Play interactive tour

Edit tour

Analysis Report Zahlung_03242021_jpg.scr

Overview

General Information

Sample Name:	Zahlung_03242021_jpg.scr (renamed file extension from scr to exe)
Analysis ID:	377275
MD5:	6540b24ec7d131ccbc57624915f9180c
SHA1:	2c29267c98ff52bb6a44e3e3dca1c0d1c668c870
SHA256:	ea36f17e9a118b567da5b9be48f13527cdd109da17d5e5abb0809f9356622f9b
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found potential dummy code loops (likely to delay analysis)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Found large amount of non-executed APIs

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Zahlung_03242021_jpg.exe (PID: 6464 cmdline: 'C:\Users\user\Desktop\Zahlung_03242021_jpg.exe' MD5: 6540B24EC7D131CCBC57624915F9180C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Zahlung_03242021_jpg.exe PID: 6464	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Zahlung_03242021_jpg.exe PID: 6464	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Zahlung_03242021_jpg.exe	Virustotal: Detection: 64%	Perma Link
Source: Zahlung_03242021_jpg.exe	Metadefender: Detection: 24%	Perma Link
Source: Zahlung_03242021_jpg.exe	ReversingLabs: Detection: 75%

Source: Zahlung_03242021_jpg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Process Stats: CPU usage > 98%

Source: Zahlung_03242021_jpg.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConfidency.exe vs Zahlung_03242021_jpg.exe
Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1159005735.0000000002B30000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameConfidency.exeFE2X/ vs Zahlung_03242021_jpg.exe
Source: Zahlung_03242021_jpg.exe	Binary or memory string: OriginalFilenameConfidency.exe vs Zahlung_03242021_jpg.exe

Source: Zahlung_03242021_jpg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

File created: C:\Users\user\AppData\Local\Temp\~DF191876E3B643CC71.TMP

Jump to behavior

Source: Zahlung_03242021_jpg.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Zahlung_03242021_jpg.exe	Virustotal: Detection: 64%
Source: Zahlung_03242021_jpg.exe	Metadefender: Detection: 24%
Source: Zahlung_03242021_jpg.exe	ReversingLabs: Detection: 75%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: Zahlung_03242021_jpg.exe PID: 6464, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: Zahlung_03242021_jpg.exe PID: 6464, type: MEMORY

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_00408423 push ebp; retf	0_2_0040842F
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_00407EC0 pushfd ; ret	0_2_00407EE9
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_00405A91 push ebx; retf	0_2_00405B20
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_00405B72 push ebx; retf	0_2_00405B20
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_004053B8 push ecx; iretd	0_2_004053BB

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02201294	0_2_02201294
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02201310	0_2_02201310
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02201378	0_2_02201378

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Zahlung_03242021_jpg.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	RDTSC instruction interceptor: First address: 0000000002204926 second address: 0000000002204926 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp byte ptr [esi+ecx], 00000000h 0x00000007 je 00007FDEA0DE30ECh 0x00000009 inc ecx 0x0000000a cmp ecx, ebx 0x0000000c jnl 00007FDEA0DE306Ch 0x00000012 jmp 00007FDEA0DE315Eh 0x00000014 pushad 0x00000015 mov eax, 0000003Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	RDTSC instruction interceptor: First address: 0000000002204684 second address: 0000000002204684 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FDEA0809995h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f cmp eax, 30D55D6Fh 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp dword ptr [ebp+000000F8h], 00000000h 0x00000031 jne 00007FDEA0809964h 0x00000033 test cx, bx 0x00000036 call 00007FDEA08099D2h 0x0000003b call 00007FDEA08099A5h 0x00000040 lfence 0x00000043 mov edx, dword ptr [7FFE0014h] 0x00000049 lfence 0x0000004c ret 0x0000004d mov esi, edx 0x0000004f pushad 0x00000050 rdtsc

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Code function: 0_2_0220467C rdtsc

0_2_0220467C

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

API coverage: 0.3 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Zahlung_03242021_jpg.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe

Code function: 0_2_0220467C rdtsc

0_2_0220467C

Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02201A7C mov eax, dword ptr fs:[00000030h]	0_2_02201A7C
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02201AAE mov eax, dword ptr fs:[00000030h]	0_2_02201AAE
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02204AE0 mov eax, dword ptr fs:[00000030h]	0_2_02204AE0
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_02203B27 mov eax, dword ptr fs:[00000030h]	0_2_02203B27
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_0220439F mov eax, dword ptr fs:[00000030h]	0_2_0220439F
Source: C:\Users\user\Desktop\Zahlung_03242021_jpg.exe	Code function: 0_2_0220252F mov eax, dword ptr fs:[00000030h]	0_2_0220252F

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1158507898.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1158507898.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1158507898.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Zahlung_03242021_jpg.exe, 00000000.00000002.1158507898.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery411	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Zahlung_03242021_jpg.exe	64%	Virustotal		Browse
Zahlung_03242021_jpg.exe	24%	Metadefender		Browse
Zahlung_03242021_jpg.exe	76%	ReversingLabs	Win32.Trojan.Vebzenpak

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	377275
Start date:	29.03.2021
Start time:	11:15:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Zahlung_03242021_jpg.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.420240325918891
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Zahlung_03242021_jpg.exe
File size:	98304
MD5:	6540b24ec7d131ccbc57624915f9180c
SHA1:	2c29267c98ff52bb6a44e3e3dca1c0d1c668c870
SHA256:	ea36f17e9a118b567da5b9be48f13527cdd109da17d5e5abb0809f9356622f9b
SHA512:	9228c775e816af94b385b3ca03a43653c8fc8ff674c03b5bd4fb8ebf071eb55099b8eca30e9fc8001a2aee88cf00d04a656c9ee536fa03655eebe2889f8154fa
SSDEEP:	1536:8g9twd+oMfleXcQ2T9gg86snOuC194pnLbl8Xc0Eew04nPai0Kt:8nQeXoT1W19259i0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....6_P.................@...@...............P....@................

File Icon


Icon Hash:	11d0ecac88e43480

Static PE Info

General
Entrypoint:	0x4015b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x505F36E5 [Sun Sep 23 16:20:53 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0ecd972e837a1a17658b43cce3314253

Entrypoint Preview

Instruction
push 00402E74h
call 00007FDEA05C1F93h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, dh
retn E273h
and ch, byte ptr [edi-6366BBE6h]
sub al, 6Eh
in eax, dx
sub dword ptr [edi+60h], ebp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
and byte ptr [eax], ah
and byte ptr [eax], ah
and byte ptr [eax], ah
inc esi
dec esp
pop ecx
push esi
inc ebp
inc esp
pop ecx
inc edi
push esp
dec ecx
inc edi
add byte ptr [ebx+69h], dh
imul ebp, dword ptr [ebx+00h], 00h
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or ebx, dword ptr [ebp+46h]
jnp 00007FDEA05C1F55h
idiv byte ptr [esi+esi*2]
inc ebx
mov eax, 4224415Bh
adc al, 3Ch
or ebp, ecx
adc dword ptr [ebx-444A3438h], edx
dec edx
mov cl, 90h
push FFFFFFCBh
pop ebx
sbb al, C6h
fstsw word ptr [edx]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push eax
pop ss
add byte ptr [eax], al
adc ax, 00000000h
add byte ptr [74654700h], al
push 010D0065h
or al, 00h
jc 00007FDEA05C200Ch
je 00002016h
imul ebp, dword ptr [ebx+6Bh], 00000065h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13ff4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1958	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x178	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x135cc	0x14000	False	0.362646484375	data	5.77045811117	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0x120c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1958	0x2000	False	0.516723632812	data	4.53448005224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x180b0	0x8a8	data
RT_ICON	0x179e8	0x6c8	data
RT_ICON	0x17480	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x17450	0x30	data
RT_VERSION	0x17150	0x300	data	Telugu	India

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaVarErrI4, __vbaFPException, __vbaUbound, __vbaDateVar, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, _CIatan, __vbaStrMove, __vbaCastObj, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x044a 0x04b0
LegalCopyright	Copyright MateFar
InternalName	Confidency
FileVersion	3.00
CompanyName	MateFar
LegalTrademarks	Copyright MateFar
ProductName	uncatechizedness
ProductVersion	3.00
FileDescription	MateFar
OriginalFilename	Confidency.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Telugu	India

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Zahlung_03242021_jpg.exe PID: 6464 Parent PID: 5996

General

Start time:	11:16:19
Start date:	29/03/2021
Path:	C:\Users\user\Desktop\Zahlung_03242021_jpg.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Zahlung_03242021_jpg.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	6540B24EC7D131CCBC57624915F9180C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Zahlung_03242021_jpg.exe PID: 6464 Parent PID: 5996 Zahlung_03242021_jpg.exeCOMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 004015B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(VB5!6&*), ref: 004015B5

Strings

VB5!6&*, xrefs: 004015B0

Memory Dump Source

Source File: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: d091e5f293516acce9e9111abdd6fa84563558a31734f49018d003274c7ff1a5
Instruction ID: 3b2306a053cd1ebf605c13ac41379a6285f2ce94c5b3aff9a9c7cdce51c88b6c
Opcode Fuzzy Hash: d091e5f293516acce9e9111abdd6fa84563558a31734f49018d003274c7ff1a5
Instruction Fuzzy Hash: 05D0B64198E3C11ED70312714D255823F704D63A2138B01E780C1DE0F3809C084AC37A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02201294, Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8b3eb97efe178f70d4560d85016d2c4c40f43addcde4e9e2d28a31c252fe84
Instruction ID: 965881f936d26e85a374af8dde96c03dc7f1149319347bc4caaff2cc49778398
Opcode Fuzzy Hash: 9c8b3eb97efe178f70d4560d85016d2c4c40f43addcde4e9e2d28a31c252fe84
Instruction Fuzzy Hash: ABB13C70650306AFDB288FA8CCC1BD573A6FF89304F484216E85C972DEC774A8A5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02201310, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc6471b0db3b4bf13e93f4f4477fb0b33c678f3bb047c4e5ae6a18074e9c504
Instruction ID: 95ecb74f0b57c8e9c0b5a9b14551e9708aa097ec530bf579a3100281b2693b70
Opcode Fuzzy Hash: 1cc6471b0db3b4bf13e93f4f4477fb0b33c678f3bb047c4e5ae6a18074e9c504
Instruction Fuzzy Hash: 4C912B70350706AFE7288FA8CCC4BE5B3A6FF48304F444225E85D972DAC774A8A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02201378, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2b7da9faaa6ae779196548e810422097dc5cf7075caec9ee8475fb4d840bf3
Instruction ID: c9f86363e217e7037b266e9f7d0d7c2aaf066759d6891313d1d3bc952481969c
Opcode Fuzzy Hash: dd2b7da9faaa6ae779196548e810422097dc5cf7075caec9ee8475fb4d840bf3
Instruction Fuzzy Hash: 6991F970650706AFE728CFA8CCC4BD5B3A6FF49304F484225E85D932DAC774A8A5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02204AE0, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be56ea548673acabf4074d99636c210276e572e73b62bfd5300030326c8d261
Instruction ID: a81aae91976b48c1799bcd34e178da6fd424841c14b2a0bcaa5b8f936389c9ef
Opcode Fuzzy Hash: 6be56ea548673acabf4074d99636c210276e572e73b62bfd5300030326c8d261
Instruction Fuzzy Hash: 538198749243428FDB25EFA8C4D8B15BB91AF52324F44C299DBA58F2EFD3748442C722

Uniqueness

Uniqueness Score: -1.00%

Function 02201A7C, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f67a657f2875dfd896b2381bc2eac35f5a1b4aadc0cf4ce80a73b254d94f1a
Instruction ID: 1195bb7e3204a2aa33054f28c345c27431df6ca7b7b7d3c0923bd33d267cd0aa
Opcode Fuzzy Hash: 92f67a657f2875dfd896b2381bc2eac35f5a1b4aadc0cf4ce80a73b254d94f1a
Instruction Fuzzy Hash: 8B319F70264341DFE728AFA8CCA8F9877A1BF14314F558246F9495B1EBC7B4D880CE26

Uniqueness

Uniqueness Score: -1.00%

Function 02201AAE, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ef0c083036c2467f2431126a15ee41e33f9202a209ed779ba67f01d4250fb0
Instruction ID: 138a8bac7907199c23856a3a805eeecaf2f98f51a0552d203cb856f80802faee
Opcode Fuzzy Hash: e8ef0c083036c2467f2431126a15ee41e33f9202a209ed779ba67f01d4250fb0
Instruction Fuzzy Hash: 35118630264345DFEB399F948CE9F9877A1AF04704F558146EE491F1EBC3B49880CE2A

Uniqueness

Uniqueness Score: -1.00%

Function 0220439F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211519dafd323de80604661b745c86749b34ded6743479c5ab8541c0091a932f
Instruction ID: 14f37be770d152261e884c792ef61c119327e701e63220770f354c345d46f783
Opcode Fuzzy Hash: 211519dafd323de80604661b745c86749b34ded6743479c5ab8541c0091a932f
Instruction Fuzzy Hash: D4E06D713212008FC718EF58E6C4F1AB3A1AF50700F26C4A5EA01CB2ABC330E804CA20

Uniqueness

Uniqueness Score: -1.00%

Function 0220467C, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e26b0496828cf8274a67c5f70d3a0533510a7abc9d43f36a85d2e9c1595780a
Instruction ID: 32c4e960bc87860f595a3235b54a0dc0d59dc12635a26170baa6b4a1a45c7444
Opcode Fuzzy Hash: 0e26b0496828cf8274a67c5f70d3a0533510a7abc9d43f36a85d2e9c1595780a
Instruction Fuzzy Hash: B0B012439345A10E1B6232F066880F9040345C3335B02C6711591A688EF8440DF58C41

Uniqueness

Uniqueness Score: -1.00%

Function 0220252F, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e5e6cbfc98978d6a8a88901a4c2006f363e7d85758fed38affd00d814cd154
Instruction ID: ad887336c0fe02d6192b6151204e1bba661cd126c0ad2c215e8822d4e57ab306
Opcode Fuzzy Hash: 09e5e6cbfc98978d6a8a88901a4c2006f363e7d85758fed38affd00d814cd154
Instruction Fuzzy Hash: C8C092BA2115868FFF22DB08C582F4073B0FB44788F0804E0E802DFB12C228F900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02203B27, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1158574057.0000000002200000.00000040.00000001.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2200000_Zahlung_03242021_jpg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320350306a85845e395bdfffc1c4bd2752c9f224a3691c143496b21128e27f27
Instruction ID: 8773e74473c40e6e942a70fb39358b1f2dc8750ed625c9488d2ece88a5d988d9
Opcode Fuzzy Hash: 320350306a85845e395bdfffc1c4bd2752c9f224a3691c143496b21128e27f27
Instruction Fuzzy Hash: 5AB09274226640CFC285DE0CC1A1E8073B0FB04684F4104D0E8028BB1AC368E800C900

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90, Relevance: 40.7, APIs: 27, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00413E00
__vbaStrCopy.MSVBVM60 ref: 00413E08
__vbaStrCopy.MSVBVM60 ref: 00413E10
__vbaAryConstruct2.MSVBVM60(?,0040456C,00000011), ref: 00413E1D
__vbaStrToAnsi.MSVBVM60(?,?,00000000,0002003F,?), ref: 00413E3B
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00413E4F
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00413E5D
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00413E66
__vbaStrToAnsi.MSVBVM60(?,?,?,?,00000000), ref: 00413E78
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000), ref: 00413E88
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 00413E9A
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00413EAE
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00413EB8
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00413ECA
__vbaStrCopy.MSVBVM60 ref: 00413EDF
__vbaUbound.MSVBVM60(00000001,?), ref: 00413EEC
#617.MSVBVM60(?,?,-00000001), ref: 00413F1A
__vbaStrVarMove.MSVBVM60(?), ref: 00413F24
__vbaStrMove.MSVBVM60 ref: 00413F2F
__vbaFreeVar.MSVBVM60 ref: 00413F38
__vbaSetSystemError.MSVBVM60(?), ref: 00413F54
__vbaFreeStr.MSVBVM60(00413FB1), ref: 00413F87
__vbaFreeStr.MSVBVM60 ref: 00413F8C
__vbaFreeStr.MSVBVM60 ref: 00413F91
__vbaFreeStr.MSVBVM60 ref: 00413F96
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00413FAA

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$Copy$AnsiErrorSystemUnicode$Move$#617Construct2DestructListUbound
String ID:
API String ID: 901077922-0
Opcode ID: 03b822e4e6e238988913f9e22b2ea4dfd14c458947d488a4a7844dd7ed96cb22
Instruction ID: 7beebc614e625b167ee2075d1cccf18e060a08a146c58e6e93e9903d1d3aa038
Opcode Fuzzy Hash: 03b822e4e6e238988913f9e22b2ea4dfd14c458947d488a4a7844dd7ed96cb22
Instruction Fuzzy Hash: AE61DAB5D00219ABCB14DFA4DD84ADEBBB8FF48700F10816AF605B7264DB745A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411E40, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,004043A0,00000008), ref: 00411EBB
__vbaStrCopy.MSVBVM60 ref: 00411ECF
__vbaStrCopy.MSVBVM60 ref: 00411EDC
__vbaVarDup.MSVBVM60 ref: 00411EF7
#710.MSVBVM60(?,?), ref: 00411F1E
__vbaStrMove.MSVBVM60 ref: 00411F29
__vbaStrCmp.MSVBVM60(0040438C,00000000), ref: 00411F35
__vbaFreeStr.MSVBVM60 ref: 00411F48
__vbaFreeVar.MSVBVM60 ref: 00411F51
__vbaNew2.MSVBVM60(00403290,Q), ref: 00411F73
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411F92
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004041A0,000000F8), ref: 00411FB5
__vbaNew2.MSVBVM60(00403290,Q), ref: 00411FCE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411FE7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,00000120), ref: 0041200D
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00412025
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,00000044), ref: 00412123
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00412155
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412165
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 00412175
__vbaAryDestruct.MSVBVM60(00000000,?,004121E6), ref: 004121D6
__vbaFreeObj.MSVBVM60 ref: 004121DF

Strings

Q, xrefs: 00411F60, 00411F69, 00411F79, 00411FBB, 00411FC4, 00411FD4

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresultNew2$CopyList$#710Construct2DestructLateMove
String ID: Q
API String ID: 4036593355-1716927825
Opcode ID: fbf6adf3f4b3372571d35233aeb12349922fe188a7e3bc60c1738a4aec0ed4bc
Instruction ID: e4d9619ce82f21dd93da530e85b4b3e84755847301ce314e4d2c3f8fe37e4dd5
Opcode Fuzzy Hash: fbf6adf3f4b3372571d35233aeb12349922fe188a7e3bc60c1738a4aec0ed4bc
Instruction Fuzzy Hash: CCB1F8B4E00218DFDB10DFA9C984ADDBBB8FF88300F1085AAE559EB251D7749946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00412510, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60 ref: 00412567
#717.MSVBVM60(?,?,00000003,00000000), ref: 00412578
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412594
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004125A7
__vbaNew2.MSVBVM60(00403290,Q), ref: 004125CC
__vbaObjSet.MSVBVM60(?,00000000), ref: 004125E5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,00000050), ref: 00412606
#716.MSVBVM60(?,?,00000000), ref: 00412615
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041263C
__vbaFreeStr.MSVBVM60 ref: 00412645
__vbaFreeObj.MSVBVM60 ref: 0041264E
__vbaFreeVar.MSVBVM60 ref: 00412657
__vbaNew2.MSVBVM60(00403290,Q), ref: 00412670
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412689
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,000000D0), ref: 004126B0
__vbaFreeObj.MSVBVM60 ref: 004126BF
__vbaFreeObj.MSVBVM60(00412700), ref: 004126F9

Strings

Q, xrefs: 004125B9, 004125C2, 004125D2, 0041265D, 00412666, 00412676

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresultNew2$#716#717LateList
String ID: Q
API String ID: 1662082557-1716927825
Opcode ID: 1feef426f396b94c7d45f7270d641e626ffb8038796c7299510072daf28a915d
Instruction ID: d956177cadb818439c7ff2194422cbf254ed5103690f668f65a145fbb323657a
Opcode Fuzzy Hash: 1feef426f396b94c7d45f7270d641e626ffb8038796c7299510072daf28a915d
Instruction Fuzzy Hash: A25118B5900219EBCB14DFA4DD88EDEBBB8FB88700F10852AE545B72A0D7745945CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413A50, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00413AAE
#575.MSVBVM60(?,?), ref: 00413ACA
__vbaVarTstNe.MSVBVM60(?,?), ref: 00413AE6
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00413AF9
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00413B1D
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000004C), ref: 00413B42
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404354,00000024), ref: 00413B70
__vbaStrMove.MSVBVM60 ref: 00413B7F
__vbaFreeObj.MSVBVM60 ref: 00413B88
__vbaNew2.MSVBVM60(00403290,Q), ref: 00413BA1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413BBA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404190,00000168), ref: 00413BE1
__vbaFreeObj.MSVBVM60 ref: 00413BF0
__vbaFreeStr.MSVBVM60(00413C38), ref: 00413C30
__vbaFreeStr.MSVBVM60 ref: 00413C35

Strings

Plagenes, xrefs: 00413B51
Recerptpligtige3, xrefs: 00413B56
Q, xrefs: 00413B8E, 00413B97, 00413BA7

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$#575CopyListMove
String ID: Plagenes$Recerptpligtige3$Q
API String ID: 1705637843-1778801150
Opcode ID: 8dabc24a3e5c170d5cef51bc47fa25959c74a12083aad8876779d46f8c3b1dc8
Instruction ID: 8db304ffb23b25a52ffdeb2d78d21449e8e17583f49bae482d376e7ad486e4e0
Opcode Fuzzy Hash: 8dabc24a3e5c170d5cef51bc47fa25959c74a12083aad8876779d46f8c3b1dc8
Instruction Fuzzy Hash: 54515DB1900208EFCB10DF94D989ADEBFB8FF98701F24411AE501B72A1D7786985CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411C00, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60 ref: 00411C6C
#513.MSVBVM60(?,?,00000002), ref: 00411C7C
__vbaVarTstNe.MSVBVM60(?,?), ref: 00411C98
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00411CAB
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00411CCF
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 00411CF4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,0000005C,?,?,?,?), ref: 00411D48
__vbaStrMove.MSVBVM60(?,?,?,?), ref: 00411D57
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00411D60
__vbaNew2.MSVBVM60(00403290,Q), ref: 00411D79
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411D92
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404190,000001E8), ref: 00411DB9
__vbaFreeObj.MSVBVM60 ref: 00411DC8
__vbaFreeStr.MSVBVM60(00411E09), ref: 00411E02

Strings

Q, xrefs: 00411D66, 00411D6F, 00411D7F

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$#513ListMove
String ID: Q
API String ID: 3426716858-1716927825
Opcode ID: 3b9d774c2abcb145d4466f0a0743e66c6fbfb5a960e14d6b358b714ecd591d21
Instruction ID: f2677990915bee0e63d579efb8ab0930f40729bfb35e7baa0156175876f0eeb9
Opcode Fuzzy Hash: 3b9d774c2abcb145d4466f0a0743e66c6fbfb5a960e14d6b358b714ecd591d21
Instruction Fuzzy Hash: 67512BB4900308DFCB14DF95DA89ADEBBB8FF98700F20816AE545B7260D7746A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413600, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0041365E
__vbaVarDup.MSVBVM60 ref: 00413682
#557.MSVBVM60(?), ref: 0041368C
__vbaFreeVar.MSVBVM60 ref: 004136A3
__vbaNew2.MSVBVM60(00403290,Q), ref: 004136F9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413712
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004041A0,00000048), ref: 00413733
#596.MSVBVM60(?,?,?,?,?,?,?), ref: 00413764
__vbaStrMove.MSVBVM60 ref: 0041376F
__vbaFreeObj.MSVBVM60 ref: 00413778
__vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0041379F
__vbaFreeStr.MSVBVM60(004137FD), ref: 004137F5
__vbaFreeStr.MSVBVM60 ref: 004137FA

Strings

10/10/10, xrefs: 00413672
Q, xrefs: 004136D1, 004136EF, 004136FF

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#557#596CheckCopyHresultListMoveNew2
String ID: 10/10/10$Q
API String ID: 4010984379-272116784
Opcode ID: f2b2e0631b1d6637651cc80aeefe3ca0706ca4bad33ccbc03fea568a2b4472ef
Instruction ID: ef806613b268a895c87af2c3a2b80ce9b6d19521a017b8f8678cc6151cf0a61d
Opcode Fuzzy Hash: f2b2e0631b1d6637651cc80aeefe3ca0706ca4bad33ccbc03fea568a2b4472ef
Instruction Fuzzy Hash: 4551D5B5D102299FCB14DFA4DD84AEEBBB8FB48700F14412EE506B7290DB745A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00412A10, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00412A59
__vbaStrCopy.MSVBVM60 ref: 00412A61
#582.MSVBVM60(00000000,00000000), ref: 00412A65
__vbaFpR8.MSVBVM60 ref: 00412A6B
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00412A94
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 00412AB9
__vbaNew2.MSVBVM60(00403290,Q), ref: 00412ADA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412AF3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404208,00000070), ref: 00412B14
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000060), ref: 00412B4E
__vbaFreeStr.MSVBVM60 ref: 00412B57
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412B67
__vbaFreeStr.MSVBVM60(00412BA6), ref: 00412B9E
__vbaFreeStr.MSVBVM60 ref: 00412BA3

Strings

Q, xrefs: 00412ABF, 00412AD0, 00412AE0

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$CopyNew2$#582List
String ID: Q
API String ID: 227960205-1716927825
Opcode ID: 02993cd2ff3d5c56097e47630382d21020c803185909d794abbc67188778e41c
Instruction ID: 59f00e38ab724fcd6d432b37438528e4c89194acabf9f1e9f924d0cc0ad71efa
Opcode Fuzzy Hash: 02993cd2ff3d5c56097e47630382d21020c803185909d794abbc67188778e41c
Instruction Fuzzy Hash: C7415270A002099BDB10DF94DD49FEEBBB8FF58701F10812AE545F7260D7746945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411610, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041165C
#521.MSVBVM60(00404368,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411667
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411672
__vbaStrCmp.MSVBVM60(00404374,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041167E
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411691
__vbaNew2.MSVBVM60(00404344,0041536C,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004116AE
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 004116D3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000050), ref: 004116F3
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004116FC
__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411715
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041172E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004041A0,00000130), ref: 00411755
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411764
__vbaFreeStr.MSVBVM60(0041178E,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411787

Strings

Q, xrefs: 00411702, 0041170B, 0041171B

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$#521CopyMove
String ID: Q
API String ID: 3440021174-1716927825
Opcode ID: ab327b84e5e5e6ee5499449d3c2110dcc18e16c0f8662ecd960e91ff766fcd7e
Instruction ID: 53f59e0de2af4de2c019c0d675841a4d0bfa243aeab8de95ad0b8171ac469b00
Opcode Fuzzy Hash: ab327b84e5e5e6ee5499449d3c2110dcc18e16c0f8662ecd960e91ff766fcd7e
Instruction Fuzzy Hash: 6B415F74A40215DBCB10DFA0DD49EDEBBB8FF98701B244126F952F72A0D7785981CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004130E0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#711.MSVBVM60(?,00404400,?,000000FF,00000000), ref: 0041314A
__vbaAryVar.MSVBVM60(00002008,?), ref: 00413159
__vbaAryCopy.MSVBVM60(?,?), ref: 0041316A
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 0041317A
__vbaGenerateBoundsError.MSVBVM60 ref: 0041319C
__vbaGenerateBoundsError.MSVBVM60 ref: 004131AE
__vbaStrCmp.MSVBVM60(004043CC), ref: 004131C3
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 004131E3
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 00413208
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000060), ref: 0041324D
__vbaFreeObj.MSVBVM60 ref: 00413256
__vbaAryDestruct.MSVBVM60(00000000,?,00413295), ref: 0041328E

Strings

lanesome, xrefs: 00413230

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$BoundsCheckErrorFreeGenerateHresult$#711CopyDestructListNew2
String ID: lanesome
API String ID: 3512543102-2063710345
Opcode ID: 397a25ff76e8dfff4c168555126b7e63f7072e308d8d55bd97810579fb001126
Instruction ID: 7ed5cd033a0da52103017a8188bd496e611513210d914c822e3defdb58beb747
Opcode Fuzzy Hash: 397a25ff76e8dfff4c168555126b7e63f7072e308d8d55bd97810579fb001126
Instruction Fuzzy Hash: 0C5180B0A00258EFDF04DF95DD49EEEBBB8FF84701F10811AE905A72A0D7789946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004132C0, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00413306
#652.MSVBVM60(?,?), ref: 00413322
__vbaVarTstNe.MSVBVM60(?,?), ref: 0041333E
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00413351
__vbaNew2.MSVBVM60(00403290,Q), ref: 00413376
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041338F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,00000110), ref: 004133B6
#529.MSVBVM60(00000002), ref: 004133D0
__vbaFreeObj.MSVBVM60 ref: 004133D9
__vbaFreeVar.MSVBVM60 ref: 004133E2
__vbaFreeStr.MSVBVM60(00413423), ref: 0041341C

Strings

Out of string space, xrefs: 00413330
Q, xrefs: 00413363, 0041336C, 0041337C

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#529#652CheckCopyHresultListNew2
String ID: Out of string space$Q
API String ID: 2022130285-1045717457
Opcode ID: 6554cc8ac67a27cedd01b6c9d93f54e50b9eb306985a9c5f416aa0e23efa685f
Instruction ID: 7238893bfac66153a181cb07c52590c6d49e8d7ed8e9fdd673d4e65c82300e60
Opcode Fuzzy Hash: 6554cc8ac67a27cedd01b6c9d93f54e50b9eb306985a9c5f416aa0e23efa685f
Instruction Fuzzy Hash: 95313DB1C00209DFCB14DF99D949ADEBBB8FF48701F10802AE555B7260D7745549CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00412D90, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60 ref: 00412DF4
#617.MSVBVM60(?,?,00000001), ref: 00412E04
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412E20
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00412E33
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00412E57
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,00000044), ref: 00412F36
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00412F6D
__vbaFreeVar.MSVBVM60 ref: 00412F76
__vbaFreeObj.MSVBVM60(00412FAE), ref: 00412FA7

Strings

bugthvlens, xrefs: 00412F0B
C@, xrefs: 00412F12

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#617CheckHresultLateListNew2
String ID: bugthvlens$C@
API String ID: 1372141498-444405750
Opcode ID: 5cee977c3f030da6d1aed2836c942a43b7dda01de1209bde7c75a567fc77acb4
Instruction ID: 58cf1a76f2544fa3f7bcd64806274a32affa685c412ba33e63cfa6d418e0ed0f
Opcode Fuzzy Hash: 5cee977c3f030da6d1aed2836c942a43b7dda01de1209bde7c75a567fc77acb4
Instruction Fuzzy Hash: 6561C0B4E00308DFDB14DFA8C985A9DBFB4FB48700F24816AE909AB395D7749985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00412BC0, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#678.MSVBVM60(00000000,3FF00000,00000000,40000000,00000000,40080000,?,?), ref: 00412C2A
__vbaFpR8.MSVBVM60 ref: 00412C30
__vbaFpR8.MSVBVM60 ref: 00412C4C
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00412C77
__vbaNew2.MSVBVM60(00403290,Q), ref: 00412CAE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412CC7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404190,00000048), ref: 00412CE8
#595.MSVBVM60(?,00000000,?,?,?), ref: 00412D14
__vbaFreeObj.MSVBVM60 ref: 00412D1D
__vbaFreeVarList.MSVBVM60(00000004,00000008,?,?,?), ref: 00412D35

Strings

Q, xrefs: 00412C89, 00412CA4, 00412CB4

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$List$#595#678CheckHresultNew2
String ID: Q
API String ID: 3306070155-1716927825
Opcode ID: ece13dbbb381eada73733f3076f0b6c369a052783d495446cf5c463950452a6c
Instruction ID: 17895120ffc74d7013e14686d232ffa6f99671e8ba890d0965bf8b1f21aaf9bc
Opcode Fuzzy Hash: ece13dbbb381eada73733f3076f0b6c369a052783d495446cf5c463950452a6c
Instruction Fuzzy Hash: FE4118B1900208ABDB10DF94DE89BDEBFB8FF48700F10412AE545F6250D7785985CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413910, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00403290,Q), ref: 00413969
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413982
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004041A0,00000130), ref: 004139A9
__vbaVarErrI4.MSVBVM60(?,?), ref: 004139B8
#559.MSVBVM60(00000000), ref: 004139BF
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004139D5
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004139DE
#580.MSVBVM60(Maxim5,00000001), ref: 004139F0

Strings

Q, xrefs: 00413947, 0041395F, 0041396F
Maxim5, xrefs: 004139EB

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#559#580CheckHresultNew2
String ID: Maxim5$Q
API String ID: 1414499412-1006315231
Opcode ID: 9bb85758233213bc86b3426659878cb4e612d51d4d3cea01ef32de00b74d17fe
Instruction ID: c20cb662129c871db86320a0b19fd2b01c3f06f77a5f4b930c8327872372d8b4
Opcode Fuzzy Hash: 9bb85758233213bc86b3426659878cb4e612d51d4d3cea01ef32de00b74d17fe
Instruction Fuzzy Hash: F82152B4910204ABCB10DFA5DD89ADEBBB8BF58701F104526F542F72A0D7785985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004123D0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,00401386), ref: 00412423
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401386), ref: 00412442
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,000001A8,?,?,?,?,?,?,?,?,?,00401386), ref: 00412461
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401386), ref: 00412470
__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,00401386), ref: 00412485
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401386), ref: 0041249E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004041A0,00000128,?,?,?,?,?,?,?,?,?,00401386), ref: 004124C1
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401386), ref: 004124D0

Strings

Q, xrefs: 00412407, 00412419, 00412429, 00412472, 0041247B, 0041248B

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: Q
API String ID: 1645334062-1716927825
Opcode ID: e064db61b001d9c3036da24ff2051991390c16c19b66dd11350fb0ab37b622cb
Instruction ID: 535cf2b5679d7d5ceffe4b67b4f02bdb376809af38d331cae421fdc8b0949e8e
Opcode Fuzzy Hash: e064db61b001d9c3036da24ff2051991390c16c19b66dd11350fb0ab37b622cb
Instruction Fuzzy Hash: 633184B4A00204AFCB10EFA4DD89EDABBB8FF4C700B50853AF545E3251D77895458AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00412220, Relevance: 15.1, APIs: 10, Instructions: 118COMMON

Download Yara Rule

APIs

#676.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,?,?), ref: 00412287
__vbaFpR8.MSVBVM60 ref: 0041228D
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004122B8
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 004122DC
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 00412301
__vbaCastObj.MSVBVM60(?,004043B8), ref: 00412335
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412340
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000058), ref: 0041235A
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041236A
__vbaFreeObj.MSVBVM60(004123B0), ref: 004123A9

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresultList$#676CastNew2
String ID:
API String ID: 3458320784-0
Opcode ID: d54d98d0e2e98f7a0c39f61a0c96226d50c1ab672ea9dd77c1272b15f67ffbcc
Instruction ID: 3a19d68913eea79b56bd8ae88e743ebcdf3b44198b35e426b79c78dadb6ad3ca
Opcode Fuzzy Hash: d54d98d0e2e98f7a0c39f61a0c96226d50c1ab672ea9dd77c1272b15f67ffbcc
Instruction Fuzzy Hash: 094171B1900209EBDB149F94DE49FEEBBB8FB84700F10412AF905F7290D7785945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00413C70, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(\MSINFO32.EXE,00000000), ref: 00413CC2
__vbaStrMove.MSVBVM60 ref: 00413CCD
__vbaVarDup.MSVBVM60 ref: 00413D03
#595.MSVBVM60(?,00000000,?,?,?), ref: 00413D1A
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 00413D32
__vbaFreeStr.MSVBVM60(00413D69), ref: 00413D62

Strings

System Information Is Unavailable At This Time, xrefs: 00413CF5
\MSINFO32.EXE, xrefs: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#595ListMove
String ID: System Information Is Unavailable At This Time$\MSINFO32.EXE
API String ID: 2404876520-4099109778
Opcode ID: f298c230611545604545321b90f2a25312ed0557e72a8cba3db3a1c53d6d8cc2
Instruction ID: faa8bf12a4014d3607f0c1286e3559d73eafd628007208b04c3358c047979cff
Opcode Fuzzy Hash: f298c230611545604545321b90f2a25312ed0557e72a8cba3db3a1c53d6d8cc2
Instruction Fuzzy Hash: 6F31B5B5D01208AFCB04DFE9D945ADEBBB8EB48B00F10C12AF526AB254DB745609CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004113B0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,00401386), ref: 004113E9
#618.MSVBVM60(?,00000001,?,?,?,?,?,?,00401386), ref: 004113F5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401386), ref: 00411400
__vbaStrCmp.MSVBVM60(00404320,00000000,?,?,?,?,?,?,00401386), ref: 0041140C
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00401386), ref: 0041141F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403DD4,0000015C,?,?,?,?,?,?,00401386), ref: 0041144D
__vbaFreeStr.MSVBVM60(0041146E,?,?,?,?,?,?,00401386), ref: 00411467

Strings

ABC, xrefs: 004113DB

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#618CheckCopyHresultMove
String ID: ABC
API String ID: 592353017-2743272264
Opcode ID: ab51fdb84fbf84488b035a5554e87ed8e26099ad0ec3bd6a9df37a211c2fe1bd
Instruction ID: c4c2ec6f40ce39fa189f647f2ffa39ee11a145c63f6efed255f5662f06014a59
Opcode Fuzzy Hash: ab51fdb84fbf84488b035a5554e87ed8e26099ad0ec3bd6a9df37a211c2fe1bd
Instruction Fuzzy Hash: 90117775940214EBCB04DF64DE49AEEBB78EF54B01F204025FA42B76A0D7741D45CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00411970, Relevance: 13.6, APIs: 9, Instructions: 103COMMON

Download Yara Rule

APIs

#587.MSVBVM60(00000000,3FF00000), ref: 004119BC
__vbaFpR8.MSVBVM60 ref: 004119C2
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 004119EB
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C), ref: 00411A10
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000054), ref: 00411A54
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00411A8B
__vbaFreeObj.MSVBVM60 ref: 00411A94
__vbaFreeVar.MSVBVM60 ref: 00411A9D
__vbaFreeObj.MSVBVM60(00411AD2), ref: 00411ACB

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#587LateNew2
String ID:
API String ID: 4275377098-0
Opcode ID: ea25329eb316f0d7f0d8d1e32534496429405fb39d5f664294fdcb01ce03ee0c
Instruction ID: 1ce4533abab5ed6157935126660fc159fae42bbf20c9738da4e03ebdbc5d03d9
Opcode Fuzzy Hash: ea25329eb316f0d7f0d8d1e32534496429405fb39d5f664294fdcb01ce03ee0c
Instruction Fuzzy Hash: EB412DB0D00209EFCB04DF99D949A9EFBB4FF98740F10816AE605B72A1D7785845CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004112A0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401386), ref: 004112E9
__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411302
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041131B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404190,0000021C,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041133E
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411347
__vbaFreeStr.MSVBVM60(00411376), ref: 0041136F

Strings

Q, xrefs: 004112EF, 004112F8, 00411308

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckCopyHresultNew2
String ID: Q
API String ID: 4138333463-1716927825
Opcode ID: ebf73f19a9771822cc15ee6bb165264df83fa60882cff60083afe88fb3773d28
Instruction ID: 118c9a22c01b691bce92bd915f02fc8ed3c33c19200cf456e2bdbcafcc2ccee4
Opcode Fuzzy Hash: ebf73f19a9771822cc15ee6bb165264df83fa60882cff60083afe88fb3773d28
Instruction Fuzzy Hash: 9F213E74940208EBDB00DF95D989ADEBBB8FF58701F204066E945B7660C7785941CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413440, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041348C
__vbaI4Str.MSVBVM60(00404450), ref: 00413497
#698.MSVBVM60(?,00000000), ref: 004134A2
__vbaVarTstNe.MSVBVM60(?,?), ref: 004134BE
__vbaFreeVar.MSVBVM60 ref: 004134C9
__vbaFreeStr.MSVBVM60(00413501), ref: 004134FA

Strings

*]9K, xrefs: 004134D4

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#698Copy
String ID: *]9K
API String ID: 688608359-1696937991
Opcode ID: 77c712d2181fe7697b14a5060684a1699bccdfe946100fcf49eb1a8fb6432ff2
Instruction ID: 2d8783f9e763ac27534b88abd7bddb67f7de0706c3c6671c66dbea0e57ba8cd9
Opcode Fuzzy Hash: 77c712d2181fe7697b14a5060684a1699bccdfe946100fcf49eb1a8fb6432ff2
Instruction Fuzzy Hash: 0B111CB5C00209ABCB05DFA8D9499DEBFB8FB48B41F10811AF511B3250D7785546CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00412720, Relevance: 12.1, APIs: 8, Instructions: 74COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00412769
__vbaNew2.MSVBVM60(00404344,0041536C,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00412781
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,00000014), ref: 004127A6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004043D0,00000058), ref: 004127CA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004127D9
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004127E2
__vbaFreeStr.MSVBVM60(00412813,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041280B
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00412810

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$CheckHresult$CopyMoveNew2
String ID:
API String ID: 116834155-0
Opcode ID: 9a8d2bb4ad4ffbb85a2f4a251d707e8f12d155b1710e87544c3a5a93fcab9a7b
Instruction ID: 3f4feb879d83823a1360e5326036b5ee39749393054785d2e2d480c4efaf338d
Opcode Fuzzy Hash: 9a8d2bb4ad4ffbb85a2f4a251d707e8f12d155b1710e87544c3a5a93fcab9a7b
Instruction Fuzzy Hash: A2211E74D00619AFCB04DF95DD89AEEBBB8FF98700F10405AE911B72A0D7B85945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411490, Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 004114E8
__vbaVarTstNe.MSVBVM60(?,?), ref: 00411504
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 00411517
__vbaNew2.MSVBVM60(00404344,0041536C), ref: 0041153B
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000004C), ref: 00411560
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404354,0000002C), ref: 004115A0
__vbaFreeObj.MSVBVM60 ref: 004115A9

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#714ListNew2
String ID:
API String ID: 2656420715-0
Opcode ID: b74cc72d61cc255be0ee647de7b0ecf031f954f08a68e8219e965996c6af8563
Instruction ID: 2a51af7c7d0b387313bb96ad1d0f5c82454256bd01755101abb033d656905e10
Opcode Fuzzy Hash: b74cc72d61cc255be0ee647de7b0ecf031f954f08a68e8219e965996c6af8563
Instruction Fuzzy Hash: AE314BB1D00208EFDB14DF99D949ADEBBB8FF88701F10801AEA15BB2A0D7785545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00412840, Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 0041287A
#516.MSVBVM60(004043CC,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00412885
__vbaNew2.MSVBVM60(00404344,0041536C,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004128A3
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000001C,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004128C8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404378,00000064,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004128EE
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 004128F7
__vbaFreeStr.MSVBVM60(00412918,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00412911

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#516CopyNew2
String ID:
API String ID: 742114213-0
Opcode ID: 462949cf21d43cae0d34f7a5b8d91d269cfad9c3860b9c9b5135efc2b696d012
Instruction ID: 5a8ea4ee2b24368718a6a9f71e24feda3f3f430738af5b1e23b60404a7191860
Opcode Fuzzy Hash: 462949cf21d43cae0d34f7a5b8d91d269cfad9c3860b9c9b5135efc2b696d012
Instruction Fuzzy Hash: F12153B0940609EBCB14AF54CD49EEE7BB4FB54701F10412AF951F31A0D7B85591CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004118B0, Relevance: 10.5, APIs: 7, Instructions: 42COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004118ED
#610.MSVBVM60(?), ref: 004118F7
#552.MSVBVM60(?,?,00000001), ref: 00411907
__vbaVarMove.MSVBVM60 ref: 00411913
__vbaFreeVar.MSVBVM60 ref: 0041191C
__vbaFreeVar.MSVBVM60(00411950), ref: 00411940
__vbaFreeStr.MSVBVM60 ref: 00411949

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$Free$#552#610CopyMove
String ID:
API String ID: 2902195431-0
Opcode ID: 8492093543d7960768e302a95f0b735ca40eea73b62144fb51adc3ad8359592e
Instruction ID: 0c67d5ce0ed378589cab732c26a33d517b51bbc603fb7b0b4853cc5baefa30b6
Opcode Fuzzy Hash: 8492093543d7960768e302a95f0b735ca40eea73b62144fb51adc3ad8359592e
Instruction Fuzzy Hash: B6115B71801249EFCF04DFA0DF59ADDBBB8FB18701F10442AE502B6560E7342A05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00412FD0, Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00413019
__vbaNew2.MSVBVM60(00404344,0041536C,?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00413031
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,00000014), ref: 00413056
__vbaHresultCheckObj.MSVBVM60(00000000,?,004043D0,000000B8), ref: 00413080
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00413089
__vbaFreeStr.MSVBVM60(004130B1), ref: 004130AA

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CopyNew2
String ID:
API String ID: 3978771648-0
Opcode ID: 82fb9b7373f5c2fbc07aea42666bff81d6b3bb33b678e5f41bf2e446a5cff979
Instruction ID: 9fb78c28e51db0ae6fab905e44917efe88e93419f653644ce06d588041ede2ff
Opcode Fuzzy Hash: 82fb9b7373f5c2fbc07aea42666bff81d6b3bb33b678e5f41bf2e446a5cff979
Instruction Fuzzy Hash: 96214F70D40609EBCB10DF55C949ADEBFF8EF98701F10805AE501B32A0D7785A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00411B00, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411B50
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411B69
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,000001B0), ref: 00411BAC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401386), ref: 00411BB5

Strings

Q, xrefs: 00411B37, 00411B46, 00411B56

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: Q
API String ID: 1645334062-1716927825
Opcode ID: a1df85cd6c7d7ffee2046c7ec616c8539465c24cb3f9e536c81b6e1263fdd4f2
Instruction ID: dbd6d41214a961a43a47fb50078c9959f11962b77aedfc550ab1c81886ce9290
Opcode Fuzzy Hash: a1df85cd6c7d7ffee2046c7ec616c8539465c24cb3f9e536c81b6e1263fdd4f2
Instruction Fuzzy Hash: 802130B0A00304EBCB10DF99C989BDABFB8FB48700F10856AF545E7661D77899418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00413820, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00403290,Q), ref: 00413863
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041387C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,000001B8), ref: 004138BC
__vbaFreeObj.MSVBVM60 ref: 004138C5

Strings

Q, xrefs: 00413849, 00413859, 00413869

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: Q
API String ID: 1645334062-1716927825
Opcode ID: b576fd17b5c09237ff5e242c64ed0776c1a1faa26eab11292c9dc4ce083e38a7
Instruction ID: 5d6d8650e6b7a037f9e35e79df34468c856f9681f394c5860a35b2deb5be8467
Opcode Fuzzy Hash: b576fd17b5c09237ff5e242c64ed0776c1a1faa26eab11292c9dc4ce083e38a7
Instruction Fuzzy Hash: AA114FB0A00305AFD700EFA9D949BDABBF8FB48701F108529F445E7690D778A545CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004117C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00403290,Q,?,?,?,?,?,?,?,?,?,00401386), ref: 00411813
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401386), ref: 0041182C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404180,000001AC,?,?,?,?,?,?,?,?,?,00401386), ref: 0041184F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401386), ref: 00411858

Strings

Q, xrefs: 004117F7, 00411809, 00411819

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: Q
API String ID: 1645334062-1716927825
Opcode ID: 8dc20714f1c539ee4ba2f893975f3dd069743270b6641255a6d92dc7d297790a
Instruction ID: 155af509ac187d0083c4b33441c04ffd38fb65f64be6fa4d84fa21195a78c033
Opcode Fuzzy Hash: 8dc20714f1c539ee4ba2f893975f3dd069743270b6641255a6d92dc7d297790a
Instruction Fuzzy Hash: 19112174A00604EFCB00EF95C949ADEBFBCFF59700F10856AF541E7261C77895418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413530, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 00413584
#687.MSVBVM60(?,?), ref: 00413592
__vbaDateVar.MSVBVM60(?), ref: 0041359C
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004135AE

Strings

12-12-12, xrefs: 00413576

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$#687DateFreeList
String ID: 12-12-12
API String ID: 3303533072-1358367876
Opcode ID: 5be4a807b6793e4a6ced3cdec4e8aaeccc9c7c277e983cddc922a55a76b0eee6
Instruction ID: b07d99efb9e571d4d5ba646a1b80c66fa342eea3a8c321637ea84011f2a8e5a6
Opcode Fuzzy Hash: 5be4a807b6793e4a6ced3cdec4e8aaeccc9c7c277e983cddc922a55a76b0eee6
Instruction Fuzzy Hash: 5E11FAB5D00208EBCB04DFE9DA49ADDBBB8EB48B00F00C01AF516B6650DB7455058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00412930, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00404344,0041536C), ref: 00412973
__vbaHresultCheckObj.MSVBVM60(00000000,0224EDD4,00404334,0000004C), ref: 00412998
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404354,00000028), ref: 004129B8
__vbaFreeObj.MSVBVM60 ref: 004129C1

Memory Dump Source

Source File: 00000000.00000002.1158294696.000000000040E000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1158276124.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1158280038.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1158309640.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1158313985.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Zahlung_03242021_jpg.jbxd

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 0e486913903a676afce517315fab27bf7a20fd2ee959c96acd57b4bdf2da4507
Instruction ID: e889ed8d8dfed0747529051db8ceeefe13bbd738a4dea7a8a1cbb900ad2d5532
Opcode Fuzzy Hash: 0e486913903a676afce517315fab27bf7a20fd2ee959c96acd57b4bdf2da4507
Instruction Fuzzy Hash: 9B118FB0A41709EFDB009BA9CE4AFDF7BB8FB14700F10402AB951F3290D3B859458B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Zahlung_03242021_jpg.scr

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Zahlung_03242021_jpg.exe PID: 6464 Parent PID: 5996

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Zahlung_03242021_jpg.exe PID: 6464 Parent PID: 5996 Zahlung_03242021_jpg.exeCOMMON

Execution Graph

Graph

Executed Functions

Function 004015B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Control-flow Graph

Non-executed Functions

Function 004015B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMON

Function 00413D90, Relevance: 40.7, APIs: 27, Instructions: 172
COMMON

Function 00411E40, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 256
COMMON

Function 00412510, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 142
COMMON

Function 00413A50, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 138
COMMON

Function 00411C00, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 147
COMMON

Function 00413600, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 138
COMMON

Function 00412A10, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 124
COMMON

Function 00411610, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 115
COMMON

Function 004130E0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 130
COMMON

Function 004132C0, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 92
COMMON

Function 00412D90, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 150
COMMON

Function 00412BC0, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 126
COMMON

Function 00413910, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 78
COMMON

Function 004123D0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87
COMMON