 =  *_t80 + _t80;
					 *_t80 =  *_t80 + _t80;
					 *_t80 =  *_t80 + _t80;
					 *_t116 =  *_t116 + _t80;
					_t81 = _t80 +  *_t116;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + _t81;
					 *_t81 =  *_t81 + 1;
					_t98 = _t96 + _t96 + _t96 + _t96;
					 *_t81 =  *_t81 + 1;
					_t82 = _t81 + _t98;
					__eflags = _t82;
					if (_t82 > 0) goto L8;
					_t83 = _t82 + _t98;
					asm("aas");
					 *_t83 =  *_t83 + _t83;
					asm("clc");
					asm("aas");
					 *_t83 =  *_t83 + _t83;
					asm("clc");
					asm("aas");
					 *_t83 =  *_t83 + _t83;
					asm("rol byte [edi], 0x0");
					 *((intOrPtr*)(_t83 - 0x7ffffffd)) =  *((intOrPtr*)(_t83 - 0x7ffffffd)) + _t83;
					_t84 = _t83 +  *_t83;
					 *((intOrPtr*)(_t84 - 0x3ffffffd)) =  *((intOrPtr*)(_t84 - 0x3ffffffd)) + _t84;
					es = es;
					 *_t84 =  *_t84 + _t84;
					asm("clc");
					asm("aas");
					 *_t84 =  *_t84 + _t84;
					asm("clc");
					asm("aas");
					 *_t84 =  *_t84 + _t84;
					asm("clc");
					asm("aas");
					 *_t84 =  *_t84 + _t84;
					__eflags =  *_t84;
					asm("cld");
					if ( *_t84 > 0) goto L9;
					 *_t84 =  *_t84 + 1;
					 *_t84 =  *_t84 + _t112;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t116;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t112 =  *_t112 + _t84;
					 *_t84 =  *_t84 + _t112;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *_t84 =  *_t84 + _t84;
					 *((intOrPtr*)(_t120 - 0x5eff6061)) =  *((intOrPtr*)(_t120 - 0x5eff6061)) + _t98 + _t98;
					_t85 =  *0xa5a500a1;
					asm("movsd");
					 *((intOrPtr*)(_t116 - 0x4dff5556)) =  *((intOrPtr*)(_t116 - 0x4dff5556)) + _t112;
					_t41 = _t134 + 0xfffffffecdcd0cb4;
					 *_t41 =  *((intOrPtr*)(_t134 + 0xfffffffecdcd0cb4)) + 0xb2;
					__eflags =  *_t41;
					return _t85;
				} else {
					asm("out 0xf7, eax");
					 *__ecx =  *__ecx + __ecx;
					 *__ecx =  *__ecx + __ecx;
					 *__ecx =  *__ecx + __ecx;
					 *__ecx =  *__ecx + __ecx;
					_push(cs);
					_t89 = __ecx +  *__ecx;
					 *_t89 =  *_t89 + _t89;
					 *((intOrPtr*)(_t89 + 0x72)) =  *((intOrPtr*)(_t89 + 0x72)) + __edx;
					asm("outsd");
					_push(0x65);
					asm("arpl [ecx+esi], si");
					 *_t89 =  *_t89 + _t89;
					_t90 = _t89 + _t49;
					L7();
					 *_t90 =  *_t90 + _t90;
					 *_t90 =  *_t90 ^ _t90;
					asm("invalid");
					goto 0xaee36200;
					asm("adc ch, [eax-0x59]");
					return _t125 + 1;
					asm("popad");
					if (__eflags != 0) goto 0x4015cd;
				}
			}

0x004015d4
0x004015d4
0x004015d4
0x004015d4
0x004015d4
0x004015d9
0x004015de
0x004015e0
0x004015e2
0x004015e4
0x004015e6
0x004015e8
0x004015e9
0x004015eb
0x004015ed
0x004015ef
0x004015f5
0x004015f7
0x004015f8
0x004015f8
0x004015f9
0x004015fa
0x00401660
0x00401662
0x00401664
0x00401666
0x00401668
0x0040166a
0x0040166c
0x0040166e
0x00401670
0x00401672
0x00401674
0x00401676
0x00401678
0x0040167a
0x0040167e
0x00401680
0x00401683
0x00401685
0x00401687
0x00401687
0x00401687
0x0040168a
0x0040168c
0x00401695
0x00401697
0x00401699
0x0040169a
0x0040169b
0x0040169d
0x0040169e
0x0040169f
0x004016a0
0x004016a1
0x004016a3
0x004016a5
0x004016a6
0x004016a8
0x004016aa
0x004016ab
0x004016ad
0x004016b1
0x004016b3
0x004016b5
0x004016b7
0x004016b9
0x004016bb
0x004016bd
0x004016bf
0x004016c1
0x004016c3
0x004016c6
0x004016c8
0x004016c9
0x004016cb
0x004016cd
0x004016cf
0x004016d1
0x004016d3
0x004016d5
0x004016d7
0x004016d9
0x004016db
0x004016dd
0x004016df
0x004016e1
0x004016e3
0x004016e5
0x004016e7
0x004016e9
0x004016eb
0x004016ed
0x004016ef
0x004016f1
0x004016f3
0x004016f5
0x004016f7
0x004016f7
0x004016f7
0x004016f7
0x004016f8
0x004016f9
0x004016fa
0x004016fb
0x00401701
0x00401702
0x00401703
0x0040170b
0x00401717
0x00401719
0x0040171a
0x0040171b
0x0040171d
0x0040171e
0x00401721
0x00401725
0x00401727
0x00401729
0x0040172b
0x0040172d
0x0040172f
0x00401731
0x00401733
0x00401735
0x00401737
0x00401739
0x0040173b
0x0040173d
0x0040173f
0x00401741
0x00401743
0x00401745
0x00401747
0x00401749
0x0040174b
0x0040174d
0x0040174f
0x00401751
0x00401753
0x00401755
0x00401757
0x00401759
0x0040175b
0x0040175d
0x0040175f
0x00401761
0x00401763
0x00401765
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176f
0x00401771
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x0040177d
0x0040177f
0x00401781
0x00401783
0x00401785
0x00401787
0x00401789
0x0040178b
0x0040178d
0x0040178f
0x00401791
0x00401793
0x00401795
0x00401797
0x00401799
0x0040179b
0x0040179d
0x0040179f
0x004017a1
0x004017a3
0x004017a5
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b1
0x004017b3
0x004017b5
0x004017b7
0x004017b9
0x004017bb
0x004017bd
0x004017bf
0x004017c1
0x004017c3
0x004017c5
0x004017c7
0x004017c9
0x004017cb
0x004017cd
0x004017cf
0x004017d1
0x004017d3
0x004017d5
0x004017d7
0x004017d9
0x004017db
0x004017dd
0x004017df
0x004017e1
0x004017e3
0x004017e5
0x004017e7
0x004017e9
0x004017eb
0x004017ed
0x004017ef
0x004017f1
0x004017f3
0x004017f5
0x004017f7
0x004017f9
0x004017fb
0x004017fd
0x004017ff
0x00401801
0x00401803
0x00401805
0x00401807
0x00401809
0x0040180b
0x0040180d
0x0040180f
0x00401811
0x00401813
0x00401815
0x00401817
0x00401819
0x0040181b
0x0040181d
0x0040181f
0x00401821
0x00401823
0x00401825
0x00401827
0x00401829
0x0040182b
0x0040182d
0x0040182f
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401845
0x00401847
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x00401859
0x0040185b
0x0040185d
0x0040185f
0x00401861
0x00401863
0x00401865
0x00401867
0x00401869
0x0040186b
0x0040186d
0x0040186f
0x00401871
0x00401873
0x00401875
0x00401877
0x00401879
0x0040187b
0x0040187d
0x0040187f
0x00401881
0x00401883
0x00401885
0x00401887
0x00401889
0x0040188b
0x0040188d
0x0040188f
0x00401891
0x00401893
0x00401895
0x00401897
0x00401899
0x0040189b
0x0040189d
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b7
0x004018b9
0x004018bb
0x004018bd
0x004018bf
0x004018c1
0x004018c3
0x004018c5
0x004018c7
0x004018c9
0x004018cb
0x004018cd
0x004018cf
0x004018d1
0x004018d3
0x004018d5
0x004018d7
0x004018d9
0x004018db
0x004018dd
0x004018df
0x004018e1
0x004018e3
0x004018e5
0x004018e7
0x004018e9
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018ff
0x00401901
0x00401903
0x00401905
0x00401907
0x00401909
0x0040190b
0x0040190d
0x0040190f
0x00401911
0x00401913
0x00401915
0x00401917
0x00401917
0x00401919
0x0040191b
0x0040191d
0x0040191f
0x00401921
0x00401923
0x00401925
0x00401927
0x00401929
0x0040192b
0x0040192d
0x0040192f
0x00401931
0x00401933
0x00401935
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401943
0x00401945
0x00401947
0x00401949
0x0040194b
0x0040194d
0x0040194f
0x00401951
0x00401953
0x00401955
0x00401957
0x00401959
0x0040195b
0x0040195d
0x0040195f
0x00401961
0x00401963
0x00401965
0x00401967
0x00401969
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401977
0x00401979
0x0040197b
0x0040197d
0x0040197f
0x00401981
0x00401983
0x00401985
0x00401987
0x00401989
0x0040198b
0x0040198d
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401997
0x00401999
0x0040199b
0x0040199d
0x0040199f
0x004019a1
0x004019a3
0x004019a5
0x004019a7
0x004019a9
0x004019ab
0x004019ad
0x004019af
0x004019b1
0x004019b3
0x004019b5
0x004019b7
0x004019b9
0x004019bb
0x004019bd
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c7
0x004019c9
0x004019cb
0x004019cd
0x004019cf
0x004019d1
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019e1
0x004019e3
0x004019e5
0x004019e7
0x004019e9
0x004019eb
0x004019ed
0x004019ef
0x004019f1
0x004019f3
0x004019f5
0x004019f7
0x004019f9
0x004019fb
0x004019fd
0x004019ff
0x00401a01
0x00401a03
0x00401a05
0x00401a07
0x00401a09
0x00401a0b
0x00401a0d
0x00401a0f
0x00401a11
0x00401a13
0x00401a15
0x00401a17
0x00401a19
0x00401a1b
0x00401a1d
0x00401a1f
0x00401a21
0x00401a23
0x00401a25
0x00401a27
0x00401a29
0x00401a2b
0x00401a2d
0x00401a2f
0x00401a31
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a41
0x00401a43
0x00401a45
0x00401a47
0x00401a49
0x00401a4b
0x00401a4d
0x00401a4f
0x00401a51
0x00401a53
0x00401a55
0x00401a57
0x00401a59
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a61
0x00401a63
0x00401a65
0x00401a67
0x00401a69
0x00401a6b
0x00401a6d
0x00401a6f
0x00401a71
0x00401a73
0x00401a75
0x00401a77
0x00401a79
0x00401a7b
0x00401a7d
0x00401a7f
0x00401a81
0x00401a83
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a8d
0x00401a8f
0x00401a91
0x00401a93
0x00401a95
0x00401a97
0x00401a99
0x00401a9b
0x00401a9d
0x00401a9f
0x00401aa1
0x00401aa3
0x00401aa5
0x00401aa7
0x00401aa9
0x00401aab
0x00401aad
0x00401aaf
0x00401ab1
0x00401ab3
0x00401ab5
0x00401ab7
0x00401ab9
0x00401abb
0x00401abd
0x00401abf
0x00401ac1
0x00401ac3
0x00401ac5
0x00401ac7
0x00401ac9
0x00401acb
0x00401acd
0x00401acf
0x00401ad1
0x00401ad3
0x00401ad5
0x00401ad7
0x00401ad9
0x00401adb
0x00401add
0x00401adf
0x00401ae1
0x00401ae3
0x00401ae5
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af1
0x00401af3
0x00401af5
0x00401af7
0x00401af9
0x00401afb
0x00401afd
0x00401aff
0x00401b01
0x00401b03
0x00401b05
0x00401b07
0x00401b09
0x00401b0b
0x00401b0d
0x00401b0f
0x00401b11
0x00401b13
0x00401b15
0x00401b17
0x00401b19
0x00401b1b
0x00401b1d
0x00401b1f
0x00401b21
0x00401b23
0x00401b25
0x00401b27
0x00401b2b
0x00401b2c
0x00401b2d
0x00401b2f
0x00401b31
0x00401b33
0x00401b35
0x00401b37
0x00401b39
0x00401b3b
0x00401b3d
0x00401b3f
0x00401b41
0x00401b43
0x00401b45
0x00401b47
0x00401b4d
0x00401b4f
0x00401b51
0x00401b53
0x00401b55
0x00401b60
0x00401b62
0x00401b64
0x00401b70
0x00401b72
0x00401b74
0x00401b76
0x00401b77
0x00401b78
0x00401b79
0x00401b7a
0x00401b7b
0x00401b7c
0x00401b7d
0x00401b7e
0x00401b81
0x00401b83
0x00401b8b
0x00401b90
0x00401b92
0x00401b94
0x00401b98
0x00401ba0
0x00401ba2
0x00401ba4
0x00401ba6
0x00401ba8
0x00401bac
0x00401bae
0x00401bb0
0x00401bb2
0x00401bb4
0x00401bb6
0x00401bb8
0x00401bba
0x00401bbc
0x00401bbe
0x00401bc0
0x00401bc2
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bca
0x00401bcf
0x00401bd1
0x00401bd3
0x00401bd5
0x00401bd7
0x00401bd9
0x00401bdb
0x00401bdd
0x00401bdf
0x00401be1
0x00401be3
0x00401be5
0x00401be7
0x00401be9
0x00401beb
0x00401bed
0x00401bef
0x00401bf1
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfb
0x00401bfb
0x00401bfd
0x00401bff
0x00401c01
0x00401c02
0x00401c04
0x00401c05
0x00401c06
0x00401c08
0x00401c09
0x00401c0a
0x00401c0c
0x00401c0f
0x00401c15
0x00401c17
0x00401c1d
0x00401c1e
0x00401c20
0x00401c21
0x00401c22
0x00401c24
0x00401c25
0x00401c26
0x00401c28
0x00401c29
0x00401c2a
0x00401c2a
0x00401c2c
0x00401c2d
0x00401c31
0x00401c33
0x00401c35
0x00401c37
0x00401c39
0x00401c3b
0x00401c3d
0x00401c3f
0x00401c41
0x00401c43
0x00401c45
0x00401c47
0x00401c49
0x00401c4b
0x00401c4d
0x00401c4f
0x00401c51
0x00401c53
0x00401c55
0x00401c57
0x00401c59
0x00401c5b
0x00401c5d
0x00401c5f
0x00401c65
0x00401c6a
0x00401c6b
0x00401c73
0x00401c73
0x00401c73
0x00401c7e
0x004015fc
0x004015fd
0x00401602
0x00401604
0x00401606
0x00401608
0x0040160a
0x0040160b
0x0040160d
0x0040160f
0x00401612
0x00401613
0x00401615
0x00401619
0x0040161b
0x0040161d
0x00401622
0x00401626
0x0040162a
0x0040162e
0x00401633
0x00401639
0x0040163a
0x0040163b
0x0040163b

APIs

#100.MSVBVM60(VB5!6&*), ref: 004015D9

Strings

VB5!6&*, xrefs: 004015D4, 0040169D

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: ae3ca8a06cc90735d1c3af12476dd21f3ac1569bce85b882b4b3dabe8faa8d93
Instruction ID: 17d16463fa94a7778ad62617a7c6e3cc76d041614794308ad54a93a16c4d8b09
Opcode Fuzzy Hash: ae3ca8a06cc90735d1c3af12476dd21f3ac1569bce85b882b4b3dabe8faa8d93
Instruction Fuzzy Hash: 1D41A76548E3C05FD3039B748C665927FB09E5722874A85EBC4D1CF0E3D19D885AC762

Uniqueness

Uniqueness Score: -1.00%

Function 00404D14, Relevance: 1.4, APIs: 1, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3ece3de6116f799d08fced11979e9030228e9c632497e6ded61dd102cc692e
Instruction ID: 49041cb6ab5af904b705e0cc5faf145f8b63b585c87878ba0717a58313c76a76
Opcode Fuzzy Hash: 0e3ece3de6116f799d08fced11979e9030228e9c632497e6ded61dd102cc692e
Instruction Fuzzy Hash: 6B3167E1627241FBD7210B78EC9126673C4EF82F407216877CA85DA398EE2C09D3D20A

Uniqueness

Uniqueness Score: -1.00%

Function 00404D44, Relevance: 1.4, APIs: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bc2eac026da360def27c73d8e308f2a4dc20547b90a26e000580750a1a454abd
Instruction ID: 7ec689c71796e52e1c35fb814687dbed03b434dd24c097a4519ee37ebff009cf
Opcode Fuzzy Hash: bc2eac026da360def27c73d8e308f2a4dc20547b90a26e000580750a1a454abd
Instruction Fuzzy Hash: E63169E2667241FBD7210F78EC912667395FF82F40710686BC649DA358EE2C05D3D606

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA0, Relevance: 1.4, APIs: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 77575c7b0a0b382cf04d479ca981024207e73b4ec077c7e27456feefeab857bf
Instruction ID: 5643cdd3a9b41dac777442cdfb7dc9655c2fd6d25812b4f09d67653687472567
Opcode Fuzzy Hash: 77575c7b0a0b382cf04d479ca981024207e73b4ec077c7e27456feefeab857bf
Instruction Fuzzy Hash: D22157E2767251FBC7220F78ECA12667395FF82F50710686BC545CA358EE2C49D3D60A

Uniqueness

Uniqueness Score: -1.00%

Function 00404DBB, Relevance: 1.4, APIs: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ec6e609a2bc119517f982e2bea41e33b82eaac2e46e0f24733bf3ec3fd5214de
Instruction ID: f23ccb14674e4b4e56fe838b29c97b2458edec85a47f11d4f986585c0a99aff6
Opcode Fuzzy Hash: ec6e609a2bc119517f982e2bea41e33b82eaac2e46e0f24733bf3ec3fd5214de
Instruction Fuzzy Hash: 0F219AE2767381FBC7220F78EC952627791FF82F90710296AC185C9358EE2C0593E706

Uniqueness

Uniqueness Score: -1.00%

Function 00404E19, Relevance: 1.4, APIs: 1, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9f2ddc512bef2f4b0ca66906a7bbf1c349efea55285ac138e417299e4e52ecff
Instruction ID: a7512c5b28c67ff6cffe9d8e3a888c348f9a92db3f38a96148106c121ae2d177
Opcode Fuzzy Hash: 9f2ddc512bef2f4b0ca66906a7bbf1c349efea55285ac138e417299e4e52ecff
Instruction Fuzzy Hash: 8D115CE2727352EBC7620F68EC55325B3D1FB81F90311286AC181DA258EA2D0593D707

Uniqueness

Uniqueness Score: -1.00%

Function 00404DEB, Relevance: 1.4, APIs: 1, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0f597d0f126f36bb3b93017422fda5630a93cebb8b933f2e7bf563ba10da5c20
Instruction ID: cf9532c3a1498b1abe888b11d7f1a70a156150798d8f640d4c24237e88f95fa7
Opcode Fuzzy Hash: 0f597d0f126f36bb3b93017422fda5630a93cebb8b933f2e7bf563ba10da5c20
Instruction Fuzzy Hash: 4021ADE2727341FBC7620F68ECA136273D1FB82F90710292AC185CA358EA2D0993D707

Uniqueness

Uniqueness Score: -1.00%

Function 00404E82, Relevance: 1.4, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0217821729afa742422451a39beda754076029f2d5117f57c3e6764bebaaa381
Instruction ID: 8f53ca666fe7f8bf5a2b3fd7eeeabf76bac82bb4513188bb00d5c3b018c1666a
Opcode Fuzzy Hash: 0217821729afa742422451a39beda754076029f2d5117f57c3e6764bebaaa381
Instruction Fuzzy Hash: 7E213BE2627342EBC7620F68EC952617391FB82F50711596AC181DA2ACEF2D0993E706

Uniqueness

Uniqueness Score: -1.00%

Function 00404E55, Relevance: 1.3, APIs: 1, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,FFFFA153,-0000007E), ref: 00404E7E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 36ada4c72c17da691f8f761aa8cd242ff9ea66ed2bd3d0e376166ab7b8759906
Instruction ID: aea3e42b99ce379337abfa3ad7d8909a20446f7f481f7b66c3c311513bd6e1c2
Opcode Fuzzy Hash: 36ada4c72c17da691f8f761aa8cd242ff9ea66ed2bd3d0e376166ab7b8759906
Instruction Fuzzy Hash: 0F115BE6B67351EBC7620F58E8A432577D1B781F903101C6BC148C912CEA295693E707

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02216056, Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

`, xrefs: 02216115

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 9a8a7f06caacc51a3a3fe9570471597547ef2b89e5ede9999ff7cf9aa2994ae9
Instruction ID: 7a6d3e6c2019ca942504ee708369b0e0e6eb79b8c118afb2e7f7c65fa7eefcd5
Opcode Fuzzy Hash: 9a8a7f06caacc51a3a3fe9570471597547ef2b89e5ede9999ff7cf9aa2994ae9
Instruction Fuzzy Hash: EE01FE3AA3071689FF3D0594C564FFD21976F52358F90813ECC4916149D76AC4C58941

Uniqueness

Uniqueness Score: -1.00%

Function 02211D88, Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bb4e3e904dd45b6e9fdf911f5a611f05428083a745c460b383379577a1c6e4
Instruction ID: cf5bfe854d648c3479c3c86a4b15d0bc476f36c2f2c3bd20a142043a612bf7a2
Opcode Fuzzy Hash: a7bb4e3e904dd45b6e9fdf911f5a611f05428083a745c460b383379577a1c6e4
Instruction Fuzzy Hash: A8F14571720716AFE7249E68CC90FDAB3E5FF65360F544325FCA993288D764A894CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02216AF5, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4020d9ea46bea62fec8541def0bcab43ba395e4d6de12c290c402f7dee42ac
Instruction ID: 08e9d803c9694ef7b205fd84c17c524f0b90fabd9f4a9c56c9244a59f1aba145
Opcode Fuzzy Hash: fa4020d9ea46bea62fec8541def0bcab43ba395e4d6de12c290c402f7dee42ac
Instruction Fuzzy Hash: F9A1F6746243438EDF25CFA8C4D4FA9BBD1AF62360F4482A9D8968B2DEC771C442C712

Uniqueness

Uniqueness Score: -1.00%

Function 02216B35, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220cb4e095bdde33079bb9e67cfde9538ecedf822f176114c6378c91b09d549c
Instruction ID: 52ceef9af29d36e2bb1558a68ec56da421b377bde96bf60f4077ca7581c3ffd3
Opcode Fuzzy Hash: 220cb4e095bdde33079bb9e67cfde9538ecedf822f176114c6378c91b09d549c
Instruction Fuzzy Hash: 015106746143829EDB259F68C8D4FA5BBD6EF26260F0886ADDC958B1DAC336C442C711

Uniqueness

Uniqueness Score: -1.00%

Function 02216AE8, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9194dae003e4b19be831fd7ae786c122f77d42e81b379085015ef2aa7b34b5
Instruction ID: 5820175a64332cc96c4c11a89292c78d312c58f268bfc2971d875e5adb7dcfda
Opcode Fuzzy Hash: fc9194dae003e4b19be831fd7ae786c122f77d42e81b379085015ef2aa7b34b5
Instruction Fuzzy Hash: 3C51E3746183438EDB14CF68C4D4FA9BBE2AF62350F4982ADDC958B2EAC331C446C712

Uniqueness

Uniqueness Score: -1.00%

Function 022126B7, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ccc828b5e807b02d384fe993b3a0d4f675d4fbeeaa30d82b20245fb42aa2cc
Instruction ID: c6e4967547a4e4aefa7e61a6b943830958ac6821eb1f42bd45d93729fb0621c7
Opcode Fuzzy Hash: c7ccc828b5e807b02d384fe993b3a0d4f675d4fbeeaa30d82b20245fb42aa2cc
Instruction Fuzzy Hash: 7A411070220345DFEB209EA8CC94FD973E7BF64354F9542A9ED468B2D9C7B58880CA11

Uniqueness

Uniqueness Score: -1.00%

Function 02212459, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caac44fea577105b0cefae6a45faa1e3158a020ac652329bde641d12209212e1
Instruction ID: f091fc6944895a3fbaa67aee305fd21a64f9ae6df61681b47dedadeafb29a39c
Opcode Fuzzy Hash: caac44fea577105b0cefae6a45faa1e3158a020ac652329bde641d12209212e1
Instruction Fuzzy Hash: 49417731610686AFE7A66E68CD21BE673D9FF19330F000724FC68D6AC5E7299C55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 022124A7, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d9a3b1187b24e21dfd146c75b1a603aae474ec1b7284bbc6a66a923ba55c50
Instruction ID: 356c07938b47c73223a3bf335d9766c749e7799035c45334e5cf9355984e0ae4
Opcode Fuzzy Hash: 73d9a3b1187b24e21dfd146c75b1a603aae474ec1b7284bbc6a66a923ba55c50
Instruction Fuzzy Hash: 9B313471710656AFE7645A28CD20FDA72D5FF113B0F144324FC68E32D5EB69AC888B80

Uniqueness

Uniqueness Score: -1.00%

Function 02216EA1, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c23e4c76764374c50541b79490648719b013b932cfb7a610450c803ba713a9b
Instruction ID: b3e267abd9342adc3505233f7e180642e74a337fa093ccce4ee4b3bb888b5c3d
Opcode Fuzzy Hash: 4c23e4c76764374c50541b79490648719b013b932cfb7a610450c803ba713a9b
Instruction Fuzzy Hash: 03014928A243435EEF318AB4C5D8FBCA6D49F23264F048369D9A24A1DED761C481C313

Uniqueness

Uniqueness Score: -1.00%

Function 022168D4, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4376908f051fd330c4c12b3a51abdb1b941505443a27a161cd4e0c336b52a92a
Instruction ID: b704c50f47c93614dc3c3d02186774bdfa05285514b67a658745cde9eda3819e
Opcode Fuzzy Hash: 4376908f051fd330c4c12b3a51abdb1b941505443a27a161cd4e0c336b52a92a
Instruction Fuzzy Hash: EDF02E641493475FFB5105B44DA47D53A519F03370F21425DED25DF1D5D75DCC885212

Uniqueness

Uniqueness Score: -1.00%

Function 022168E1, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceadc238ed0e011522ea1534005d5b7a9486fab9e93a61c01eb26225b38356e5
Instruction ID: 2d201020db6fcef06ec84ac876b1963ce927fafd02a4a43fef69a86ecc535979
Opcode Fuzzy Hash: ceadc238ed0e011522ea1534005d5b7a9486fab9e93a61c01eb26225b38356e5
Instruction Fuzzy Hash: 42E0D16514520B6FFB65059899B5BE525469F43370F304318ED1AA72C8D79DCCC81111

Uniqueness

Uniqueness Score: -1.00%

Function 02215F3E, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b325c2cd64102e488941184ffcbf60caa3b4852f494ec842ef32bd6f6d4cf2d
Instruction ID: 30c9cbca692058663ea218a98ca6f1077b22872eaf33727dfeaed890aaa82ca7
Opcode Fuzzy Hash: 3b325c2cd64102e488941184ffcbf60caa3b4852f494ec842ef32bd6f6d4cf2d
Instruction Fuzzy Hash: 39F030343213409FC319CA68C988F6673E5EFA6710F8185E8ED06CB2A9DB30E850CA10

Uniqueness

Uniqueness Score: -1.00%

Function 02213567, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f23a6accc21b2d31ad1793f8c5f15e148e6c986d091d4308b19987957ec1b3
Instruction ID: d31242d08a3cbf79b10b1791c774f8972a7793264369b9380140df0f58245a7b
Opcode Fuzzy Hash: 48f23a6accc21b2d31ad1793f8c5f15e148e6c986d091d4308b19987957ec1b3
Instruction Fuzzy Hash: 6BC092B7601680CFEF02CE08C8A6B8073B4FB2AA84B4905D0EC02DF712E328ED00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 022159EE, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367578842.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3bc9c0c6007b01c299265b3952082ba5243596192c7a681530fbdb5fc67f6f
Instruction ID: 013a42a05c75f67c0c9a8e7124ca2841171609ebd1802a88a6fb24736e5a3d12
Opcode Fuzzy Hash: 1d3bc9c0c6007b01c299265b3952082ba5243596192c7a681530fbdb5fc67f6f
Instruction Fuzzy Hash: 42B09231A55540CFCA82CE48C180F80B3A1FF08A40B820480F4228BA91C364EC80CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00411161, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00411161(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				char _v36;
				signed int _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v60;
				char _v68;
				intOrPtr _v76;
				char _v84;
				char _v100;
				intOrPtr _v140;
				char _v148;
				void* _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				intOrPtr* _v168;
				signed int _v172;
				intOrPtr* _v176;
				signed int _v180;
				signed int _v192;
				intOrPtr* _v196;
				signed int _v200;
				intOrPtr* _v204;
				signed int _v208;
				char _v212;
				signed int _v216;
				signed int _v220;
				intOrPtr _t105;
				short _t110;
				char* _t114;
				char* _t118;
				signed int _t122;
				char* _t126;
				signed int _t130;
				signed int _t136;
				signed int _t141;
				void* _t159;
				void* _t161;
				intOrPtr _t162;

				_t162 = _t161 - 0xc;
				 *[fs:0x0] = _t162;
				L004013D0();
				_v16 = _t162;
				_v12 = 0x401258;
				_v8 = 0;
				_t105 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013d6, _t159);
				_v76 = 1;
				_v84 = 2;
				_push(0x4031bc);
				_push(0x4033f8);
				L004015A4();
				_v60 = _t105;
				_v68 = 8;
				_push( &_v84);
				_push(2);
				_push( &_v68);
				_push( &_v100);
				L0040150E();
				_v140 = 0x4033f8;
				_v148 = 0x8008;
				_push( &_v100);
				_t110 =  &_v148;
				_push(_t110);
				L00401520();
				_v152 = _t110;
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_push(3);
				L00401574();
				_t114 = _v152;
				if(_t114 != 0) {
					if( *0x414010 != 0) {
						_v196 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v196 = 0x414010;
					}
					_t118 =  &_v44;
					L00401586();
					_v152 = _t118;
					_t122 =  *((intOrPtr*)( *_v152 + 0x48))(_v152,  &_v32, _t118,  *((intOrPtr*)( *((intOrPtr*)( *_v196)) + 0x304))( *_v196));
					asm("fclex");
					_v156 = _t122;
					if(_v156 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4031c0);
						_push(_v152);
						_push(_v156);
						L0040158C();
						_v200 = _t122;
					}
					if( *0x414010 != 0) {
						_v204 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v204 = 0x414010;
					}
					_t126 =  &_v48;
					L00401586();
					_v160 = _t126;
					_t130 =  *((intOrPtr*)( *_v160 + 0x48))(_v160,  &_v36, _t126,  *((intOrPtr*)( *((intOrPtr*)( *_v204)) + 0x304))( *_v204));
					asm("fclex");
					_v164 = _t130;
					if(_v164 >= 0) {
						_v208 = _v208 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4031c0);
						_push(_v160);
						_push(_v164);
						L0040158C();
						_v208 = _t130;
					}
					if( *0x41433c != 0) {
						_v212 = 0x41433c;
					} else {
						_push(0x41433c);
						_push(0x4033d8);
						L00401580();
						_v212 = 0x41433c;
					}
					_t61 =  &_v212; // 0x41433c
					_v168 =  *((intOrPtr*)( *_t61));
					_t136 =  *((intOrPtr*)( *_v168 + 0x4c))(_v168,  &_v52);
					asm("fclex");
					_v172 = _t136;
					if(_v172 >= 0) {
						_v216 = _v216 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x4033c8);
						_push(_v168);
						_push(_v172);
						L0040158C();
						_v216 = _t136;
					}
					_v176 = _v52;
					_t141 =  *((intOrPtr*)( *_v176 + 0x24))(_v176, _v32, _v36,  &_v40);
					asm("fclex");
					_v180 = _t141;
					if(_v180 >= 0) {
						_v220 = _v220 & 0x00000000;
					} else {
						_push(0x24);
						_push(0x403420);
						_push(_v176);
						_push(_v180);
						L0040158C();
						_v220 = _t141;
					}
					_v192 = _v40;
					_v40 = _v40 & 0x00000000;
					L004015B0();
					_push( &_v36);
					_push( &_v32);
					_push(2);
					L0040159E();
					_push( &_v52);
					_push( &_v48);
					_t114 =  &_v44;
					_push(_t114);
					_push(3);
					L0040157A();
				}
				_push(0x4114f4);
				L00401568();
				return _t114;
			}

0x00411164
0x00411173
0x0041117f
0x00411187
0x0041118a
0x00411191
0x004111a0
0x004111a3
0x004111aa
0x004111b1
0x004111b6
0x004111bb
0x004111c0
0x004111c3
0x004111cd
0x004111ce
0x004111d3
0x004111d7
0x004111d8
0x004111dd
0x004111e7
0x004111f4
0x004111f5
0x004111fb
0x004111fc
0x00411201
0x0041120b
0x0041120f
0x00411213
0x00411214
0x00411216
0x0041121e
0x00411227
0x00411234
0x00411251
0x00411236
0x00411236
0x0041123b
0x00411240
0x00411245
0x00411245
0x00411275
0x00411279
0x0041127e
0x00411296
0x00411299
0x0041129b
0x004112a8
0x004112ca
0x004112aa
0x004112aa
0x004112ac
0x004112b1
0x004112b7
0x004112bd
0x004112c2
0x004112c2
0x004112d8
0x004112f5
0x004112da
0x004112da
0x004112df
0x004112e4
0x004112e9
0x004112e9
0x00411319
0x0041131d
0x00411322
0x0041133a
0x0041133d
0x0041133f
0x0041134c
0x0041136e
0x0041134e
0x0041134e
0x00411350
0x00411355
0x0041135b
0x00411361
0x00411366
0x00411366
0x0041137c
0x00411399
0x0041137e
0x0041137e
0x00411383
0x00411388
0x0041138d
0x0041138d
0x004113a3
0x004113ab
0x004113c3
0x004113c6
0x004113c8
0x004113d5
0x004113f7
0x004113d7
0x004113d7
0x004113d9
0x004113de
0x004113e4
0x004113ea
0x004113ef
0x004113ef
0x00411401
0x0041141f
0x00411422
0x00411424
0x00411431
0x00411453
0x00411433
0x00411433
0x00411435
0x0041143a
0x00411440
0x00411446
0x0041144b
0x0041144b
0x0041145d
0x00411463
0x00411470
0x00411478
0x0041147c
0x0041147d
0x0041147f
0x0041148a
0x0041148e
0x0041148f
0x00411492
0x00411493
0x00411495
0x0041149a
0x0041149d
0x004114ee
0x004114f3

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 0041117F
__vbaStrCat.MSVBVM60(004033F8,004031BC), ref: 004111BB
#632.MSVBVM60(?,00000008,00000002,00000002,004033F8,004031BC), ref: 004111D8
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,00000008,00000002,00000002), ref: 004111FC
__vbaFreeVarList.MSVBVM60(00000003,00000008,00000002,?,00008008,?), ref: 00411216
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,004013D6), ref: 00411240
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411279
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000048), ref: 004112BD
__vbaNew2.MSVBVM60(004029C8, b), ref: 004112E4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041131D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000048), ref: 00411361
__vbaNew2.MSVBVM60(004033D8,0041433C), ref: 00411388
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,0000004C), ref: 004113EA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403420,00000024), ref: 00411446
__vbaStrMove.MSVBVM60(00000000,?,00403420,00000024), ref: 00411470
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041147F
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00411495
__vbaFreeStr.MSVBVM60(004114F4,?,?,?,004013D6), ref: 004114EE

Strings

b, xrefs: 0041122D, 00411236, 00411245, 00411251, 004112D1, 004112DA, 004112E9, 004112F5
<CA, xrefs: 004113A3

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ListNew2$#632ChkstkMove
String ID: b$<CA
API String ID: 3602551525-1966994258
Opcode ID: 904a29f4964161b396abb277d8b174bfc495c3d363eb2ba19c51b6f3ac3fe51c
Instruction ID: 7a48e9bea69f3ff984d664b97799eb3b84357dc16687bdcb2826afeda60cfcc2
Opcode Fuzzy Hash: 904a29f4964161b396abb277d8b174bfc495c3d363eb2ba19c51b6f3ac3fe51c
Instruction Fuzzy Hash: 0C91D971A00218EFDB10DF95CC45FDDBBB8BB48704F1041EAE609BB2A1D7789A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00412198, Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00412198(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v44;
				void* _v48;
				intOrPtr _v56;
				char _v64;
				signed int _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr _v104;
				char _v112;
				char _v128;
				intOrPtr _v136;
				intOrPtr _v144;
				void* _v196;
				signed int _v200;
				intOrPtr* _v204;
				signed int _v208;
				signed int _v220;
				char _v224;
				signed int _v228;
				signed int _v232;
				char* _t80;
				signed int _t88;
				signed int _t94;
				void* _t109;
				void* _t111;
				intOrPtr _t112;

				_t112 = _t111 - 0xc;
				 *[fs:0x0] = _t112;
				L004013D0();
				_v16 = _t112;
				_v12 = 0x401300;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013d6, _t109);
				L0040154A();
				_v104 = 5;
				_v112 = 2;
				_v88 = 0x63;
				_v96 = 2;
				_t13 =  &_v72;
				 *_t13 = _v72 & 0x00000000;
				_v80 = 2;
				_v56 = 0x64;
				_v64 = 2;
				_push( &_v112);
				_push( &_v96);
				_push( &_v80);
				_push( &_v64);
				_push( &_v128);
				L004014AE();
				_push( &_v128);
				_t80 =  &_v44;
				_push(_t80);
				L004014B4();
				_push(_t80);
				L004014BA();
				L00401532();
				asm("fcomp qword [0x4012f8]");
				asm("fnstsw ax");
				asm("sahf");
				if( *_t13 == 0) {
					_v220 = _v220 & 0x00000000;
				} else {
					_v220 = 1;
				}
				_v196 =  ~_v220;
				L00401568();
				_push( &_v128);
				_push( &_v112);
				_push( &_v96);
				_push( &_v80);
				_push( &_v64);
				_push(5);
				L00401574();
				_t88 = _v196;
				if(_t88 != 0) {
					if( *0x41433c != 0) {
						_v224 = 0x41433c;
					} else {
						_push(0x41433c);
						_push(0x4033d8);
						L00401580();
						_v224 = 0x41433c;
					}
					_t39 =  &_v224; // 0x41433c
					_v196 =  *((intOrPtr*)( *_t39));
					_t94 =  *((intOrPtr*)( *_v196 + 0x1c))(_v196,  &_v48);
					asm("fclex");
					_v200 = _t94;
					if(_v200 >= 0) {
						_v228 = _v228 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x4033c8);
						_push(_v196);
						_push(_v200);
						L0040158C();
						_v228 = _t94;
					}
					_v204 = _v48;
					_v136 = 0x80020004;
					_v144 = 0xa;
					L004013D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t88 =  *((intOrPtr*)( *_v204 + 0x60))(_v204, L"Kamgarns8", 0x10);
					asm("fclex");
					_v208 = _t88;
					if(_v208 >= 0) {
						_v232 = _v232 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x403528);
						_push(_v204);
						_push(_v208);
						L0040158C();
						_v232 = _t88;
					}
					L0040156E();
				}
				asm("wait");
				_push(0x4123fd);
				L00401598();
				return _t88;
			}

0x0041219b
0x004121aa
0x004121b6
0x004121be
0x004121c1
0x004121c8
0x004121d7
0x004121e0
0x004121e5
0x004121ec
0x004121f3
0x004121fa
0x00412201
0x00412201
0x00412205
0x0041220c
0x00412213
0x0041221d
0x00412221
0x00412225
0x00412229
0x0041222d
0x0041222e
0x00412236
0x00412237
0x0041223a
0x0041223b
0x00412240
0x00412241
0x00412246
0x0041224b
0x00412251
0x00412253
0x00412254
0x00412262
0x00412256
0x00412256
0x00412256
0x00412271
0x0041227b
0x00412283
0x00412287
0x0041228b
0x0041228f
0x00412293
0x00412294
0x00412296
0x0041229e
0x004122a7
0x004122b4
0x004122d1
0x004122b6
0x004122b6
0x004122bb
0x004122c0
0x004122c5
0x004122c5
0x004122db
0x004122e3
0x004122fb
0x004122fe
0x00412300
0x0041230d
0x0041232f
0x0041230f
0x0041230f
0x00412311
0x00412316
0x0041231c
0x00412322
0x00412327
0x00412327
0x00412339
0x0041233f
0x00412349
0x00412356
0x00412363
0x00412364
0x00412365
0x00412366
0x0041237a
0x0041237d
0x0041237f
0x0041238c
0x004123ae
0x0041238e
0x0041238e
0x00412390
0x00412395
0x0041239b
0x004123a1
0x004123a6
0x004123a6
0x004123b8
0x004123b8
0x004123bd
0x004123be
0x004123f7
0x004123fc

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 004121B6
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 004121E0
#664.MSVBVM60(?,00000002,00000002,00000002,00000002), ref: 0041222E
__vbaStrVarVal.MSVBVM60(?,?,?,00000002,00000002,00000002,00000002), ref: 0041223B
#581.MSVBVM60(00000000,?,?,?,00000002,00000002,00000002,00000002), ref: 00412241
__vbaFpR8.MSVBVM60(00000000,?,?,?,00000002,00000002,00000002,00000002), ref: 00412246
__vbaFreeStr.MSVBVM60 ref: 0041227B
__vbaFreeVarList.MSVBVM60(00000005,00000002,00000002,00000002,00000002,?), ref: 00412296
__vbaNew2.MSVBVM60(004033D8,0041433C,?,?,?,?,?,004013D6), ref: 004122C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,0000001C), ref: 00412322
__vbaChkstk.MSVBVM60(00000000,?,004033C8,0000001C), ref: 00412356
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403528,00000060), ref: 004123A1
__vbaFreeObj.MSVBVM60(00000000,?,00403528,00000060), ref: 004123B8
__vbaFreeVar.MSVBVM60(004123FD,?,?,?,?,?,004013D6), ref: 004123F7

Strings

c, xrefs: 004121F3
Kamgarns8, xrefs: 00412367
<CA, xrefs: 004122DB
d, xrefs: 0041220C

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#581#664ListNew2
String ID: <CA$Kamgarns8$c$d
API String ID: 2251187687-944135169
Opcode ID: 3923735e0b706d1585803dd75eefe8ec1ca0523162a895cb242cc804c7b0098e
Instruction ID: dfffa874cfda739f8493fea6bfc420f7da5c08b0a1f41b22c6eb3177c82be47b
Opcode Fuzzy Hash: 3923735e0b706d1585803dd75eefe8ec1ca0523162a895cb242cc804c7b0098e
Instruction Fuzzy Hash: C6510671D0121CEBEB10DF91CD45FCDB7B8BB08704F1081AAE519BB1A1DBB85A888F65

Uniqueness

Uniqueness Score: -1.00%

Function 0041251D, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041251D(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, signed int* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v36;
				char _v48;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v116;
				signed int _v120;
				char _v124;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _t92;
				signed int _t93;
				char* _t98;
				signed int _t102;
				signed int _t106;
				char* _t110;
				signed int _t114;
				signed int _t117;
				intOrPtr _t122;
				intOrPtr _t128;
				void* _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t137;
				long long _t143;
				long long _t144;
				signed int _t146;
				signed int _t147;

				_t143 = __fp0;
				_t134 = _t133 - 0xc;
				 *[fs:0x0] = _t134;
				L004013D0();
				_v16 = _t134;
				_v12 = 0x401338;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x7c,  *[fs:0x0], 0x4013d6, _t131);
				 *_a24 =  *_a24 & 0x00000000;
				_push(5);
				_push(0x40353c);
				_t92 =  &_v48;
				_push(_t92);
				L004014A8();
				_v88 = _v88 & 0x00000000;
				if(_v88 >= 2) {
					L004014A2();
					_v116 = _t92;
				} else {
					_v116 = _v116 & 0x00000000;
				}
				_t93 = _v88;
				asm("fld1");
				 *((long long*)(_v36 + _t93 * 8)) = _t143;
				_v88 = 1;
				_t137 = _v88 - 2;
				if(_t137 >= 0) {
					L004014A2();
					_v120 = _t93;
				} else {
					_v120 = _v120 & 0x00000000;
				}
				_t122 = _v36;
				_t144 =  *0x4011f8;
				 *((long long*)(_t122 + _v88 * 8)) = _t144;
				_v80 =  &_v48;
				_push( &_v80);
				asm("fld1");
				_push(_t122);
				_push(_t122);
				 *_t134 = _t144;
				L0040149C();
				L00401532();
				asm("fcomp qword [0x401330]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t137 != 0) {
					if( *0x414010 != 0) {
						_v124 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v124 = 0x414010;
					}
					_t102 =  &_v72;
					L00401586();
					_v88 = _t102;
					_t106 =  *((intOrPtr*)( *_v88 + 0x160))(_v88,  &_v80, _t102,  *((intOrPtr*)( *((intOrPtr*)( *_v124)) + 0x308))( *_v124));
					asm("fclex");
					_v92 = _t106;
					if(_v92 >= 0) {
						_v128 = _v128 & 0x00000000;
					} else {
						_push(0x160);
						_push(0x4031d0);
						_push(_v88);
						_push(_v92);
						L0040158C();
						_v128 = _t106;
					}
					if( *0x414010 != 0) {
						_v132 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v132 = 0x414010;
					}
					_t128 =  *((intOrPtr*)( *_v132));
					_t110 =  &_v76;
					L00401586();
					_v96 = _t110;
					_t114 =  *((intOrPtr*)( *_v96 + 0x60))(_v96,  &_v84, _t110,  *((intOrPtr*)(_t128 + 0x308))( *_v132));
					asm("fclex");
					_v100 = _t114;
					if(_v100 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x4031d0);
						_push(_v96);
						_push(_v100);
						L0040158C();
						_v136 = _t114;
					}
					L00401592();
					_t146 =  *0x401324;
					 *_t134 = _t146;
					asm("fild dword [ebp-0x50]");
					_v140 = _t146;
					_t147 = _v140;
					_v116 = _t147;
					asm("fild dword [ebp-0x4c]");
					_v144 = _t147;
					_v120 = _v144;
					_v124 =  *0x401320;
					_t117 =  *((intOrPtr*)( *_a4 + 0x2c8))(_a4, 6, _t128, _t128, _t128, _t128, _t114);
					asm("fclex");
					_v104 = _t117;
					if(_v104 >= 0) {
						_v148 = _v148 & 0x00000000;
					} else {
						_push(0x2c8);
						_push(0x402fec);
						_push(_a4);
						_push(_v104);
						L0040158C();
						_v148 = _t117;
					}
					_push( &_v76);
					_push( &_v72);
					_push(2);
					L0040157A();
				}
				asm("wait");
				_push(0x4127c6);
				_v80 =  &_v48;
				_t98 =  &_v80;
				_push(_t98);
				_push(0);
				L00401496();
				return _t98;
			}

0x0041251d
0x00412520
0x0041252f
0x00412539
0x00412541
0x00412544
0x0041254b
0x0041255a
0x00412560
0x00412563
0x00412565
0x0041256a
0x0041256d
0x0041256e
0x00412573
0x0041257b
0x00412583
0x00412588
0x0041257d
0x0041257d
0x0041257d
0x0041258b
0x00412591
0x00412593
0x00412596
0x0041259d
0x004125a1
0x004125a9
0x004125ae
0x004125a3
0x004125a3
0x004125a3
0x004125b4
0x004125b7
0x004125bd
0x004125c3
0x004125c9
0x004125ca
0x004125cc
0x004125cd
0x004125ce
0x004125d1
0x004125d6
0x004125db
0x004125e1
0x004125e3
0x004125e4
0x004125f1
0x0041260b
0x004125f3
0x004125f3
0x004125f8
0x004125fd
0x00412602
0x00412602
0x00412626
0x0041262a
0x0041262f
0x0041263e
0x00412644
0x00412646
0x0041264d
0x00412669
0x0041264f
0x0041264f
0x00412654
0x00412659
0x0041265c
0x0041265f
0x00412664
0x00412664
0x00412674
0x0041268e
0x00412676
0x00412676
0x0041267b
0x00412680
0x00412685
0x00412685
0x0041269f
0x004126a9
0x004126ad
0x004126b2
0x004126c1
0x004126c4
0x004126c6
0x004126cd
0x004126e9
0x004126cf
0x004126cf
0x004126d1
0x004126d6
0x004126d9
0x004126dc
0x004126e1
0x004126e1
0x004126f6
0x004126fc
0x00412703
0x00412706
0x00412709
0x0041270f
0x00412716
0x00412719
0x0041271c
0x00412729
0x00412733
0x00412740
0x00412746
0x00412748
0x0041274f
0x0041276e
0x00412751
0x00412751
0x00412756
0x0041275b
0x0041275e
0x00412761
0x00412766
0x00412766
0x00412778
0x0041277c
0x0041277d
0x0041277f
0x00412784
0x00412787
0x00412788
0x004127b7
0x004127ba
0x004127bd
0x004127be
0x004127c0
0x004127c5

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412539
__vbaAryConstruct2.MSVBVM60(?,0040353C,00000005,?,?,?,?,004013D6), ref: 0041256E
__vbaGenerateBoundsError.MSVBVM60 ref: 00412583
__vbaGenerateBoundsError.MSVBVM60 ref: 004125A9
#684.MSVBVM60(?,?,?), ref: 004125D1
__vbaFpR8.MSVBVM60(?,?,?), ref: 004125D6
__vbaNew2.MSVBVM60(004029C8, b,?,?,?), ref: 004125FD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?), ref: 0041262A
__vbaHresultCheckObj.MSVBVM60(00000000,00000002,004031D0,00000160,?,?,?,?,?,?,?,?,?), ref: 0041265F
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,?,?,?,?,?,?), ref: 00412680
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004126AD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,00000060,?,?,?,?,?,?,?,?,?,?,?), ref: 004126DC
__vbaFpI4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?), ref: 004126F6
__vbaHresultCheckObj.MSVBVM60(00000000,00401338,00402FEC,000002C8,?,?,?,?,00000000), ref: 00412761
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,00000000), ref: 0041277F
__vbaAryDestruct.MSVBVM60(00000000,?,004127C6,?,?,?), ref: 004127C0

Strings

b, xrefs: 004125EA, 004125F3, 00412602, 0041260B, 0041266D, 00412676, 00412685, 0041268E

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$BoundsErrorGenerateNew2$#684ChkstkConstruct2DestructFreeList
String ID: b
API String ID: 3043929341-3039486171
Opcode ID: 99369248dd43d11ebc3d4e34bf2cbde30308dc17fcc4a7d1107df3f47149ee0f
Instruction ID: 023b188a11964fd4b82b83f7fb47a0d3cb00c6fde5c6af36a8bf3f04179a38be
Opcode Fuzzy Hash: 99369248dd43d11ebc3d4e34bf2cbde30308dc17fcc4a7d1107df3f47149ee0f
Instruction Fuzzy Hash: 6E812870900208EFDB10DFE1CA49BDDBBB4BF08704F10846AE546BB2A1CBB85995DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00410E7B, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00410E7B(void* __ebx, void* __edi, void* __esi, void* __eflags, long long __fp0, intOrPtr* _a4, void* _a8, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				char _v40;
				void* _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				void* _v100;
				signed int _v104;
				signed int _v116;
				char _v120;
				signed int _v124;
				signed int _t49;
				intOrPtr _t51;
				char* _t52;
				char* _t57;
				void* _t67;
				void* _t69;
				long long* _t70;

				_t70 = _t69 - 0xc;
				 *[fs:0x0] = _t70;
				L004013D0();
				_v16 = _t70;
				_v12 = 0x401238;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x64,  *[fs:0x0], 0x4013d6, _t67);
				L0040154A();
				_t57 =  &_v40;
				L0040154A();
				_v72 = 1;
				_v80 = 2;
				_push( &_v80);
				asm("fld1");
				_push(_t57);
				_push(_t57);
				 *_t70 = __fp0;
				asm("fld1");
				_push(_t57);
				_push(_t57);
				_v60 = __fp0;
				asm("fld1");
				_push(_t57);
				_push(_t57);
				 *_t70 = __fp0;
				_push(_t57);
				_push(_t57);
				 *_t70 =  *0x401230;
				L0040152C();
				L00401532();
				asm("fcomp qword [0x401228]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags == 0) {
					_t15 =  &_v116;
					 *_t15 = _v116 & 0x00000000;
					__eflags =  *_t15;
				} else {
					_v116 = 1;
				}
				_v100 =  ~_v116;
				L00401598();
				_t49 = _v100;
				if(_t49 != 0) {
					if( *0x41433c != 0) {
						_v120 = 0x41433c;
					} else {
						_push(0x41433c);
						_push(0x4033d8);
						L00401580();
						_v120 = 0x41433c;
					}
					_t23 =  &_v120; // 0x41433c
					_t51 =  *((intOrPtr*)( *_t23));
					_v100 = _t51;
					L00401526();
					_t52 =  &_v64;
					L00401586();
					_t49 =  *((intOrPtr*)( *_v100 + 0x40))(_v100, _t52, _t52, _t51, _v60, 0x4033a8, L"Elogy4");
					asm("fclex");
					_v104 = _t49;
					if(_v104 >= 0) {
						_t35 =  &_v124;
						 *_t35 = _v124 & 0x00000000;
						__eflags =  *_t35;
					} else {
						_push(0x40);
						_push(0x4033c8);
						_push(_v100);
						_push(_v104);
						L0040158C();
						_v124 = _t49;
					}
					L0040156E();
				}
				asm("wait");
				_push(0x410ffa);
				L00401598();
				L00401598();
				L0040156E();
				return _t49;
			}

0x00410e7e
0x00410e8d
0x00410e97
0x00410e9f
0x00410ea2
0x00410ea9
0x00410eb8
0x00410ec1
0x00410ec9
0x00410ecc
0x00410ed1
0x00410ed8
0x00410ee2
0x00410ee3
0x00410ee5
0x00410ee6
0x00410ee7
0x00410eea
0x00410eec
0x00410eed
0x00410eee
0x00410ef1
0x00410ef3
0x00410ef4
0x00410ef5
0x00410efe
0x00410eff
0x00410f00
0x00410f03
0x00410f08
0x00410f0d
0x00410f13
0x00410f15
0x00410f16
0x00410f21
0x00410f21
0x00410f21
0x00410f18
0x00410f18
0x00410f18
0x00410f2a
0x00410f31
0x00410f36
0x00410f3c
0x00410f49
0x00410f63
0x00410f4b
0x00410f4b
0x00410f50
0x00410f55
0x00410f5a
0x00410f5a
0x00410f6a
0x00410f6d
0x00410f6f
0x00410f7f
0x00410f85
0x00410f89
0x00410f97
0x00410f9a
0x00410f9c
0x00410fa3
0x00410fbc
0x00410fbc
0x00410fbc
0x00410fa5
0x00410fa5
0x00410fa7
0x00410fac
0x00410faf
0x00410fb2
0x00410fb7
0x00410fb7
0x00410fc3
0x00410fc3
0x00410fc8
0x00410fc9
0x00410fe4
0x00410fec
0x00410ff4
0x00410ff9

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00410E97
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00410EC1
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00410ECC
#673.MSVBVM60(?,?,?,?,?,?,?,?,00000002), ref: 00410F03
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,00000002), ref: 00410F08
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,00000002), ref: 00410F31
__vbaNew2.MSVBVM60(004033D8,0041433C,?,?,?,?,?,?,?,?,00000002), ref: 00410F55
__vbaCastObj.MSVBVM60(?,004033A8,Elogy4,?,?,?,?,?,?,?,?,00000002), ref: 00410F7F
__vbaObjSet.MSVBVM60(?,00000000,?,004033A8,Elogy4,?,?,?,?,?,?,?,?,00000002), ref: 00410F89
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,00000040,?,?,?,?,?,?,?,?,00000002), ref: 00410FB2
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00000002), ref: 00410FC3
__vbaFreeVar.MSVBVM60(00410FFA,?,?,?,?,?,?,?,?,00000002), ref: 00410FE4
__vbaFreeVar.MSVBVM60(00410FFA,?,?,?,?,?,?,?,?,00000002), ref: 00410FEC
__vbaFreeObj.MSVBVM60(00410FFA,?,?,?,?,?,?,?,?,00000002), ref: 00410FF4

Strings

Elogy4, xrefs: 00410F72
<CA, xrefs: 00410F6A

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#673CastCheckChkstkHresultNew2
String ID: <CA$Elogy4
API String ID: 3774982171-1516038039
Opcode ID: 299bdd12cc053c2fc8293ae1b31c6bd2cd3c6352e23318e6ce0ddf9b15acfcbd
Instruction ID: 2f5d73290eceec3bd37e0e078069b006ff7a727834e916936ffb2a3d9ba979ae
Opcode Fuzzy Hash: 299bdd12cc053c2fc8293ae1b31c6bd2cd3c6352e23318e6ce0ddf9b15acfcbd
Instruction Fuzzy Hash: 4F410870940208AFDB10EFA2DD4AAEDBBB4FF44704F10452EF406BB1A1DBB85985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004117DA, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004117DA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12, void* _a40, void* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v44;
				void* _v60;
				void* _v64;
				char _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				short _v88;
				char _v100;
				signed int _v104;
				signed int _v108;
				signed int _t60;
				signed int _t65;
				short _t69;
				void* _t83;
				void* _t85;
				intOrPtr _t86;

				_t86 = _t85 - 0xc;
				 *[fs:0x0] = _t86;
				L004013D0();
				_v16 = _t86;
				_v12 = 0x4012a8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x54,  *[fs:0x0], 0x4013d6, _t83);
				L0040154A();
				L0040154A();
				L00401556();
				if( *0x41433c != 0) {
					_v100 = 0x41433c;
				} else {
					_push(0x41433c);
					_push(0x4033d8);
					L00401580();
					_v100 = 0x41433c;
				}
				_t15 =  &_v100; // 0x41433c
				_v72 =  *((intOrPtr*)( *_t15));
				_t60 =  *((intOrPtr*)( *_v72 + 0x4c))(_v72,  &_v64);
				asm("fclex");
				_v76 = _t60;
				if(_v76 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x4c);
					_push(0x4033c8);
					_push(_v72);
					_push(_v76);
					L0040158C();
					_v104 = _t60;
				}
				_v80 = _v64;
				_t65 =  *((intOrPtr*)( *_v80 + 0x20))(_v80,  &_v68);
				asm("fclex");
				_v84 = _t65;
				if(_v84 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x20);
					_push(0x403420);
					_push(_v80);
					_push(_v84);
					L0040158C();
					_v108 = _t65;
				}
				_v88 =  ~(0 | _v68 != 0x00000000);
				L0040156E();
				_t69 = _v88;
				if(_t69 != 0) {
					_push(L"Udfordres5");
					L004014F0();
				}
				_push(0x41192d);
				L00401568();
				L00401598();
				L00401598();
				return _t69;
			}

0x004117dd
0x004117ec
0x004117f6
0x004117fe
0x00411801
0x00411808
0x00411817
0x00411820
0x0041182b
0x00411836
0x00411842
0x0041185c
0x00411844
0x00411844
0x00411849
0x0041184e
0x00411853
0x00411853
0x00411863
0x00411868
0x00411877
0x0041187a
0x0041187c
0x00411883
0x0041189c
0x00411885
0x00411885
0x00411887
0x0041188c
0x0041188f
0x00411892
0x00411897
0x00411897
0x004118a3
0x004118b2
0x004118b5
0x004118b7
0x004118be
0x004118d7
0x004118c0
0x004118c0
0x004118c2
0x004118c7
0x004118ca
0x004118cd
0x004118d2
0x004118d2
0x004118e6
0x004118ed
0x004118f2
0x004118f8
0x004118fa
0x004118ff
0x004118ff
0x00411904
0x00411917
0x0041191f
0x00411927
0x0041192c

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 004117F6
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00411820
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 0041182B
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00411836
__vbaNew2.MSVBVM60(004033D8,0041433C,?,?,?,?,004013D6), ref: 0041184E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,0000004C), ref: 00411892
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403420,00000020), ref: 004118CD
__vbaFreeObj.MSVBVM60(00000000,?,00403420,00000020), ref: 004118ED
#531.MSVBVM60(Udfordres5), ref: 004118FF
__vbaFreeStr.MSVBVM60(0041192D), ref: 00411917
__vbaFreeVar.MSVBVM60(0041192D), ref: 0041191F
__vbaFreeVar.MSVBVM60(0041192D), ref: 00411927

Strings

Udfordres5, xrefs: 004118FA
<CA, xrefs: 00411863

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$#531ChkstkCopyNew2
String ID: <CA$Udfordres5
API String ID: 2412138654-256355560
Opcode ID: 0e37231ad8f626340ae7c850c05ae215e50cbd0dbbd127ed8f737f9ad5ee7eee
Instruction ID: 9f5eea26fb830955a1e888f80ed4b8988df6eff5007bcc61a6b79e9b2e809f9d
Opcode Fuzzy Hash: 0e37231ad8f626340ae7c850c05ae215e50cbd0dbbd127ed8f737f9ad5ee7eee
Instruction Fuzzy Hash: 4541D571900208EFDB00EF95C945BDDBBB4FF44709F10842AF516BB2A1D7786986CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041205E, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041205E(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12, char _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v52;
				char _v56;
				char _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v76;
				signed int _v80;
				signed int _t31;
				char* _t35;
				intOrPtr _t56;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_t31 = 0x3c;
				L004013D0();
				_v12 = _t56;
				_v8 = 0x4012e8;
				L0040154A();
				L0040154A();
				_push(0x403434);
				L004014C0();
				_push( &_a28);
				_push(_t31);
				L004014C6();
				if(_t31 != 0) {
					if( *0x414010 != 0) {
						_v76 = 0x414010;
					} else {
						_push(" �b");
						_push(0x4029c8);
						L00401580();
						_v76 = 0x414010;
					}
					_t35 =  &_v60;
					L00401586();
					_v64 = _t35;
					_t31 =  *((intOrPtr*)( *_v64 + 0xf0))(_v64,  &_v56, _t35,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x304))( *_v76));
					asm("fclex");
					_v68 = _t31;
					if(_v68 >= 0) {
						_v80 = _v80 & 0x00000000;
					} else {
						_push(0xf0);
						_push(0x4031c0);
						_push(_v64);
						_push(_v68);
						L0040158C();
						_v80 = _t31;
					}
					_push(_v56);
					L004014F0();
					L00401568();
					L0040156E();
				}
				asm("wait");
				_push(0x412185);
				L00401598();
				L00401598();
				return _t31;
			}

0x00412063
0x0041206e
0x0041206f
0x00412078
0x00412079
0x00412081
0x00412084
0x00412091
0x0041209c
0x004120a1
0x004120a6
0x004120ab
0x004120ac
0x004120b3
0x004120ba
0x004120c7
0x004120e1
0x004120c9
0x004120c9
0x004120ce
0x004120d3
0x004120d8
0x004120d8
0x004120fc
0x00412100
0x00412105
0x00412114
0x0041211a
0x0041211c
0x00412123
0x0041213f
0x00412125
0x00412125
0x0041212a
0x0041212f
0x00412132
0x00412135
0x0041213a
0x0041213a
0x00412143
0x00412146
0x0041214e
0x00412156
0x00412156
0x0041215b
0x0041215c
0x00412177
0x0041217f
0x00412184

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412079
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412091
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 0041209C
__vbaCyStr.MSVBVM60(00403434,?,?,?,?,004013D6), ref: 004120A6
__vbaFpCmpCy.MSVBVM60(00000000,?,00403434,?,?,?,?,004013D6), ref: 004120B3
__vbaNew2.MSVBVM60(004029C8, b,00000000,?,00403434,?,?,?,?,004013D6), ref: 004120D3
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00000000,?,00403434), ref: 00412100
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000000F0,?,?,?,?,?,?,?,?,00000000,?,00403434), ref: 00412135
#531.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,?,00403434), ref: 00412146
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,?,00403434), ref: 0041214E
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,?,00403434), ref: 00412156
__vbaFreeVar.MSVBVM60(00412185,00000000,?,00403434,?,?,?,?,004013D6), ref: 00412177
__vbaFreeVar.MSVBVM60(00412185,00000000,?,00403434,?,?,?,?,004013D6), ref: 0041217F

Strings

b, xrefs: 004120C0, 004120C9, 004120D8, 004120E1

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#531CheckChkstkHresultNew2
String ID: b
API String ID: 418237231-3039486171
Opcode ID: fa520f1d65ad372d3b305c357299ffe9f0763e547f4bfdbdc05e70e5521e764c
Instruction ID: 126265687a3f02ca8b3ff013954b3d382bb30acda177e61d544e1ab84a57c2ca
Opcode Fuzzy Hash: fa520f1d65ad372d3b305c357299ffe9f0763e547f4bfdbdc05e70e5521e764c
Instruction Fuzzy Hash: 2F311A70950208BBCB14EF92DD45BDDBB78BF48708F10442AF502BB1B1DBB85945DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041194C, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0041194C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				char* _t67;
				signed int _t71;
				signed int _t77;
				signed int _t81;
				char* _t83;
				void* _t94;
				void* _t96;
				intOrPtr _t97;

				_t97 = _t96 - 0xc;
				 *[fs:0x0] = _t97;
				L004013D0();
				_v16 = _t97;
				_v12 = 0x4012b8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x54,  *[fs:0x0], 0x4013d6, _t94);
				L0040154A();
				if( *0x414010 != 0) {
					_v92 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v92 = 0x414010;
				}
				_t67 =  &_v52;
				L00401586();
				_v60 = _t67;
				_t71 =  *((intOrPtr*)( *_v60 + 0x1dc))(_v60,  &_v48, _t67,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x2fc))( *_v92));
				asm("fclex");
				_v64 = _t71;
				if(_v64 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1dc);
					_push(0x4031c0);
					_push(_v60);
					_push(_v64);
					L0040158C();
					_v96 = _t71;
				}
				if( *0x41433c != 0) {
					_v100 = 0x41433c;
				} else {
					_push(0x41433c);
					_push(0x4033d8);
					L00401580();
					_v100 = 0x41433c;
				}
				_t29 =  &_v100; // 0x41433c
				_v68 =  *((intOrPtr*)( *_t29));
				_t77 =  *((intOrPtr*)( *_v68 + 0x14))(_v68,  &_v56);
				asm("fclex");
				_v72 = _t77;
				if(_v72 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4033c8);
					_push(_v68);
					_push(_v72);
					L0040158C();
					_v104 = _t77;
				}
				_v76 = _v56;
				_t81 =  *((intOrPtr*)( *_v76 + 0x138))(_v76, _v48, 1);
				asm("fclex");
				_v80 = _t81;
				if(_v80 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x403454);
					_push(_v76);
					_push(_v80);
					L0040158C();
					_v108 = _t81;
				}
				L00401568();
				_push( &_v56);
				_t83 =  &_v52;
				_push(_t83);
				_push(2);
				L0040157A();
				asm("wait");
				_push(0x411b07);
				L00401598();
				return _t83;
			}

0x0041194f
0x0041195e
0x00411968
0x00411970
0x00411973
0x0041197a
0x00411989
0x00411992
0x0041199e
0x004119b8
0x004119a0
0x004119a0
0x004119a5
0x004119aa
0x004119af
0x004119af
0x004119d3
0x004119d7
0x004119dc
0x004119eb
0x004119f1
0x004119f3
0x004119fa
0x00411a16
0x004119fc
0x004119fc
0x00411a01
0x00411a06
0x00411a09
0x00411a0c
0x00411a11
0x00411a11
0x00411a21
0x00411a3b
0x00411a23
0x00411a23
0x00411a28
0x00411a2d
0x00411a32
0x00411a32
0x00411a42
0x00411a47
0x00411a56
0x00411a59
0x00411a5b
0x00411a62
0x00411a7b
0x00411a64
0x00411a64
0x00411a66
0x00411a6b
0x00411a6e
0x00411a71
0x00411a76
0x00411a76
0x00411a82
0x00411a92
0x00411a98
0x00411a9a
0x00411aa1
0x00411abd
0x00411aa3
0x00411aa3
0x00411aa8
0x00411aad
0x00411ab0
0x00411ab3
0x00411ab8
0x00411ab8
0x00411ac4
0x00411acc
0x00411acd
0x00411ad0
0x00411ad1
0x00411ad3
0x00411adb
0x00411adc
0x00411b01
0x00411b06

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00411968
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00411992
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,?,004013D6), ref: 004119AA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004119D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001DC), ref: 00411A0C
__vbaNew2.MSVBVM60(004033D8,0041433C), ref: 00411A2D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,00000014), ref: 00411A71
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403454,00000138), ref: 00411AB3
__vbaFreeStr.MSVBVM60 ref: 00411AC4
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00411AD3
__vbaFreeVar.MSVBVM60(00411B07,?,?,004013D6), ref: 00411B01

Strings

<CA, xrefs: 00411A42
b, xrefs: 00411997, 004119A0, 004119AF, 004119B8

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$New2$ChkstkList
String ID: b$<CA
API String ID: 3368141698-1966994258
Opcode ID: 2a0d3127e51b7d410b7b0e6b03f4751c3a87af038efd9d29d66f3d6a9c6948f4
Instruction ID: f7462ca627ca813d5839a6547f95fe5bc15949b39cc5a413639a1236afed286d
Opcode Fuzzy Hash: 2a0d3127e51b7d410b7b0e6b03f4751c3a87af038efd9d29d66f3d6a9c6948f4
Instruction Fuzzy Hash: D551E271A01208EFCB00EFA5D885BDDBBB5BF48704F10442AF505BB2A1D7785985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00412906, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00412906(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v96;
				intOrPtr* _v100;
				signed int _v104;
				signed int _v108;
				char* _t60;
				char* _t64;
				signed int _t68;
				signed int _t72;
				char* _t74;
				void* _t90;
				void* _t92;
				intOrPtr _t93;

				_t93 = _t92 - 0xc;
				 *[fs:0x0] = _t93;
				L004013D0();
				_v16 = _t93;
				_v12 = 0x401368;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x54,  *[fs:0x0], 0x4013d6, _t90);
				L0040154A();
				if( *0x414010 != 0) {
					_v96 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v96 = 0x414010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x308))( *_v96));
				_t60 =  &_v52;
				_push(_t60);
				L00401586();
				_v80 = _t60;
				_v60 = 0x80020004;
				_v68 = 0xa;
				if( *0x414010 != 0) {
					_v100 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v100 = 0x414010;
				}
				_t64 =  &_v48;
				L00401586();
				_v72 = _t64;
				_t68 =  *((intOrPtr*)( *_v72 + 0x48))(_v72,  &_v44, _t64,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x304))( *_v100));
				asm("fclex");
				_v76 = _t68;
				if(_v76 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x4031c0);
					_push(_v72);
					_push(_v76);
					L0040158C();
					_v104 = _t68;
				}
				L004013D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t72 =  *((intOrPtr*)( *_v80 + 0x1ec))(_v80, _v44, 0x10);
				asm("fclex");
				_v84 = _t72;
				if(_v84 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4031d0);
					_push(_v80);
					_push(_v84);
					L0040158C();
					_v108 = _t72;
				}
				L00401568();
				_push( &_v52);
				_t74 =  &_v48;
				_push(_t74);
				_push(2);
				L0040157A();
				_push(0x412ab4);
				L00401598();
				return _t74;
			}

0x00412909
0x00412918
0x00412922
0x0041292a
0x0041292d
0x00412934
0x00412943
0x0041294c
0x00412958
0x00412972
0x0041295a
0x0041295a
0x0041295f
0x00412964
0x00412969
0x00412969
0x0041298c
0x0041298d
0x00412990
0x00412991
0x00412996
0x00412999
0x004129a0
0x004129ae
0x004129c8
0x004129b0
0x004129b0
0x004129b5
0x004129ba
0x004129bf
0x004129bf
0x004129e3
0x004129e7
0x004129ec
0x004129fb
0x004129fe
0x00412a00
0x00412a07
0x00412a20
0x00412a09
0x00412a09
0x00412a0b
0x00412a10
0x00412a13
0x00412a16
0x00412a1b
0x00412a1b
0x00412a27
0x00412a31
0x00412a32
0x00412a33
0x00412a34
0x00412a40
0x00412a46
0x00412a48
0x00412a4f
0x00412a6b
0x00412a51
0x00412a51
0x00412a56
0x00412a5b
0x00412a5e
0x00412a61
0x00412a66
0x00412a66
0x00412a72
0x00412a7a
0x00412a7b
0x00412a7e
0x00412a7f
0x00412a81
0x00412a89
0x00412aae
0x00412ab3

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412922
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 0041294C
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,?,004013D6), ref: 00412964
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412991
__vbaNew2.MSVBVM60(004029C8, b,?,00000000), ref: 004129BA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004129E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000048), ref: 00412A16
__vbaChkstk.MSVBVM60 ref: 00412A27
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,000001EC), ref: 00412A61
__vbaFreeStr.MSVBVM60 ref: 00412A72
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412A81
__vbaFreeVar.MSVBVM60(00412AB4,?,?,004013D6), ref: 00412AAE

Strings

b, xrefs: 00412951, 0041295A, 00412969, 00412972, 004129A7, 004129B0, 004129BF, 004129C8

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2$List
String ID: b
API String ID: 3897332912-3039486171
Opcode ID: 3e7cee12795e5df88ba500fea1be8682f327e676a8e6825c260aa9d01877323b
Instruction ID: 48b85a9022899b67789c215f635d53dff621bdbc42b790fce287639f1ef1bdac
Opcode Fuzzy Hash: 3e7cee12795e5df88ba500fea1be8682f327e676a8e6825c260aa9d01877323b
Instruction Fuzzy Hash: 775139B0A00208EFCB10EF95C945BDDBBB9BF48704F10442AF502BB2A1D7B99955DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00412F14, Relevance: 22.6, APIs: 15, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00412F14(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a36, void* _a52, void* _a56) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v44;
				void* _v60;
				char _v64;
				char _v68;
				short _v72;
				signed int _t19;
				short _t25;
				intOrPtr _t45;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t45;
				_t19 = 0x38;
				L004013D0();
				_v12 = _t45;
				_v8 = 0x4013a8;
				L0040154A();
				L00401556();
				L0040154A();
				_push(0x4035b8);
				_push(0x4035c0);
				L004015A4();
				L004015B0();
				_push(_t19);
				L00401460();
				_push(_t19);
				L00401466();
				L004015B0();
				_push(_t19);
				_push(0x4035c8);
				L004015B6();
				asm("sbb eax, eax");
				_v72 =  ~( ~( ~_t19));
				_push( &_v68);
				_push( &_v64);
				_push(2);
				L0040159E();
				_t25 = _v72;
				if(_t25 != 0) {
					L00401538();
				}
				asm("wait");
				_push(0x412ffb);
				L00401568();
				L00401598();
				L00401598();
				return _t25;
			}

0x00412f19
0x00412f24
0x00412f25
0x00412f2e
0x00412f2f
0x00412f37
0x00412f3a
0x00412f47
0x00412f52
0x00412f5d
0x00412f62
0x00412f67
0x00412f6c
0x00412f76
0x00412f7b
0x00412f7c
0x00412f81
0x00412f82
0x00412f8c
0x00412f91
0x00412f92
0x00412f97
0x00412f9e
0x00412fa4
0x00412fab
0x00412faf
0x00412fb0
0x00412fb2
0x00412fba
0x00412fc0
0x00412fc2
0x00412fc2
0x00412fc7
0x00412fc8
0x00412fe5
0x00412fed
0x00412ff5
0x00412ffa

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412F2F
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412F47
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00412F52
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412F5D
__vbaStrCat.MSVBVM60(004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F6C
__vbaStrMove.MSVBVM60(004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F76
__vbaI4Str.MSVBVM60(00000000,004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F7C
#537.MSVBVM60(00000000,00000000,004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F82
__vbaStrMove.MSVBVM60(00000000,00000000,004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F8C
__vbaStrCmp.MSVBVM60(004035C8,00000000,00000000,00000000,004035C0,004035B8,?,?,?,?,004013D6), ref: 00412F97
__vbaFreeStrList.MSVBVM60(00000002,?,?,004035C8,00000000,00000000,00000000,004035C0,004035B8,?,?,?,?,004013D6), ref: 00412FB2
__vbaEnd.MSVBVM60 ref: 00412FC2
__vbaFreeStr.MSVBVM60(00412FFB), ref: 00412FE5
__vbaFreeVar.MSVBVM60(00412FFB), ref: 00412FED
__vbaFreeVar.MSVBVM60(00412FFB), ref: 00412FF5

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#537ChkstkCopyList
String ID:
API String ID: 2604925928-0
Opcode ID: 59eea4c378a5ad9e85e6c02cd1d27d668fbe2f435b1eddd90c704ab041c7a3f8
Instruction ID: c52cb6bc5662a98bbb655d57ca0d656589f3f4445596b57df2eeaa08abfabb5d
Opcode Fuzzy Hash: 59eea4c378a5ad9e85e6c02cd1d27d668fbe2f435b1eddd90c704ab041c7a3f8
Instruction Fuzzy Hash: 28114F7094020DBACB04FBA1CC42EEE777CAF54B08F50413BB402BA0F1EE786A468659

Uniqueness

Uniqueness Score: -1.00%

Function 00411019, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00411019(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v64;
				intOrPtr _v72;
				char _v80;
				char _v88;
				char _v96;
				char _v112;
				intOrPtr _v152;
				char _v160;
				short _v164;
				intOrPtr _t33;
				short _t38;
				short _t42;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				L004013D0();
				_v16 = _t55;
				_v12 = 0x401248;
				_v8 = 0;
				_t33 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013d6, _t52);
				L0040154A();
				L0040154A();
				_v88 = 2;
				_v96 = 2;
				_push("FGF");
				_push(0x4033f8);
				L004015A4();
				_v72 = _t33;
				_v80 = 8;
				_push( &_v96);
				_push(1);
				_push( &_v80);
				_push( &_v112);
				L0040151A();
				_v152 = 0x4031bc;
				_v160 = 0x8008;
				_push( &_v112);
				_t38 =  &_v160;
				_push(_t38);
				L00401520();
				_v164 = _t38;
				_push( &_v112);
				_push( &_v96);
				_push( &_v80);
				_push(3);
				L00401574();
				_t42 = _v164;
				if(_t42 != 0) {
					_push(L"FRDSELSTAVLERS");
					L00401514();
				}
				_push(0x411134);
				L00401598();
				L00401598();
				return _t42;
			}

0x0041101c
0x0041102b
0x00411037
0x0041103f
0x00411042
0x00411049
0x00411058
0x00411061
0x0041106c
0x00411071
0x00411078
0x0041107f
0x00411084
0x00411089
0x0041108e
0x00411091
0x0041109b
0x0041109c
0x004110a1
0x004110a5
0x004110a6
0x004110ab
0x004110b5
0x004110c2
0x004110c3
0x004110c9
0x004110ca
0x004110cf
0x004110d9
0x004110dd
0x004110e1
0x004110e2
0x004110e4
0x004110ec
0x004110f5
0x004110f7
0x004110fc
0x004110fc
0x00411101
0x00411126
0x0041112e
0x00411133

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00411037
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00411061
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 0041106C
__vbaStrCat.MSVBVM60(004033F8,FGF), ref: 00411089
#629.MSVBVM60(?,00000008,00000001,00000002,004033F8,FGF), ref: 004110A6
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,00000008,00000001,00000002), ref: 004110CA
__vbaFreeVarList.MSVBVM60(00000003,00000008,00000002,?,00008008,?), ref: 004110E4
#532.MSVBVM60(FRDSELSTAVLERS,?,?,?,004013D6), ref: 004110FC
__vbaFreeVar.MSVBVM60(00411134,?,?,?,004013D6), ref: 00411126
__vbaFreeVar.MSVBVM60(00411134,?,?,?,004013D6), ref: 0041112E

Strings

FGF, xrefs: 0041107F
FRDSELSTAVLERS, xrefs: 004110F7

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#532#629ChkstkList
String ID: FGF$FRDSELSTAVLERS
API String ID: 1231843687-835823297
Opcode ID: 8ff3a167ba9ca0e6073c5e0e0980c095a2642e9f73a20f5e7106b0eb19716016
Instruction ID: fa1d40bc11bb2dbf6114b9da99302a1f949efb349f76398e79d6c7d040619c92
Opcode Fuzzy Hash: 8ff3a167ba9ca0e6073c5e0e0980c095a2642e9f73a20f5e7106b0eb19716016
Instruction Fuzzy Hash: 4521D871D0020CAADB01EFD1CD46FDEBBBCAF44708F50806AB515BB1A1DB789A498B95

Uniqueness

Uniqueness Score: -1.00%

Function 00412E42, Relevance: 16.6, APIs: 11, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00412E42(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _v52;
				short _v56;
				signed int _t15;
				short _t19;
				intOrPtr _t35;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t35;
				_t15 = 0x28;
				L004013D0();
				_v12 = _t35;
				_v8 = 0x401398;
				L0040154A();
				_push(0x4035b0);
				_push(0x403558);
				L004015A4();
				L004015B0();
				_push(_v48);
				L0040146C();
				L004015B0();
				_push(_t15);
				_push(0x4035b0);
				L004015B6();
				asm("sbb eax, eax");
				_v56 =  ~( ~( ~_t15));
				L00401568();
				_t19 = _v56;
				if(_t19 != 0) {
					_push(0x30);
					L00401472();
					_v44 = _t19;
				}
				_push(0x412ef7);
				L00401598();
				L00401568();
				return _t19;
			}

0x00412e47
0x00412e52
0x00412e53
0x00412e5c
0x00412e5d
0x00412e65
0x00412e68
0x00412e75
0x00412e7a
0x00412e7f
0x00412e84
0x00412e8e
0x00412e93
0x00412e96
0x00412ea0
0x00412ea5
0x00412ea6
0x00412eab
0x00412eb2
0x00412eb8
0x00412ebf
0x00412ec4
0x00412eca
0x00412ecc
0x00412ece
0x00412ed3
0x00412ed3
0x00412ed6
0x00412ee9
0x00412ef1
0x00412ef6

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412E5D
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412E75
__vbaStrCat.MSVBVM60(00403558,004035B0,?,?,?,?,004013D6), ref: 00412E84
__vbaStrMove.MSVBVM60(00403558,004035B0,?,?,?,?,004013D6), ref: 00412E8E
#523.MSVBVM60(?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412E96
__vbaStrMove.MSVBVM60(?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412EA0
__vbaStrCmp.MSVBVM60(004035B0,00000000,?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412EAB
__vbaFreeStr.MSVBVM60(004035B0,00000000,?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412EBF
#570.MSVBVM60(00000030,004035B0,00000000,?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412ECE
__vbaFreeVar.MSVBVM60(00412EF7,004035B0,00000000,?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412EE9
__vbaFreeStr.MSVBVM60(00412EF7,004035B0,00000000,?,00403558,004035B0,?,?,?,?,004013D6), ref: 00412EF1

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#523#570Chkstk
String ID:
API String ID: 30573447-0
Opcode ID: 68d26b2e2b5397c3e85dd9d68c87681ce74ffdf47db0860d415d03009da4da94
Instruction ID: 378e5297af42755622c5d48c6a259ec008fa3a3eb401ee73ce3caab3777d09d2
Opcode Fuzzy Hash: 68d26b2e2b5397c3e85dd9d68c87681ce74ffdf47db0860d415d03009da4da94
Instruction Fuzzy Hash: 59113071950208BADB00EBA6DD42EEE7678BF44B44F60413BF402BA4F1EAB85A048659

Uniqueness

Uniqueness Score: -1.00%

Function 00412D61, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00412D61(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v44;
				intOrPtr _v48;
				void* _v52;
				short _v56;
				void* _t24;
				short _t25;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t44 = _t43 - 0xc;
				 *[fs:0x0] = _t44;
				L004013D0();
				_v16 = _t44;
				_v12 = 0x401388;
				_v8 = 0;
				_t24 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4013d6, _t41);
				L0040154A();
				L00401556();
				_push(0x403598);
				_push(0x4035a4);
				L004015A4();
				L004015B0();
				_push(_t24);
				L00401478();
				_v56 =  ~(0 | _t24 != 0x0000ffff);
				L00401568();
				_t25 = _v56;
				if(_t25 != 0) {
					_push(0xc2);
					L00401472();
					_v48 = _t25;
				}
				_push(0x412e23);
				L00401568();
				L00401598();
				return _t25;
			}

0x00412d64
0x00412d73
0x00412d7d
0x00412d85
0x00412d88
0x00412d8f
0x00412d9e
0x00412da7
0x00412db2
0x00412db7
0x00412dbc
0x00412dc1
0x00412dcb
0x00412dd0
0x00412dd1
0x00412de1
0x00412de8
0x00412ded
0x00412df3
0x00412df5
0x00412dfa
0x00412dff
0x00412dff
0x00412e02
0x00412e15
0x00412e1d
0x00412e22

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412D7D
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00412DA7
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00412DB2
__vbaStrCat.MSVBVM60(004035A4,00403598,?,?,?,?,004013D6), ref: 00412DC1
__vbaStrMove.MSVBVM60(004035A4,00403598,?,?,?,?,004013D6), ref: 00412DCB
__vbaBoolStr.MSVBVM60(00000000,004035A4,00403598,?,?,?,?,004013D6), ref: 00412DD1
__vbaFreeStr.MSVBVM60(00000000,004035A4,00403598,?,?,?,?,004013D6), ref: 00412DE8
#570.MSVBVM60(000000C2,00000000,004035A4,00403598,?,?,?,?,004013D6), ref: 00412DFA
__vbaFreeStr.MSVBVM60(00412E23,00000000,004035A4,00403598,?,?,?,?,004013D6), ref: 00412E15
__vbaFreeVar.MSVBVM60(00412E23,00000000,004035A4,00403598,?,?,?,?,004013D6), ref: 00412E1D

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#570BoolChkstkCopyMove
String ID:
API String ID: 3676185156-0
Opcode ID: 6fc44146b04d2c7f97dce5b79e61d3c87bc01bdc4fb0c87908eaf6d000a449bc
Instruction ID: 9c0a79c3cb8647cc07f60da9e73b764f44e529df54cfcec1218528bec8ee68e4
Opcode Fuzzy Hash: 6fc44146b04d2c7f97dce5b79e61d3c87bc01bdc4fb0c87908eaf6d000a449bc
Instruction Fuzzy Hash: BF112170940209BBCB00EF65CD46EEDBB74AF44B44F50403AB402BB5E1DA789A458B59

Uniqueness

Uniqueness Score: -1.00%

Function 004116CE, Relevance: 12.0, APIs: 8, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004116CE(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				char _v44;
				char* _t14;
				intOrPtr _t28;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t28;
				_push(0x1c);
				L004013D0();
				_v12 = _t28;
				_v8 = 0x401288;
				L00401556();
				_push(1);
				_push(1);
				_push(1);
				_push( &_v44);
				L004014FC();
				_t14 =  &_v44;
				_push(_t14);
				L00401502();
				L004015B0();
				L00401598();
				_push(0x411751);
				L00401568();
				L00401568();
				return _t14;
			}

0x004116d3
0x004116de
0x004116df
0x004116e6
0x004116e9
0x004116f1
0x004116f4
0x00411701
0x00411706
0x00411708
0x0041170a
0x0041170f
0x00411710
0x00411715
0x00411718
0x00411719
0x00411723
0x0041172b
0x00411730
0x00411743
0x0041174b
0x00411750

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 004116E9
__vbaStrCopy.MSVBVM60(?,?,?,?,004013D6), ref: 00411701
#539.MSVBVM60(?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 00411710
__vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 00411719
__vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 00411723
__vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 0041172B
__vbaFreeStr.MSVBVM60(00411751,?,?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 00411743
__vbaFreeStr.MSVBVM60(00411751,?,?,00000001,00000001,00000001,?,?,?,?,004013D6), ref: 0041174B

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#539ChkstkCopy
String ID:
API String ID: 3841497116-0
Opcode ID: 3eb9c18658a6d0c2244f5b8c8b437c38b7310062582e41add90c33d9f21e9ff9
Instruction ID: fcc91fdfd409dc7c5ac154d8c6c0a26e204216d6034234481f38f55e398ea89c
Opcode Fuzzy Hash: 3eb9c18658a6d0c2244f5b8c8b437c38b7310062582e41add90c33d9f21e9ff9
Instruction Fuzzy Hash: FA016270940208BADB00EBA2CC83FEE7778AB44744F50002EF102BB5E1DBBCA945C669

Uniqueness

Uniqueness Score: -1.00%

Function 0041241C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041241C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				void* _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _t41;
				signed int _t46;
				short _t47;
				intOrPtr _t55;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t55;
				_push(0x2c);
				L004013D0();
				_v12 = _t55;
				_v8 = 0x401310;
				if( *0x41433c != 0) {
					_v56 = 0x41433c;
				} else {
					_push(0x41433c);
					_push(0x4033d8);
					L00401580();
					_v56 = 0x41433c;
				}
				_t5 =  &_v56; // 0x41433c
				_v36 =  *((intOrPtr*)( *_t5));
				_t41 =  *((intOrPtr*)( *_v36 + 0x14))(_v36,  &_v28);
				asm("fclex");
				_v40 = _t41;
				if(_v40 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4033c8);
					_push(_v36);
					_push(_v40);
					L0040158C();
					_v60 = _t41;
				}
				_v44 = _v28;
				_t46 =  *((intOrPtr*)( *_v44 + 0x68))(_v44,  &_v32);
				asm("fclex");
				_v48 = _t46;
				if(_v48 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x403454);
					_push(_v44);
					_push(_v48);
					L0040158C();
					_v64 = _t46;
				}
				_t47 = _v32;
				_v24 = _t47;
				L0040156E();
				_push(0x41250a);
				return _t47;
			}

0x00412421
0x0041242c
0x0041242d
0x00412434
0x00412437
0x0041243f
0x00412442
0x00412450
0x0041246a
0x00412452
0x00412452
0x00412457
0x0041245c
0x00412461
0x00412461
0x00412471
0x00412476
0x00412485
0x00412488
0x0041248a
0x00412491
0x004124aa
0x00412493
0x00412493
0x00412495
0x0041249a
0x0041249d
0x004124a0
0x004124a5
0x004124a5
0x004124b1
0x004124c0
0x004124c3
0x004124c5
0x004124cc
0x004124e5
0x004124ce
0x004124ce
0x004124d0
0x004124d5
0x004124d8
0x004124db
0x004124e0
0x004124e0
0x004124e9
0x004124ed
0x004124f4
0x004124f9
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00412437
__vbaNew2.MSVBVM60(004033D8,0041433C,?,?,?,?,004013D6), ref: 0041245C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004033C8,00000014,?,?,?,?,?,?,?,?,?,?,004013D6), ref: 004124A0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403454,00000068,?,?,?,?,?,?,?,?,?,?,004013D6), ref: 004124DB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004013D6), ref: 004124F4

Strings

<CA, xrefs: 00412471

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID: <CA
API String ID: 1616694062-146778150
Opcode ID: 3b809933d9b7ec998a497ad15c3d62b11770ecba298f0e5cac4be72c16de7e94
Instruction ID: 68c9d9973a5bf186c8ca261618f265e1ca58be5e05ff49ad3f9468a68c9fd289
Opcode Fuzzy Hash: 3b809933d9b7ec998a497ad15c3d62b11770ecba298f0e5cac4be72c16de7e94
Instruction Fuzzy Hash: 7231F475E00208EFDB00DF95DA85BDDBBB5FB08715F10402AF501B62A0D7B859949F69

Uniqueness

Uniqueness Score: -1.00%

Function 00413016, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00413016(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v44;
				signed int _v48;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x1c);
				L004013D0();
				_v12 = _t40;
				_v8 = 0x4013b8;
				if( *0x414010 != 0) {
					_v44 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v44 = 0x414010;
				}
				_t26 =  &_v28;
				L00401586();
				_v32 = _t26;
				_t29 =  *((intOrPtr*)( *_v32 + 0x1c8))(_v32, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v44)) + 0x300))( *_v44));
				asm("fclex");
				_v36 = _t29;
				if(_v36 >= 0) {
					_v48 = _v48 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x4031c0);
					_push(_v32);
					_push(_v36);
					L0040158C();
					_v48 = _t29;
				}
				L0040156E();
				asm("wait");
				_push(0x4130dc);
				return _t29;
			}

0x0041301b
0x00413026
0x00413027
0x0041302e
0x00413031
0x00413039
0x0041303c
0x0041304a
0x00413064
0x0041304c
0x0041304c
0x00413051
0x00413056
0x0041305b
0x0041305b
0x0041307f
0x00413083
0x00413088
0x00413093
0x00413099
0x0041309b
0x004130a2
0x004130be
0x004130a4
0x004130a4
0x004130a9
0x004130ae
0x004130b1
0x004130b4
0x004130b9
0x004130b9
0x004130c5
0x004130ca
0x004130cb
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00413031
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,?,004013D6), ref: 00413056
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,004013D6), ref: 00413083
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C8,?,?,?,?,?,?,?,004013D6), ref: 004130B4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,004013D6), ref: 004130C5

Strings

b, xrefs: 00413043, 0041304C, 0041305B, 00413064

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID: b
API String ID: 4127847336-3039486171
Opcode ID: a78db3002026d210905776e542a6108ba9a77a3565df0a533bfda02f8c0861b2
Instruction ID: b77ed7f34cecf281fbcc506f0e55ecd0df9ba18bc8da54f141af8294c208f75e
Opcode Fuzzy Hash: a78db3002026d210905776e542a6108ba9a77a3565df0a533bfda02f8c0861b2
Instruction Fuzzy Hash: 77114DB0A40208EFDB00DF95C845BDEBBB8BB4CB05F10442AF501B72A0C7BC5581DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004115D3, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E004115D3(void* __ebx, void* __edi, void* __esi, signed int* _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				char* _t28;
				signed int _t31;
				void* _t41;
				intOrPtr _t42;

				_t42 = _t41 - 0xc;
				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t42;
				_push(0x2c);
				L004013D0();
				_v16 = _t42;
				_v12 = 0x401278;
				 *_a8 =  *_a8 & 0x00000000;
				if( *0x414010 != 0) {
					_v64 = 0x414010;
				} else {
					_push(" �b");
					_push(0x4029c8);
					L00401580();
					_v64 = 0x414010;
				}
				_t28 =  &_v44;
				L00401586();
				_v48 = _t28;
				_t31 =  *((intOrPtr*)( *_v48 + 0x1c8))(_v48, _t28,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x300))( *_v64));
				asm("fclex");
				_v52 = _t31;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x4031c0);
					_push(_v48);
					_push(_v52);
					L0040158C();
					_v68 = _t31;
				}
				L0040156E();
				_push(0x4116b1);
				return _t31;
			}

0x004115d6
0x004115d9
0x004115e4
0x004115e5
0x004115ec
0x004115ef
0x004115f7
0x004115fa
0x00411604
0x0041160e
0x00411628
0x00411610
0x00411610
0x00411615
0x0041161a
0x0041161f
0x0041161f
0x00411643
0x00411647
0x0041164c
0x00411657
0x0041165d
0x0041165f
0x00411666
0x00411682
0x00411668
0x00411668
0x0041166d
0x00411672
0x00411675
0x00411678
0x0041167d
0x0041167d
0x00411689
0x0041168e
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 004115EF
__vbaNew2.MSVBVM60(004029C8, b,?,?,?,?,004013D6), ref: 0041161A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411647
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C8), ref: 00411678
__vbaFreeObj.MSVBVM60 ref: 00411689

Strings

b, xrefs: 00411607, 00411610, 0041161F, 00411628

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID: b
API String ID: 4127847336-3039486171
Opcode ID: 3ca4711b22d3af2eab0f1cf14e3c91053829147df4bfe882daea7a64b4f9b1c6
Instruction ID: 6d1580f0a6cdf171fb97f6248b3793cafdefb80d8089bd2abe9f0e7bbbee018d
Opcode Fuzzy Hash: 3ca4711b22d3af2eab0f1cf14e3c91053829147df4bfe882daea7a64b4f9b1c6
Instruction Fuzzy Hash: 8821F7B5A40208EFCB00DFA5D849FDDBBB4BB48B04F10846AF511BB2A0C7799844DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004127EF, Relevance: 9.1, APIs: 6, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004127EF(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v28;
				char _v36;
				char _v52;
				intOrPtr _v76;
				char _v84;
				signed int _v88;
				signed long long _v96;
				signed int _v100;
				intOrPtr _t30;
				signed int _t34;
				signed int _t37;
				intOrPtr _t45;

				_push(__ecx);
				_push(__ecx);
				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t45;
				_t30 = 0x50;
				L004013D0();
				_v12 = _t45;
				_v8 = 0x401358;
				_push(0x403558);
				_push(0x403560);
				L004015A4();
				_v28 = _t30;
				_v36 = 8;
				_push( &_v36);
				_push( &_v52);
				L00401490();
				_v76 = 0x403560;
				_v84 = 0x8008;
				_push( &_v52);
				_t34 =  &_v84;
				_push(_t34);
				L00401520();
				_v88 = _t34;
				_push( &_v52);
				_push( &_v36);
				_push(2);
				L00401574();
				_t37 = _v88;
				if(_t37 == 0) {
					L6:
					asm("wait");
					_push(0x4128ee);
					return _t37;
				} else {
					__fp0 =  *0x401350;
					__fp0 =  *0x401350 *  *0x401348;
					asm("fnstsw ax");
					if((__al & 0x0000000d) != 0) {
						goto L1;
					}
					_v96 = __fp0;
					__fp0 = _v96;
					 *__esp = _v96;
					_a4 =  *_a4;
					__eax =  *((intOrPtr*)( *_a4 + 0x84))(_a4, __ecx);
					asm("fclex");
					_v88 = __eax;
					if(_v88 >= 0) {
						_v100 = _v100 & 0x00000000;
					} else {
						_push(0x84);
						_push(0x402fec);
						_push(_a4);
						_push(_v88);
						L0040158C();
						_v100 = __eax;
					}
					goto L6;
				}
				L1:
				return __imp____vbaFPException();
			}

0x004127f2
0x004127f3
0x004127f4
0x004127ff
0x00412800
0x00412809
0x0041280a
0x00412812
0x00412815
0x0041281c
0x00412821
0x00412826
0x0041282b
0x0041282e
0x00412838
0x0041283c
0x0041283d
0x00412842
0x00412849
0x00412853
0x00412854
0x00412857
0x00412858
0x0041285d
0x00412864
0x00412868
0x00412869
0x0041286b
0x00412873
0x00412879
0x004128ce
0x004128ce
0x004128cf
0x00000000
0x0041287b
0x0041287b
0x00412881
0x00412887
0x0041288b
0x00000000
0x00412901
0x0041288d
0x00412890
0x00412894
0x0041289a
0x0041289f
0x004128a5
0x004128a7
0x004128ae
0x004128ca
0x004128b0
0x004128b0
0x004128b5
0x004128ba
0x004128bd
0x004128c0
0x004128c5
0x004128c5
0x00000000
0x004128ae
0x004013dc
0x004013dc

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 0041280A
__vbaStrCat.MSVBVM60(00403560,00403558,?,?,?,?,004013D6), ref: 00412826
#522.MSVBVM60(?,00000008,00403560,00403558,?,?,?,?,004013D6), ref: 0041283D
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,00000008,00403560,00403558), ref: 00412858
__vbaFreeVarList.MSVBVM60(00000002,00000008,?,00008008,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 0041286B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FEC,00000084), ref: 004128C0

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#522CheckChkstkFreeHresultList
String ID:
API String ID: 2283886730-0
Opcode ID: b754adb56c43e386b0afc4775fcaaff742420ea94d90a37f8146628620dd8765
Instruction ID: f6eb336b45a09bc71512c47e4fa8df3c02e4e39dc6411b70d0bc810a77098bbe
Opcode Fuzzy Hash: b754adb56c43e386b0afc4775fcaaff742420ea94d90a37f8146628620dd8765
Instruction Fuzzy Hash: 0C212BB1900218BBDF00EFD5CD46BEEBBBCBB04B45F10452AF501BA1A0D7B895588B59

Uniqueness

Uniqueness Score: -1.00%

Function 00411764, Relevance: 9.0, APIs: 6, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00411764(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a44, void* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v52;
				void* _t10;
				intOrPtr _t23;

				_push(0x4013d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t23;
				_t10 = 0x24;
				L004013D0();
				_v12 = _t23;
				_v8 = 0x401298;
				L0040154A();
				L0040154A();
				_push(0x403434);
				L004014F6();
				_push(0x4117c7);
				L00401598();
				L00401598();
				return _t10;
			}

0x00411769
0x00411774
0x00411775
0x0041177e
0x0041177f
0x00411787
0x0041178a
0x00411797
0x004117a2
0x004117a7
0x004117ac
0x004117b1
0x004117b9
0x004117c1
0x004117c6

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 0041177F
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 00411797
__vbaVarDup.MSVBVM60(?,?,?,?,004013D6), ref: 004117A2
__vbaUI1Str.MSVBVM60(00403434,?,?,?,?,004013D6), ref: 004117AC
__vbaFreeVar.MSVBVM60(004117C7,00403434,?,?,?,?,004013D6), ref: 004117B9
__vbaFreeVar.MSVBVM60(004117C7,00403434,?,?,?,?,004013D6), ref: 004117C1

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk
String ID:
API String ID: 4042203372-0
Opcode ID: f6df2ea7a427fdfc4638dca5ca5fcb2d26f74bd34724e5b6da20520054cbf7f7
Instruction ID: 1630ce4507f86b402089639400a632bb78164f14329c329525d220bd0eb2e83e
Opcode Fuzzy Hash: f6df2ea7a427fdfc4638dca5ca5fcb2d26f74bd34724e5b6da20520054cbf7f7
Instruction Fuzzy Hash: B1F03A71450659BBCB04EB52DC42FEDB778FF55B08F40442EB502775E1DBBC2A048659

Uniqueness

Uniqueness Score: -1.00%

Function 00411B2E, Relevance: 7.5, APIs: 5, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00411B2E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v36;
				char _v44;
				char* _t18;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L004013D0();
				_v16 = _t29;
				_v12 = 0x4012c8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4013d6, _t26);
				_v36 = 0x17;
				_v44 = 2;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_t18 =  &_v44;
				_push(_t18);
				L004014EA();
				L004015B0();
				L00401598();
				_push(0x411bb8);
				L00401568();
				return _t18;
			}

0x00411b31
0x00411b40
0x00411b4a
0x00411b52
0x00411b55
0x00411b5c
0x00411b6b
0x00411b6e
0x00411b75
0x00411b7c
0x00411b7e
0x00411b80
0x00411b82
0x00411b84
0x00411b87
0x00411b88
0x00411b92
0x00411b9a
0x00411b9f
0x00411bb2
0x00411bb7

APIs

__vbaChkstk.MSVBVM60(?,004013D6), ref: 00411B4A
#702.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00411B88
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00411B92
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00411B9A
__vbaFreeStr.MSVBVM60(00411BB8,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00411BB2

Memory Dump Source

Source File: 00000000.00000002.1367109977.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1367102114.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1367124256.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1367134058.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#702ChkstkMove
String ID:
API String ID: 3665094559-0
Opcode ID: 26b16cb37d57849b767e451883163083b7c1dd1657dc8ff3854eda6d8cd14082
Instruction ID: baddc57fd212407a7d7bf966a6a4fbb940dc3deeb66ef946601cdda8b6dd700e
Opcode Fuzzy Hash: 26b16cb37d57849b767e451883163083b7c1dd1657dc8ff3854eda6d8cd14082
Instruction Fuzzy Hash: 45017C70804208BBCB00EB95CD46FCEBBB5AB45764F20432AF021B75E0DB785945CA58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO1001910 Sample Arrive Tracking No_SINI0068206497.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100 Parent PID: 5736

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: PO1001910 Sample Arrive Tracking No_SINI0068206497.exe PID: 7100 Parent PID: 5736 PO1001910 Sample Arrive Tracking No_SINI0068206497.exeCOMMON

Executed Functions

Function 00404BEE, Relevance: 1.5, APIs: 1, Instructions: 251COMMON

Function 00404C21, Relevance: 1.5, APIs: 1, Instructions: 236memoryCOMMON

Function 00404C48, Relevance: 1.5, APIs: 1, Instructions: 235COMMON

Function 00404C80, Relevance: 1.5, APIs: 1, Instructions: 225COMMON

Function 00411BD7, Relevance: 84.3, APIs: 38, Strings: 10, Instructions: 309COMMON

Function 00411BD7, Relevance: 84.3, APIs: 38, Strings: 10, Instructions: 309
COMMON

Function 00412AD3, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 163
COMMON

Function 00411513, Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Function 004015D4, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 421
COMMON

Function 00411161, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 208
COMMON

Function 00412198, Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 144
COMMON

Function 0041251D, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 192
COMMON

Function 00410E7B, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 111
COMMON

Function 004117DA, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 99
COMMON

Function 0041205E, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 82
COMMON

Function 0041194C, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 125
COMMON

Function 00412906, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 123
COMMON

Function 00412F14, Relevance: 22.6, APIs: 15, Instructions: 67
COMMON

Function 00411019, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 69
COMMON

Function 00412E42, Relevance: 16.6, APIs: 11, Instructions: 53
COMMON

Function 00412D61, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Function 004116CE, Relevance: 12.0, APIs: 8, Instructions: 40
COMMON

Function 0041241C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
COMMON

Function 00413016, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Function 004115D3, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Function 004127EF, Relevance: 9.1, APIs: 6, Instructions: 74
COMMON

Function 00411764, Relevance: 9.0, APIs: 6, Instructions: 30
COMMON

Function 00411B2E, Relevance: 7.5, APIs: 5, Instructions: 39
COMMON