Play interactive tour
Edit tourAnalysis Report SecuriteInfo.com.Trojan.VbCrypt.1981.29338.509
Overview
General Information
| Sample Name: | SecuriteInfo.com.Trojan.VbCrypt.1981.29338.509 (renamed file extension from 509 to exe) |
| Analysis ID: | 345046 |
| MD5: | 41e225be0600a7efd31ca3206f97ec17 |
| SHA1: | 260d739ff434f90daad6c2c724fc9333348e9007 |
| SHA256: | 50851ce50dcc51f9c8111e3071ee9b041181cd462cd263b38f28f51dbc79c38a |
| Tags: | GuLoader |
Most interesting Screenshot:  | |
Detection
GuLoader
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected GuLoader
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
PE / OLE file has an invalid certificate
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
Startup |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_VB6DownloaderGeneric | Yara detected VB6 Downloader Generic | Joe Security | ||
| JoeSecurity_GuLoader | Yara detected GuLoader | Joe Security |
Sigma Overview |
|---|
| No Sigma rule has matched |
|---|
Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
Compliance: |   |
|---|
| Uses 32bit PE files | Show sources | ||
| Source: | Static PE information: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_021652CD | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
Data Obfuscation: | |
|---|
| Yara detected GuLoader | Show sources | ||
| Source: | File source: | ||
| Yara detected VB6 Downloader Generic | Show sources | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_00409C59 | |
| Source: | Code function: | 0_2_004011E9 | |
| Source: | Code function: | 0_2_02163591 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion: | |
|---|
| Detected RDTSC dummy instruction sequence (likely for instruction hammering) | Show sources | ||
| Source: | RDTSC instruction interceptor: | ||
| Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) | Show sources | ||
| Source: | Binary or memory string: | ||
| Tries to detect virtualization through RDTSC time measurements | Show sources | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Code function: | 0_2_0216140F | |
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Binary or memory string: | ||
Anti Debugging: | |
|---|
| Found potential dummy code loops (likely to delay analysis) | Show sources | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_0216140F | |
| Source: | Code function: | 0_2_02164454 | |
| Source: | Code function: | 0_2_02164479 | |
| Source: | Code function: | 0_2_02161A6B | |
| Source: | Code function: | 0_2_021618AE | |
| Source: | Code function: | 0_2_021618AC | |
| Source: | Code function: | 0_2_021644DD | |
| Source: | Code function: | 0_2_02162522 | |
| Source: | Code function: | 0_2_02164B2B | |
| Source: | Code function: | 0_2_02164B75 | |
| Source: | Code function: | 0_2_02163BE6 | |
| Source: | Code function: | 0_2_02164BE5 | |
| Source: | Code function: | 0_2_021613EC | |
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Path Interception | Process Injection1 | Virtualization/Sandbox Evasion11 | OS Credential Dumping | Security Software Discovery411 | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Data Obfuscation | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Process Injection1 | LSASS Memory | Virtualization/Sandbox Evasion11 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information1 | Security Account Manager | Process Discovery1 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Binary Padding | NTDS | System Information Discovery21 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud |
Behavior Graph |
|---|
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetScreenshots |
|---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
|---|
Initial Sample |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 4% | ReversingLabs |
Dropped Files |
|---|
| No Antivirus matches |
|---|
Unpacked PE Files |
|---|
| No Antivirus matches |
|---|
Domains |
|---|
| No Antivirus matches |
|---|
URLs |
|---|
| No Antivirus matches |
|---|
Domains and IPs |
|---|
General Information |
|---|
| Joe Sandbox Version: | 31.0.0 Emerald |
| Analysis ID: | 345046 |
| Start date: | 27.01.2021 |
| Start time: | 16:19:07 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 11m 13s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | SecuriteInfo.com.Trojan.VbCrypt.1981.29338.509 (renamed file extension from 509 to exe) |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 35 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | MAL |
| Classification: | mal68.troj.evad.winEXE@1/0@0/0 |
| EGA Information: | Failed |
| HDC Information: | Failed |
| HCA Information: | Failed |
| Cookbook Comments: |
|
| Warnings: | Show All
|
Simulations |
|---|
Behavior and APIs |
|---|
| No simulations |
|---|
Joe Sandbox View / Context |
|---|
Created / dropped Files |
|---|
| No created / dropped files found |
|---|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 5.625631069652798 |
| TrID: |
|
| File name: | SecuriteInfo.com.Trojan.VbCrypt.1981.29338.exe |
| File size: | 136968 |
| MD5: | 41e225be0600a7efd31ca3206f97ec17 |
| SHA1: | 260d739ff434f90daad6c2c724fc9333348e9007 |
| SHA256: | 50851ce50dcc51f9c8111e3071ee9b041181cd462cd263b38f28f51dbc79c38a |
| SHA512: | a1a20040e223f8f78ffa845a1a362ec607fbb38e4f7f34fc4f17963d7e1c5d840869a89c610c68242713b628f13c616c2fa0609bf030683566ac5735651609d4 |
| SSDEEP: | 1536:Y+bSgYX0Y7aSE2Ex8qY4I0tLOMsxDUZAKcgFlfv35O7kl8De+M:DEX0Y7aSE7xHY4I0pmDbmYkQu |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.u.%.u.%.u...{.$.u.j.|...u...x.$.u.Rich%.u.........................PE..L....0.I..........................................@ |
File Icon |
|---|
 | |
| Icon Hash: | 11d0cca988e43480 |
Static PE Info |
|---|
General | |
|---|---|
| Entrypoint: | 0x40140c |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
| DLL Characteristics: | |
| Time Stamp: | 0x491530A5 [Sat Nov 8 06:24:37 2008 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 1e02c8ef609fc8033c11804967aa3948 |
Authenticode Signature |
|---|
| Signature Valid: | false |
| Signature Issuer: | E=TILLEMPER@Paulicianism7.NYS, CN=Pilandite4, OU=Hornviol, O=Rekompenserer, L=SHAHENS, S=VENTRICULITIDAE, C=CV |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | CAC4ADCD7033303DAF452FD592D6C90C |
| Thumbprint SHA-1: | 902697F79368DD47401D961D51B32CCCB5DCA049 |
| Thumbprint SHA-256: | A9A5C43F7DECB40E5AC1143E0D27AA012EB8812D119ADF17F00FD010F6E1E1C2 |
| Serial: | 00 |
Entrypoint Preview |
|---|
| Instruction |
|---|
| push 00402BFCh |
| call 00007FF554BA5E53h |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| xor byte ptr [eax], al |
| add byte ptr [eax], al |
| inc eax |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax-0Ch], ah |
| inc esp |
| das |
| sub edi, eax |
| lodsb |
| inc ecx |
| call far 1D55h : E02E0DA3h |
| pop edx |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add dword ptr [eax], eax |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| inc eax |
| adc al, ECh |
| add eax, dword ptr [esi+65h] |
| push 0000006Ch |
| bound esp, dword ptr [ebp+64h] |
| insd |
| je 00007FF554BA5E62h |
| inc ecx |
| add byte ptr [eax], ah |
| or byte ptr [ecx+00h], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| dec esp |
| xor dword ptr [eax], eax |
| or edx, dword ptr [esi-1D27008Eh] |
| wait |
| nop |
| dec esi |
| stosd |
| pushfd |
| pop edi |
| pop ecx |
| add eax, FB7F4921h |
| cli |
| sbb dl, dh |
| test byte ptr [edx], bl |
| jmp 00007FF56149F7ADh |
| scasd |
| xchg eax, ebx |
| or byte ptr [edx-7Ch], al |
| cmp cl, byte ptr [edi-53h] |
| xor ebx, dword ptr [ecx-48EE309Ah] |
| or al, 00h |
| stosb |
| add byte ptr [eax-2Dh], ah |
| xchg eax, ebx |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| pop ebp |
| adc byte ptr [eax], al |
| add byte ptr [ecx+0000000Eh], dl |
| push cs |
| add byte ptr [ebx+74h], dl |
| jc 00007FF554BA5EC3h |
| jo 00007FF554BA5ED0h |
| imul ebp, dword ptr [esi+67h], 656E7265h |
| jnc 00007FF554BA5E62h |
| or eax, 6F000901h |
Data Directories |
|---|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1d324 | 0x28 | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x2a000 | 0x1256 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x21000 | 0x708 | .data |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x238 | 0x20 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x1000 | 0x140 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Sections |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1c944 | 0x1d000 | False | 0.300604458513 | data | 5.94562175337 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
| .data | 0x1e000 | 0xb31c | 0x1000 | False | 0.00634765625 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x2a000 | 0x1256 | 0x2000 | False | 0.359375 | data | 3.33091481892 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Resources |
|---|
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| RT_ICON | 0x2a9ae | 0x8a8 | data | ||
| RT_ICON | 0x2a446 | 0x568 | GLS_BINARY_LSB_FIRST | ||
| RT_GROUP_ICON | 0x2a424 | 0x22 | data | ||
| RT_VERSION | 0x2a120 | 0x304 | data | Chinese | Taiwan |
Imports |
|---|
| DLL | Import |
|---|---|
| MSVBVM60.DLL | __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaStrFixstr, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaUbound, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaVar2Vec, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaUI1Str, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj |
Version Infos |
|---|
| Description | Data |
|---|---|
| Translation | 0x0404 0x04b0 |
| LegalCopyright | Copyright TekSuS |
| InternalName | GAUFFERED |
| FileVersion | 3.01 |
| CompanyName | TekSuS Silicon |
| LegalTrademarks | Copyright TekSuS |
| ProductName | reaving |
| ProductVersion | 3.01 |
| FileDescription | TekSuS Silicon |
| OriginalFilename | GAUFFERED.exe |
Possible Origin |
|---|
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Chinese | Taiwan |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
| No network behavior found |
|---|
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
System Behavior |
|---|
General |
|---|
| Start time: | 16:20:01 |
| Start date: | 27/01/2021 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.VbCrypt.1981.29338.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 136968 bytes |
| MD5 hash: | 41E225BE0600A7EFD31CA3206F97EC17 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Visual Basic |
| Reputation: | low |
Disassembly |
|---|
Code Analysis |
|---|
Executed Functions |
|---|
Function 00405752, Relevance: 133.8, APIs: 72, Strings: 4, Instructions: 761COMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
Function 021644DD, Relevance: 1.3, Strings: 1, Instructions: 79COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0216140F, Relevance: .5, Instructions: 496COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 021613EC, Relevance: .3, Instructions: 301COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02164B2B, Relevance: .2, Instructions: 215COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 021618AE, Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02164B75, Relevance: .1, Instructions: 124COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02164BE5, Relevance: .1, Instructions: 113COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02161A6B, Relevance: .1, Instructions: 88COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 021618AC, Relevance: .1, Instructions: 84COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02164479, Relevance: .1, Instructions: 62COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02164454, Relevance: .0, Instructions: 26COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02162522, Relevance: .0, Instructions: 6COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02163BE6, Relevance: .0, Instructions: 4COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 021652CD, Relevance: .0, Instructions: 3COMMON
Download Yara Rule
| Memory Dump Source |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041D0C0, Relevance: 40.7, APIs: 27, Instructions: 172COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004167B0, Relevance: 19.6, APIs: 13, Instructions: 130COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004169C0, Relevance: 16.6, APIs: 11, Instructions: 107COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041CA80, Relevance: 9.1, APIs: 6, Instructions: 86COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041C600, Relevance: 9.1, APIs: 6, Instructions: 67COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041C510, Relevance: 9.1, APIs: 6, Instructions: 63COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 0041C710, Relevance: 7.6, APIs: 5, Instructions: 77COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 004166B0, Relevance: 6.1, APIs: 4, Instructions: 58COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |