Play interactive tour

Edit tour

Analysis Report Bank details.exe

Overview

General Information

Sample Name:	Bank details.exe
Analysis ID:	379006
MD5:	2b96d5a21ce0c535e5558175f5157bc3
SHA1:	aafbb78f4c8fdba1354636f9a83affc3a55223c0
SHA256:	33a9607ff9672894cd9bf3fd3ba21dde6a220de4601c2da9479a9e059764d35b
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Bank details.exe (PID: 6464 cmdline: 'C:\Users\user\Desktop\Bank details.exe' MD5: 2B96D5A21CE0C535E5558175F5157BC3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Bank details.exe PID: 6464	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Bank details.exe PID: 6464	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Bank details.exe	Virustotal: Detection: 44%			Perma Link
Source: Bank details.exe	ReversingLabs: Detection: 48%

Source: Bank details.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Bank details.exe, 00000000.00000002.842516311.00000000007EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\Bank details.exe

Process Stats: CPU usage > 98%

Source: Bank details.exe, 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameResiccate2.exe vs Bank details.exe
Source: Bank details.exe	Binary or memory string: OriginalFilenameResiccate2.exe vs Bank details.exe

Source: Bank details.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Bank details.exe

File created: C:\Users\user\AppData\Local\Temp\~DF555C1DFBC45B413E.TMP

Jump to behavior

Source: Bank details.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Bank details.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Bank details.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Bank details.exe	Virustotal: Detection: 44%
Source: Bank details.exe	ReversingLabs: Detection: 48%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: Bank details.exe PID: 6464, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: Bank details.exe PID: 6464, type: MEMORY

Source: C:\Users\user\Desktop\Bank details.exe

Code function: 0_2_00405D0F push ebx; iretd

0_2_00405D10

Source: C:\Users\user\Desktop\Bank details.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Bank details.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Bank details.exe, 00000000.00000002.842296160.00000000006D0000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Bank details.exe

RDTSC instruction interceptor: First address: 00000000006DB137 second address: 00000000006DB137 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FD140376671h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dx, dx 0x00000020 jmp 00007FD140376666h 0x00000022 cmp bh, dh 0x00000024 test al, al 0x00000026 add edi, edx 0x00000028 cmp edx, ebx 0x0000002a dec dword ptr [ebp+000000F8h] 0x00000030 cmp ebx, ecx 0x00000032 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000039 jne 00007FD1403765D9h 0x0000003b cmp bh, bh 0x0000003d call 00007FD1403766D7h 0x00000042 call 00007FD140376681h 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Bank details.exe, 00000000.00000002.842296160.00000000006D0000.00000040.00000001.sdmp

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Bank details.exe

Process Stats: CPU usage > 90% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Bank details.exe, 00000000.00000002.842577944.0000000000E70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Bank details.exe, 00000000.00000002.842577944.0000000000E70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Bank details.exe, 00000000.00000002.842577944.0000000000E70000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: Bank details.exe, 00000000.00000002.842577944.0000000000E70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery31	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Bank details.exe	45%	Virustotal		Browse
Bank details.exe	48%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	379006
Start date:	31.03.2021
Start time:	12:54:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Bank details.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.7% (good quality ratio 56.7%) Quality average: 39.2% Quality standard deviation: 36%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.702089907294954
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Bank details.exe
File size:	131072
MD5:	2b96d5a21ce0c535e5558175f5157bc3
SHA1:	aafbb78f4c8fdba1354636f9a83affc3a55223c0
SHA256:	33a9607ff9672894cd9bf3fd3ba21dde6a220de4601c2da9479a9e059764d35b
SHA512:	b14039e3e039b1df7cfc109b2d8ef7c0850e9e307321ac5d40bbb7c565f92994dca27632995f4333f78830a91a21784c5ff402bc15885d69a1d3c61acbb1f808
SSDEEP:	1536:GLLlVJNiYwvn8qE4FnN8t/FAwBDffPz4gQkCt:GLLlZoU4FnN8dFAQX745kC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L...;.WN.....................`....................@................

File Icon


Icon Hash:	d230f0e47064cc00

Static PE Info

General
Entrypoint:	0x4013d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4E570E3B [Fri Aug 26 03:08:43 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	399e3e9a5cc2cd2a186a8a2e044492e1

Entrypoint Preview

Instruction
push 00414A2Ch
call 00007FD140772F73h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
stosd
popad
sbb ebp, ebx
sbb dword ptr [ebx], esp
dec esi
lea ecx, dword ptr [eax+77C97133h]
jne 00007FD140772FD5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push eax
dec edi
dec esp
inc ecx
push edx
dec ecx
push ebx
inc ebp
push edx
dec ecx
dec esi
inc edi
push ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
adc al, 73h
mov bl, 17h
out 69h, al
or esi, esi
dec edi
mov ds, word ptr [ecx-07h]
fld1
pop eax
loop 00007FD140772FCAh
xchg eax, ebp
adc dword ptr [57EA1D52h], 4Ah
stosd
and dword ptr [edi], edi
fiadd dword ptr [ebx+34h]
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [32620001h], dh
add dword ptr [eax], eax
add byte ptr [eax], cl
add byte ptr [esi+61h], dl
outsb
add byte ptr fs:[72000701h], cl
outsd
jns 00007FD140772FE3h
insb
insb

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a494	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0x3ebc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x128	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19954	0x1a000	False	0.307626577524	data	5.04046635888	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1930	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1d000	0x3ebc	0x4000	False	0.292724609375	data	3.31942687693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1e814	0x26a8	data
RT_ICON	0x1db6c	0xca8	data
RT_ICON	0x1d424	0x748	data
RT_GROUP_ICON	0x1d3f4	0x30	data
RT_VERSION	0x1d150	0x2a4	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Resiccate2
FileVersion	9.04.0012
CompanyName	Jelly MUX, Inc.
Comments	Jelly MUX
ProductName	Jelly MUX
ProductVersion	9.04.0012
FileDescription	Jelly MUX
OriginalFilename	Resiccate2.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Bank details.exe PID: 6464 Parent PID: 5996

General

Start time:	12:55:23
Start date:	31/03/2021
Path:	C:\Users\user\Desktop\Bank details.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Bank details.exe'
Imagebase:	0x400000
File size:	131072 bytes
MD5 hash:	2B96D5A21CE0C535E5558175F5157BC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Bank details.exe PID: 6464 Parent PID: 5996 Bank details.exeCOMMON

Executed Functions

Function 004013D8, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399
COMMON

Download Yara Rule

C-Code - Quality: 81%

			_entry_(signed int __eax, signed int __ebx, intOrPtr* __edx, signed int __edi, void* __esi) {
				signed int _t23;
				signed int _t24;
				void* _t26;
				void* _t27;
				intOrPtr* _t33;
				intOrPtr* _t37;
				void* _t41;
				signed int* _t43;
				signed int* _t44;
				void* _t45;
				signed int _t46;
				intOrPtr _t54;

				_t38 = __edi;
				_t37 = __edx;
				_t29 = __ebx;
				_push("VB5!6&*"); // executed
				L004013D0(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t23 = __eax + 1;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + __edx;
				asm("stosd");
				asm("popad");
				asm("sbb ebp, ebx");
				asm("sbb [ebx], esp");
				_t43 = __esi - 1;
				_t1 = _t23 + 0x77c97133; // 0x77c97134
				_t33 = _t1;
				if(_t43 == 0) {
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					_push(_t23);
					_push(__edx);
					_push(__ebx);
					_t46 = _t45 + 1;
					_push(__edx);
					_t33 = _t33 + 1;
					_t44 = _t43 - 1;
					_t41 = __edi - 1 + 1;
					_push(__ebx);
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 ^ _t23;
					asm("adc al, 0x73");
					asm("out 0x69, al");
					_t43 = _t44;
					_t38 = _t41 - 1;
					ds =  *((intOrPtr*)(_t33 - 7));
					asm("fld1");
					_pop(_t27);
					asm("loop 0x4a");
					_t45 = _t27;
					asm("adc dword [0x57ea1d52], 0x4a");
					asm("stosd");
					 *_t38 =  *_t38 & _t38;
					asm("fiadd dword [ds:ebx+0x34]");
					_t29 = 0x00000017 ^  *(_t33 - 0x48ee309a);
					_t23 = _t46;
				}
				 *((intOrPtr*)(_t37 - 0x6c2ca000)) =  *((intOrPtr*)(_t37 - 0x6c2ca000)) + _t33;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t23;
				 *0x32620001 = _t37;
				 *_t23 =  *_t23 + _t23;
				 *_t23 =  *_t23 + _t33;
				_t43[0x18] = _t43[0x18] + _t37;
				asm("gs outsb");
				 *[ss:0x72000701] =  *[ss:0x72000701] + _t33;
				_t54 =  *[ss:0x72000701];
				asm("outsd");
				if(_t54 < 0) {
					asm("insb");
					asm("insb");
					if (_t54 >= 0) goto L5;
					asm("sbb [ecx], eax");
					 *_t37 =  *_t37 + _t23;
					 *_t43 =  *_t43 & _t38;
					 *_t43 =  *_t43 + _t37;
					 *_t43 =  *_t43 + _t37;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t33;
					 *_t23 =  *_t23 + _t23;
					 *((intOrPtr*)(_t23 + 0x4c000001)) =  *((intOrPtr*)(_t23 + 0x4c000001)) + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t33 =  *_t33 + _t23;
					 *_t23 =  *_t23 + _t37;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t33;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *_t23 =  *_t23 + _t23;
					 *0xf00500f0 =  *0xf00500f0 + _t23;
					 *0xf00500f0 =  *0xf00500f0 + _t23;
					 *0xf00500f0 =  *0xf00500f0 + _t23;
					 *0xf00500f0 =  *0xf00500f0 + _t23;
				}
				_t24 = _t23 + 0xf00500f0;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xf00500f0 =  *0xf00500f0 + _t24;
				 *0xb33300f0 =  *0xb33300f0 + _t24;
				_push(es);
				asm("jecxz 0xffffffdc");
				if( *0xb33300f0 >= 0) {
					 *0x39050039 =  *0x39050039 + _t24;
					 *0x39050039 =  *0x39050039 + _t24;
					 *0x39050039 =  *0x39050039 + _t24;
					 *0x39050039 =  *0x39050039 + _t24;
					 *0x39050039 =  *0x39050039 + _t24;
					 *0x39050039 =  *0x39050039 + _t24;
					do {
						_t26 = _t24 + 0x39050039;
						 *0x39050039 =  *0x39050039 + _t26;
						 *0x39050039 =  *0x39050039 + _t26;
						 *0x39050039 =  *0x39050039 + _t26;
						 *0x39050039 =  *0x39050039 + _t26;
						 *((intOrPtr*)(_t38 + 0x34)) =  *((intOrPtr*)(_t38 + 0x34)) + _t26;
						asm("into");
						_t24 = _t26 - 0x93;
					} while (_t24 >= 0);
				}
				asm("out dx, al");
				asm("adc bh, al");
				asm("adc al, 0xd6");
				asm("sbb al, 0x56");
				asm("cmpsd");
				asm("cld");
				_pop(ss);
				if(_t29 - 1 > 0) {
					_t24 = _t38;
				}
				_push(0x3a70981f);
				asm("in al, 0x33");
				asm("ror dword [esi-0x69f6d09b], cl");
				_push(_t45);
				asm("into");
				asm("outsd");
				return _t24 ^ 0x546173fb;
			}

0x004013d8
0x004013d8
0x004013d8
0x004013d8
0x004013dd
0x004013e2
0x004013e4
0x004013e6
0x004013e8
0x004013ea
0x004013ec
0x004013ed
0x004013ef
0x004013f1
0x004013f3
0x004013f5
0x004013f6
0x004013f7
0x004013f9
0x004013fb
0x004013fc
0x004013fc
0x00401402
0x00401404
0x00401406
0x00401408
0x0040140a
0x0040140c
0x0040140e
0x00401410
0x00401412
0x00401414
0x00401418
0x0040141a
0x0040141b
0x0040141c
0x0040141d
0x0040141e
0x0040141f
0x00401420
0x00401421
0x00401423
0x00401425
0x0040142a
0x0040142c
0x00401430
0x00401432
0x00401434
0x00401435
0x00401438
0x0040143a
0x0040143b
0x0040143d
0x0040143e
0x00401445
0x00401446
0x00401448
0x00401450
0x00401456
0x00401456
0x00401457
0x0040145d
0x0040145f
0x00401461
0x00401463
0x00401465
0x00401467
0x00401469
0x0040146b
0x0040146d
0x0040146f
0x00401471
0x00401473
0x00401475
0x00401477
0x00401479
0x0040147b
0x0040147d
0x0040147f
0x00401481
0x00401487
0x00401489
0x0040148b
0x0040148e
0x00401491
0x00401491
0x0040149a
0x0040149b
0x0040149d
0x0040149e
0x0040149f
0x004014a1
0x004014a3
0x004014a6
0x004014ae
0x004014bc
0x004014be
0x004014c0
0x004014c2
0x004014c4
0x004014ca
0x004014cc
0x004014ce
0x004014d0
0x004014d2
0x004014d4
0x004014dc
0x004014de
0x004014e0
0x004014e2
0x004014e4
0x004014e6
0x004014e8
0x004014ee
0x004014f4
0x004014fa
0x004014fa
0x004014fe
0x00401503
0x00401509
0x0040150f
0x00401515
0x0040151b
0x00401521
0x00401527
0x0040152d
0x00401533
0x00401539
0x0040153f
0x00401545
0x0040154b
0x00401551
0x00401557
0x0040155d
0x00401563
0x00401569
0x0040156f
0x00401575
0x0040157b
0x00401581
0x00401587
0x0040158d
0x00401593
0x00401599
0x0040159f
0x004015a5
0x004015ab
0x004015b1
0x004015b7
0x004015bd
0x004015c3
0x004015c9
0x004015cf
0x004015d5
0x004015db
0x004015e1
0x004015e7
0x004015ed
0x004015f3
0x004015f9
0x004015ff
0x00401605
0x0040160b
0x00401611
0x00401617
0x0040161d
0x00401623
0x00401629
0x0040162f
0x00401635
0x0040163b
0x00401641
0x00401647
0x0040164d
0x00401653
0x00401659
0x0040165f
0x00401665
0x0040166b
0x00401671
0x00401677
0x0040167d
0x00401683
0x00401689
0x0040168f
0x00401695
0x0040169b
0x004016a1
0x004016a7
0x004016ad
0x004016b3
0x004016b9
0x004016bf
0x004016c5
0x004016cb
0x004016d1
0x004016d7
0x004016dd
0x004016e3
0x004016e9
0x004016ef
0x004016f5
0x004016fb
0x00401701
0x00401707
0x0040170d
0x00401713
0x00401719
0x0040171f
0x00401725
0x0040172b
0x00401731
0x00401737
0x0040173d
0x00401743
0x00401749
0x0040174f
0x00401755
0x0040175b
0x00401761
0x00401767
0x0040176d
0x00401773
0x00401779
0x0040177f
0x00401785
0x0040178b
0x00401791
0x00401797
0x0040179d
0x004017a3
0x004017a9
0x004017aa
0x004017ac
0x004017ae
0x004017b4
0x004017ba
0x004017c0
0x004017c6
0x004017cc
0x004017ce
0x004017d0
0x004017d5
0x004017db
0x004017e1
0x004017e7
0x004017ed
0x004017f0
0x004017f1
0x004017f1
0x004017ce
0x004017f6
0x004017f7
0x004017fe
0x00401800
0x00401802
0x00401803
0x00401804
0x00401805
0x00401807
0x00401807
0x00401808
0x00401809
0x0040180b
0x00401816
0x00401817
0x00401818
0x00401819

APIs

#100.MSVBVM60(VB5!6&*), ref: 004013DD

Strings

VB5!6&*, xrefs: 004013D8

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 1c61498a54c1451e7e9d484a2f1860c507cc87632a0cf611b407de95d5b37152
Instruction ID: 74316fa7b9a1750fbb2776b566e1303037603431160469116a66be85efc6f724
Opcode Fuzzy Hash: 1c61498a54c1451e7e9d484a2f1860c507cc87632a0cf611b407de95d5b37152
Instruction Fuzzy Hash: AA510FA158E7C28FD3139BB09C65692BF71AE23214B0E15EBC4C0DB4F3D25C184AD7A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00419E90, Relevance: 79.2, APIs: 43, Strings: 2, Instructions: 414COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00419EEE
__vbaHresultCheckObj.MSVBVM60(00000000,00401208,00415508,000000B0), ref: 00419F13
__vbaNew2.MSVBVM60(00415A8C,0041B3C8), ref: 00419F3F
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 00419F5E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419F7D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158FC,00000218), ref: 00419FA0
__vbaCastObj.MSVBVM60(?,00415B98,?), ref: 00419FB5
__vbaObjSet.MSVBVM60(?,00000000), ref: 00419FC0
__vbaHresultCheckObj.MSVBVM60(00000000,02CDEF24,00415A7C,00000040), ref: 00419FD6
__vbaFreeStr.MSVBVM60 ref: 00419FDF
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00419FEF
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041A015
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A02E
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041A045
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A05E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415884,00000108), ref: 0041A081
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001EC), ref: 0041A0C6
__vbaFreeStr.MSVBVM60 ref: 0041A0CF
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041A0DF
__vbaStrCopy.MSVBVM60 ref: 0041A0F0
#712.MSVBVM60(?,00415BB8,00000000,00000001,000000FF,00000000), ref: 0041A107
__vbaStrMove.MSVBVM60 ref: 0041A112
__vbaStrCmp.MSVBVM60(00415BC0,?), ref: 0041A121
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041A142
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A15B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,00000160), ref: 0041A17E
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041A190
_adj_fdiv_m64.MSVBVM60 ref: 0041A1B9
__vbaFpI4.MSVBVM60(43080000,?,43560000), ref: 0041A1F0
__vbaI4Var.MSVBVM60(?,4A82629E,430D0000,00000000,?,43560000), ref: 0041A205
__vbaHresultCheckObj.MSVBVM60(00000000,00401208,00415508,000002C0,?,43560000), ref: 0041A242
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,43560000), ref: 0041A252
__vbaFreeVar.MSVBVM60 ref: 0041A25E
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041A277
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A290
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415884,00000198), ref: 0041A2B3
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041A2CC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A2E5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,000001B4), ref: 0041A380
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041A390
__vbaFreeStr.MSVBVM60(0041A3E8), ref: 0041A3D7
__vbaFreeObj.MSVBVM60 ref: 0041A3DC
__vbaFreeStr.MSVBVM60 ref: 0041A3E5

Strings

cer, xrefs: 0041A0E8
mW, xrefs: 0041A399

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$List$Copy$#712CallCastLateMove_adj_fdiv_m64
String ID: cer$mW
API String ID: 3423631630-3042866172
Opcode ID: d4f9ec49fb8aa505fe14109dc91dda90c18ca719fc28587517ddc11f507d8244
Instruction ID: 44b4b10f65e745809dde828d549892ebd7d46f7aa18064e5ef4480b1d3c9e74f
Opcode Fuzzy Hash: d4f9ec49fb8aa505fe14109dc91dda90c18ca719fc28587517ddc11f507d8244
Instruction Fuzzy Hash: 9EF13D70A00214EFDB14DFA4DD88FEE7BB8FF48700F10816AF545A72A1D77499858B99

Uniqueness

Uniqueness Score: -1.00%

Function 00418670, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 224COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004186C2
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 004186DB
__vbaObjSet.MSVBVM60(?,00000000), ref: 004186FA
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041871F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418738
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004159F0,00000048), ref: 00418755
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001EC), ref: 00418796
__vbaFreeStr.MSVBVM60 ref: 004187A5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004187B1
#610.MSVBVM60(?), ref: 004187BE
#557.MSVBVM60(?), ref: 004187C8
__vbaFreeVar.MSVBVM60 ref: 004187DF
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 004187FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418816
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,00000050), ref: 00418833
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000072,?), ref: 00418843
__vbaFreeStr.MSVBVM60 ref: 0041884C
__vbaFreeObj.MSVBVM60 ref: 00418851
__vbaVarDup.MSVBVM60 ref: 0041886B
#645.MSVBVM60(?,00000000), ref: 00418877
__vbaStrMove.MSVBVM60 ref: 00418882
__vbaFreeVar.MSVBVM60 ref: 0041888B
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 004188A4
__vbaObjSet.MSVBVM60(?,00000000), ref: 004188BD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001EC), ref: 00418907
__vbaFreeObj.MSVBVM60 ref: 00418910
__vbaFreeStr.MSVBVM60(00418954), ref: 0041894C
__vbaFreeStr.MSVBVM60 ref: 00418951

Strings

Subtheme9, xrefs: 0041885D
Homodynamic, xrefs: 004188E0

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#557#610#645CopyFileListMoveOpen
String ID: Homodynamic$Subtheme9
API String ID: 1654649428-3231425174
Opcode ID: 4e7274edd163bd5a5fa0be3851c49afa64bd8b46fd4f920c3965dd19df3ab33f
Instruction ID: a7594f906f8e94400ce9546c29ff38c02a9f434d18d5f4be7f5e7d51a108639e
Opcode Fuzzy Hash: 4e7274edd163bd5a5fa0be3851c49afa64bd8b46fd4f920c3965dd19df3ab33f
Instruction Fuzzy Hash: E8910D75A00209AFCB14DFA4DD89ADEBBB8FF4C700F108529F545E72A0DB74A945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00418F80, Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00418FE1
__vbaStrCopy.MSVBVM60 ref: 00418FEB
#515.MSVBVM60(?,?,00000002), ref: 00419004
__vbaVarTstNe.MSVBVM60(?,?), ref: 00419020
__vbaFreeVar.MSVBVM60 ref: 0041902C
__vbaVarDup.MSVBVM60 ref: 0041904F
#667.MSVBVM60(?), ref: 00419059
__vbaStrMove.MSVBVM60 ref: 00419064
__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 0041906C
__vbaFreeStr.MSVBVM60 ref: 0041907E
__vbaFreeVar.MSVBVM60 ref: 00419087
__vbaFpI4.MSVBVM60 ref: 0041909A
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,00415508,00000064), ref: 004190BA
#648.MSVBVM60(?), ref: 004190D6
__vbaFreeVar.MSVBVM60 ref: 004190DF
__vbaNew2.MSVBVM60(00415A8C,0041B3C8), ref: 004190F7
__vbaHresultCheckObj.MSVBVM60(00000000,02CDEF24,00415A7C,00000014), ref: 0041911C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415A9C,000000E0), ref: 00419142
__vbaStrMove.MSVBVM60 ref: 0041914D
__vbaFreeObj.MSVBVM60 ref: 00419156
__vbaFreeStr.MSVBVM60(004191A7), ref: 0041919A
__vbaFreeStr.MSVBVM60 ref: 0041919F
__vbaFreeStr.MSVBVM60 ref: 004191A4

Strings

tmp, xrefs: 00419041
ABC, xrefs: 00418FE3

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$CopyMove$#515#648#667New2
String ID: ABC$tmp
API String ID: 262650768-3727537278
Opcode ID: 85c405048e4e29ea6dfb1fd5ce9d1688ccf078d060541b8d5d9fb544a4ec3983
Instruction ID: 54597fe4e63870bcabf7e9b1fc77b81b01bbb6f33fde6a87fd986c046d0cadb3
Opcode Fuzzy Hash: 85c405048e4e29ea6dfb1fd5ce9d1688ccf078d060541b8d5d9fb544a4ec3983
Instruction Fuzzy Hash: 3A513A70D00259EBCB00DFA4DD88AEEBBB9FF58705F10811AE546B72A0D7745986CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00418130, Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00418185
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041819E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004181BD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,00000208), ref: 004181DC
__vbaFreeObj.MSVBVM60 ref: 004181E5
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 004181FE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418217
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415994,000000C4), ref: 00418236
__vbaFreeObj.MSVBVM60 ref: 0041823F
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 00418258
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418271
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,000001B8), ref: 004182AD
__vbaFreeObj.MSVBVM60 ref: 004182BC
#575.MSVBVM60(?,?), ref: 004182D4
__vbaVarTstNe.MSVBVM60(?,?), ref: 004182F0
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00418303
#531.MSVBVM60(POLERS), ref: 00418316
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041832F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418348
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,00000128), ref: 0041836B
__vbaFreeObj.MSVBVM60 ref: 0041837A
__vbaFreeStr.MSVBVM60(004183AE), ref: 004183A7

Strings

POLERS, xrefs: 00418311

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#531#575CopyList
String ID: POLERS
API String ID: 2609946365-3130257914
Opcode ID: 546eed2bf817f4485b26accf07b74971a5ec5bc6252b01f03dae52e707a72e0f
Instruction ID: 8f1e50b946bb721af3719f7cc7bb466abd4ade00a091c7371581e29436c2db05
Opcode Fuzzy Hash: 546eed2bf817f4485b26accf07b74971a5ec5bc6252b01f03dae52e707a72e0f
Instruction Fuzzy Hash: D1711B75A00218AFCB14DFA4DD88EDEBBB8FF48700F10452AE545E72A1DB789945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183E0, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 0041843F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041845E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,000001B8), ref: 004184A3
__vbaFreeObj.MSVBVM60 ref: 004184B2
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 004184C7
__vbaObjSet.MSVBVM60(?,00000000), ref: 004184E0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,000001BC), ref: 004184FF
__vbaFreeObj.MSVBVM60 ref: 00418508
__vbaVarDup.MSVBVM60 ref: 0041851E
#518.MSVBVM60(?,?), ref: 0041852C
__vbaVarTstNe.MSVBVM60(?,?), ref: 00418548
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041855B
__vbaNew2.MSVBVM60(00415EA4,0041B010), ref: 00418580
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418599
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158B4,00000110), ref: 004185BC
#600.MSVBVM60(?,00000002), ref: 004185DC
__vbaFreeObj.MSVBVM60 ref: 004185E7
__vbaFreeVar.MSVBVM60 ref: 004185EC
__vbaInStr.MSVBVM60(00000000,004159D8,ABC,00000002), ref: 00418600
#531.MSVBVM60(Tomtate), ref: 00418610

Strings

Tomtate, xrefs: 0041860B
ABC, xrefs: 004185F4

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#518#531#600List
String ID: ABC$Tomtate
API String ID: 2507251013-3899952926
Opcode ID: 135ba16a419526f01e470f8f693b7d5d129e78ed70cc6d79007863ae037df589
Instruction ID: f8f7296d4a93a24f88be40f5a3bdc0a19bd6cfc53838f85d494e1b6e0d710fc8
Opcode Fuzzy Hash: 135ba16a419526f01e470f8f693b7d5d129e78ed70cc6d79007863ae037df589
Instruction Fuzzy Hash: 35613E74A01309EFDB00DFA4C949ADE7BB8FF48704F10852AF445EB261DB749944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00419700, Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419744
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419763
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001F8), ref: 00419782
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 0041978B
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004197A4
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004197BD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415884,000001D0), ref: 00419802
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 0041980F
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419828
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419841
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415884,000001C0), ref: 00419860
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419865
#690.MSVBVM60(Tvrpolitisk,MEDIATIONAL,Hobblingly,Fondsbrsers7), ref: 0041987F
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00419898
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004198B1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158C4,00000068), ref: 004198CE
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004198D9

Strings

Fondsbrsers7, xrefs: 0041986B
Tvrpolitisk, xrefs: 0041987A
Hobblingly, xrefs: 00419870
MEDIATIONAL, xrefs: 00419875

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2$#690
String ID: Fondsbrsers7$Hobblingly$MEDIATIONAL$Tvrpolitisk
API String ID: 3927151119-644221730
Opcode ID: 0ff59eccff4211b1e00f19ce045bbb65236afc0c1e66566e1d393059b872a712
Instruction ID: dca3020d47a88af3c169ff60342f23d8b1cc6d5e71306d186183640037a00386
Opcode Fuzzy Hash: 0ff59eccff4211b1e00f19ce045bbb65236afc0c1e66566e1d393059b872a712
Instruction Fuzzy Hash: 69514E74A40205AFC714EF64CD89FEA7BB8EF4C704F10853AF545EB2A1D77498858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00418980, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004189C4
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004189E3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158FC,000001EC), ref: 00418A2D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00418A36
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00418A4F
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00418A68
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001EC), ref: 00418AA9
__vbaFreeObj.MSVBVM60 ref: 00418AB2
#707.MSVBVM60(00000001,00000000), ref: 00418ABC
__vbaStrMove.MSVBVM60 ref: 00418AC7
__vbaFreeStr.MSVBVM60(00418AE9), ref: 00418AE2

Strings

Supersocial, xrefs: 00418A7B
BANEMRKERNE, xrefs: 004189FE

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#707Move
String ID: BANEMRKERNE$Supersocial
API String ID: 1972278932-480040196
Opcode ID: 5061c4a6e03b8d240ab3bf451388908da5cd579a279f6003e5946c085045b228
Instruction ID: f28d0b8cc1abdfca0d4aa7a9e3a6ee8ef083f01aed684050751739332772877d
Opcode Fuzzy Hash: 5061c4a6e03b8d240ab3bf451388908da5cd579a279f6003e5946c085045b228
Instruction Fuzzy Hash: 75413D70A40305ABC704DF68D989BDABBB8FF5C701F10852AF505E73A1DB749981CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419910, Relevance: 21.1, APIs: 14, Instructions: 134COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,00401226), ref: 0041995D
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401226), ref: 0041997C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158B4,000001A8,?,?,?,?,?,?,?,?,00401226), ref: 0041999B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401226), ref: 004199A4
__vbaI2Str.MSVBVM60(00415B88,?,?,?,?,?,?,?,?,00401226), ref: 004199AF
__vbaHresultCheckObj.MSVBVM60(00000000,004011C8,00415508,00000084,?,?,?,?,?,?,?,?,?,00401226), ref: 004199F0
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,00401226), ref: 00419A09
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401226), ref: 00419A22
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00415884,000001C4,?,?,?,?,?,?,?,?,00401226), ref: 00419A41
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401226), ref: 00419A50
__vbaNew2.MSVBVM60(00415EA4,0041B010,?,?,?,?,?,?,?,?,00401226), ref: 00419A65
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401226), ref: 00419A7E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004158A4,000001E8,?,?,?,?,?,?,?,?,00401226), ref: 00419A9D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401226), ref: 00419AA6

Memory Dump Source

Source File: 00000000.00000002.841642286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.841634630.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.841671988.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.841678988.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 4bdca61ce4b8883890909cc1c8acde0094b6e377df39caea16068079a912bf75
Instruction ID: dad535d9dac9a900255cbbcbedb52b05b87d2f27e34136b11c10d0e481da62c0
Opcode Fuzzy Hash: 4bdca61ce4b8883890909cc1c8acde0094b6e377df39caea16068079a912bf75
Instruction Fuzzy Hash: 5F417D74640245AFC7109F64CD89FEA7BBCFF48B41F10453AF585E72A0D77898858BA8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Bank details.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Bank details.exe PID: 6464 Parent PID: 5996

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Bank details.exe PID: 6464 Parent PID: 5996 Bank details.exeCOMMON

Executed Functions

Function 004013D8, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399COMMON

Non-executed Functions

Function 00419E90, Relevance: 79.2, APIs: 43, Strings: 2, Instructions: 414COMMON

Function 00418670, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 224COMMON

Function 004013D8, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399
COMMON