Play interactive tour

Edit tour

Analysis Report qhw7KZSA53.exe

Overview

General Information

Sample Name:	qhw7KZSA53.exe
Analysis ID:	396529
MD5:	4b7687321980c96093c8e6a43b764728
SHA1:	5e27cc0eddb8646e26b72a7ff4f608df45c0eb8a
SHA256:	3a51813adeabd17d4939280137288152b2a3f25f7bf9e738c8f25df5ef49be31
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Potential time zone aware malware

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

qhw7KZSA53.exe (PID: 5380 cmdline: 'C:\Users\user\Desktop\qhw7KZSA53.exe' MD5: 4B7687321980C96093C8E6A43B764728)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: qhw7KZSA53.exe PID: 5380	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: qhw7KZSA53.exe PID: 5380	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: qhw7KZSA53.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: qhw7KZSA53.exe	Virustotal: Detection: 24%			Perma Link
Source: qhw7KZSA53.exe	ReversingLabs: Detection: 23%

Machine Learning detection for sample

Show sources

Source: qhw7KZSA53.exe

Joe Sandbox ML: detected

Source: qhw7KZSA53.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: qhw7KZSA53.exe, 00000001.00000002.740127231.00000000006EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Process Stats: CPU usage > 98%

Source: qhw7KZSA53.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: qhw7KZSA53.exe, 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIntuitioners4.exe vs qhw7KZSA53.exe
Source: qhw7KZSA53.exe, 00000001.00000002.740662074.00000000020C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs qhw7KZSA53.exe
Source: qhw7KZSA53.exe	Binary or memory string: OriginalFilenameIntuitioners4.exe vs qhw7KZSA53.exe

Source: qhw7KZSA53.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@1/0@0/0

Source: qhw7KZSA53.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qhw7KZSA53.exe	Virustotal: Detection: 24%
Source: qhw7KZSA53.exe	ReversingLabs: Detection: 23%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: qhw7KZSA53.exe PID: 5380, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: qhw7KZSA53.exe PID: 5380, type: MEMORY

Source: qhw7KZSA53.exe

Static PE information: real checksum: 0x22441 should be: 0x1f32c

Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_00405E52 push ebx; ret	1_2_00405E77
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_004042D6 push ecx; iretd	1_2_00404423
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_00402B60 push edi; retf	1_2_00402B64
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_00406909 pushfd ; iretd	1_2_0040690F
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_0040430F push ecx; iretd	1_2_00404423
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A664EE push eax; ret	1_2_02A664EF
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A61CCE pushfd ; iretd	1_2_02A61CCF
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A61CDD pushfd ; iretd	1_2_02A61CF6

Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A65981 second address: 0000000002A65981 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov ebx, edx 0x0000000c shl edx, 05h 0x0000000f add edx, ebx 0x00000011 movzx ebx, byte ptr [esi] 0x00000014 jmp 00007FE2343B27FAh 0x00000016 cmp ah, FFFFFF9Ch 0x00000019 add edx, ebx 0x0000001b xor edx, 34C63380h 0x00000021 test ah, dh 0x00000023 add esi, 02h 0x00000026 cmp word ptr [esi], 0000h 0x0000002a jne 00007FE2343B279Dh 0x0000002c pushad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A6593A second address: 0000000002A6593A instructions:

Potential time zone aware malware

Show sources

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: qhw7KZSA53.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A65981 second address: 0000000002A65981 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov ebx, edx 0x0000000c shl edx, 05h 0x0000000f add edx, ebx 0x00000011 movzx ebx, byte ptr [esi] 0x00000014 jmp 00007FE2343B27FAh 0x00000016 cmp ah, FFFFFF9Ch 0x00000019 add edx, ebx 0x0000001b xor edx, 34C63380h 0x00000021 test ah, dh 0x00000023 add esi, 02h 0x00000026 cmp word ptr [esi], 0000h 0x0000002a jne 00007FE2343B279Dh 0x0000002c pushad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A6593A second address: 0000000002A6593A instructions:
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A65BF8 second address: 0000000002A65BB5 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE2343B2805h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bx, dx 0x00000020 add edi, edx 0x00000022 pushad 0x00000023 mov ecx, 00000072h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	RDTSC instruction interceptor: First address: 0000000002A65BB5 second address: 0000000002A65BF8 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 dec dword ptr [ebp+000000F8h] 0x00000009 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000010 jne 00007FE234EF328Eh 0x00000012 test ah, dh 0x00000014 call 00007FE234EF32FBh 0x00000019 call 00007FE234EF32E5h 0x0000001e lfence 0x00000021 mov edx, dword ptr [7FFE0014h] 0x00000027 lfence 0x0000002a ret 0x0000002b mov esi, edx 0x0000002d pushad 0x0000002e rdtsc

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Code function: 1_2_02A65695 rdtsc

1_2_02A65695

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: qhw7KZSA53.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\qhw7KZSA53.exe

Code function: 1_2_02A65695 rdtsc

1_2_02A65695

Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A632A5 mov eax, dword ptr fs:[00000030h]	1_2_02A632A5
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A632A2 mov eax, dword ptr fs:[00000030h]	1_2_02A632A2
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A61B93 mov eax, dword ptr fs:[00000030h]	1_2_02A61B93
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A6249B mov eax, dword ptr fs:[00000030h]	1_2_02A6249B
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A658C4 mov eax, dword ptr fs:[00000030h]	1_2_02A658C4
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A62463 mov eax, dword ptr fs:[00000030h]	1_2_02A62463
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A62460 mov eax, dword ptr fs:[00000030h]	1_2_02A62460
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A6218F mov eax, dword ptr fs:[00000030h]	1_2_02A6218F
Source: C:\Users\user\Desktop\qhw7KZSA53.exe	Code function: 1_2_02A65169 mov eax, dword ptr fs:[00000030h]	1_2_02A65169

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: qhw7KZSA53.exe, 00000001.00000002.740293607.0000000000C70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: qhw7KZSA53.exe, 00000001.00000002.740293607.0000000000C70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: qhw7KZSA53.exe, 00000001.00000002.740293607.0000000000C70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: qhw7KZSA53.exe, 00000001.00000002.740293607.0000000000C70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery411	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery21	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qhw7KZSA53.exe	25%	Virustotal		Browse
qhw7KZSA53.exe	23%	ReversingLabs	Win32.Trojan.GuLoader
qhw7KZSA53.exe	100%	Avira	HEUR/AGEN.1109931
qhw7KZSA53.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.qhw7KZSA53.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1109931		Download File
1.0.qhw7KZSA53.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1109931		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	396529
Start date:	23.04.2021
Start time:	14:29:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qhw7KZSA53.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 14.2% (good quality ratio 8.8%) Quality average: 37.6% Quality standard deviation: 33.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.551859861514489
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qhw7KZSA53.exe
File size:	98304
MD5:	4b7687321980c96093c8e6a43b764728
SHA1:	5e27cc0eddb8646e26b72a7ff4f608df45c0eb8a
SHA256:	3a51813adeabd17d4939280137288152b2a3f25f7bf9e738c8f25df5ef49be31
SHA512:	17ea0dbc1e4144bafd45fc7683ce6d8bf1a43610a5abb11f70593f1e33b668c2a0e18c98398351af6c8b659be7256db82f8c1c4c988046258d4d5ad7996526c4
SSDEEP:	768:kd2uNErYGMJDKf0aJxvOlu/ir5SGM7YMTdxIXX5ewWYOW75CZ8ZngsCBf1lC8Ym1:nd6VivjvO3IYCdxmL5rnGf1l/Ymas
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...Ab.O.................P...0...............`....@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x4017b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4FA66241 [Sun May 6 11:36:33 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f401ad1c560f85eb5aae8e91f258deba

Entrypoint Preview

Instruction
push 0040C3F0h
call 00007FE234C66F63h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], bl
sbb eax, A18B28B3h
dec ecx
dec esi
mov bl, B9h
inc ecx
cmpsb
ror dword ptr [edi+00006325h], 1
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
outsb
and byte ptr [41462220h], bh
jnc 00007FE234C66FE6h
jc 00007FE234C66FE1h
jo 00007FE234C66FDAh
outsd
je 00007FE234C66FE1h
insd
je 00007FE234C66FE5h
imul esp, dword ptr [ebx+61h], 6500326Ch
imul esp, dword ptr [edi+68h], 00000000h
dec esp
xor dword ptr [eax], eax
pop es
jnl 00007FE234C66FDDh
adc byte ptr [ecx+5Ah], dl
lahf
add dword ptr [ebp-50h], 2201F807h
jecxz 00007FE234C66F20h
lds eax, fword ptr [eax]
movsd
in al, dx
mov ch, 47h
fisubr dword ptr [ecx+ecx*2]
mov cl, 30h
enter 1563h, 6Bh
imul edi, dword ptr [edx]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ebp
stosb
add byte ptr [eax], al
xor byte ptr [ecx+09000000h], ch
add byte ptr [edx+65h], cl
jnc 00007FE234C66FE2h
push 0000006Ch
jnc 00007FE234C66FABh
add byte ptr [00000001h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x151b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x910	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x198	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14820	0x15000	False	0.394542875744	data	6.01789488966	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x1278	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x910	0x1000	False	0.1689453125	data	1.97442049534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x187e0	0x130	data
RT_ICON	0x184f8	0x2e8	data
RT_ICON	0x183d0	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x183a0	0x30	data
RT_VERSION	0x18150	0x250	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaR4Str, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarDup, __vbaStrComp, __vbaFpI4, __vbaRecDestructAnsi, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Intuitioners4
FileVersion	1.00
CompanyName	Cybill Technologies
ProductName	Cybill Technologies
ProductVersion	1.00
OriginalFilename	Intuitioners4.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: qhw7KZSA53.exe PID: 5380 Parent PID: 5800

General

Start time:	14:30:48
Start date:	23/04/2021
Path:	C:\Users\user\Desktop\qhw7KZSA53.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\qhw7KZSA53.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	4B7687321980C96093C8E6A43B764728
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: qhw7KZSA53.exe PID: 5380 Parent PID: 5800 qhw7KZSA53.exeCOMMON

Executed Functions

Function 0040E3F4, Relevance: 188.6, APIs: 98, Strings: 9, Instructions: 1328
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0040E3F4(signed int _a4) {
				void* _v8;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				long long* _v28;
				short _v44;
				intOrPtr _v56;
				short _v60;
				char _v64;
				char _v108;
				char _v124;
				short _v128;
				void* _v132;
				intOrPtr _v140;
				char _v148;
				char _v152;
				char _v220;
				long long _v272;
				intOrPtr _v276;
				char _v280;
				signed int _v284;
				char _v300;
				signed int _v304;
				char _v308;
				intOrPtr _v336;
				char _v344;
				intOrPtr _v352;
				char _v360;
				signed int _v396;
				signed int _v400;
				char _v408;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v532;
				long long _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v680;
				signed int _v684;
				signed int _v716;
				signed int _v720;
				intOrPtr* _v724;
				signed int _v728;
				signed int _v732;
				intOrPtr* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				signed int _v756;
				signed int _v760;
				intOrPtr* _v764;
				signed int _v768;
				intOrPtr* _v772;
				signed int _v776;
				intOrPtr* _v780;
				signed int _v784;
				signed int _v788;
				intOrPtr* _v792;
				signed int _v796;
				signed int _v800;
				signed int _v804;
				signed int _v808;
				intOrPtr* _v812;
				signed int _v816;
				signed int _v820;
				intOrPtr* _v824;
				signed int _v828;
				signed int _v832;
				intOrPtr* _v836;
				signed int _v840;
				intOrPtr* _v844;
				signed int _v848;
				signed int _v852;
				intOrPtr* _v856;
				signed int _v860;
				signed int _v864;
				signed int _v868;
				signed int _v872;
				signed int _v876;
				intOrPtr* _v880;
				signed int _v884;
				intOrPtr* _v888;
				signed int _v892;
				signed int _v896;
				signed int _v900;
				signed int _v904;
				signed int _t735;
				signed int _t739;
				signed int _t744;
				signed int _t748;
				signed int _t761;
				signed int _t764;
				signed int _t769;
				signed int _t773;
				signed int _t777;
				signed int _t790;
				signed int _t794;
				char* _t796;
				signed int _t806;
				signed int _t810;
				signed int _t829;
				signed int _t833;
				signed int _t837;
				signed int _t846;
				signed int _t856;
				signed int _t861;
				signed int _t872;
				signed int _t876;
				char* _t877;
				signed int _t887;
				signed int _t891;
				signed int _t895;
				signed int _t904;
				signed int _t912;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t931;
				signed int _t937;
				signed int _t941;
				signed int _t945;
				signed int _t950;
				signed int _t953;
				signed int _t958;
				signed int _t962;
				signed int _t966;
				signed int _t970;
				signed int _t974;
				char* _t975;
				signed int _t1000;
				signed int _t1005;
				signed int _t1009;
				char* _t1013;
				char* _t1015;
				signed int _t1019;
				signed int _t1025;
				signed int _t1031;
				void* _t1034;
				char* _t1040;
				char* _t1057;
				intOrPtr _t1060;
				char* _t1065;
				intOrPtr _t1074;
				char* _t1076;
				char* _t1084;
				char* _t1089;
				void* _t1091;
				void* _t1093;
				long long* _t1095;
				void* _t1096;
				long long* _t1098;
				long long* _t1100;
				long long* _t1101;
				signed int _t1109;
				long long _t1156;

				 *[fs:0x0] = _t1095;
				L00401550();
				_v28 = _t1095;
				_v24 = 0x401198;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, _t1091, _t1093, _t1034,  *[fs:0x0], 0x401556);
				_v8 = 1;
				_v8 = 2;
				_t735 =  *((intOrPtr*)( *_a4 + 0x114))(_a4, 1);
				asm("fclex");
				_v544 = _t735;
				if(_v544 >= 0) {
					_v716 = _v716 & 0x00000000;
				} else {
					_push(0x114);
					_push(0x40d0c8);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v716 = _t735;
				}
				_v8 = 3;
				_t739 =  *((intOrPtr*)( *_a4 + 0x110))(_a4,  &_v492);
				asm("fclex");
				_v544 = _t739;
				if(_v544 >= 0) {
					_v720 = _v720 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x40d0c8);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v720 = _t739;
				}
				if(_v492 == _v140) {
					_v8 = 4;
					_v8 = 5;
					if( *0x416408 != 0) {
						_v724 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v724 = 0x416408;
					}
					_v544 =  *_v724;
					_t1025 =  *((intOrPtr*)( *_v544 + 0x4c))(_v544,  &_v300);
					asm("fclex");
					_v548 = _t1025;
					if(_v548 >= 0) {
						_v728 = _v728 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x40d844);
						_push(_v544);
						_push(_v548);
						L00401790();
						_v728 = _t1025;
					}
					_v552 = _v300;
					_v400 = 0x85;
					_v408 = 2;
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t1031 =  *((intOrPtr*)( *_v552 + 0x1c))(_v552, 0x10,  &_v304);
					asm("fclex");
					_v556 = _t1031;
					if(_v556 >= 0) {
						_v732 = _v732 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40d864);
						_push(_v552);
						_push(_v556);
						L00401790();
						_v732 = _t1031;
					}
					_v680 = _v304;
					_t72 =  &_v304;
					 *_t72 = _v304 & 0x00000000;
					_t1109 =  *_t72;
					_push(_v680);
					_push( &_v64);
					L0040178A();
					L0040177E();
				}
				_v8 = 7;
				_t1156 =  *0x401400;
				L004015CE();
				L00401778();
				asm("fcomp qword [0x4013f8]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t1109 != 0) {
					_v8 = 8;
					_push(L"Convictfish");
					L00401772();
				}
				_v8 = 0xa;
				if( *0x416010 != 0) {
					_v736 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v736 = 0x416010;
				}
				_t744 =  &_v300;
				L0040178A();
				_v544 = _t744;
				_t748 =  *((intOrPtr*)( *_v544 + 0x130))(_v544,  &_v284, _t744,  *((intOrPtr*)( *((intOrPtr*)( *_v736)) + 0x308))( *_v736));
				asm("fclex");
				_v548 = _t748;
				if(_v548 >= 0) {
					_v740 = _v740 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x40d890);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v740 = _t748;
				}
				_v684 = _v284;
				_t100 =  &_v284;
				 *_t100 = _v284 & 0x00000000;
				_v336 = _v684;
				_v344 = 8;
				_push(0);
				_push( &_v344); // executed
				L00401766(); // executed
				L0040176C();
				L0040177E();
				_t1040 =  &_v344;
				L00401760();
				_v8 = 0xb;
				_v352 = 0x80020004;
				_v360 = 0xa;
				_v336 = 0x80020004;
				_v344 = 0xa;
				_push( &_v360);
				_push( &_v344);
				asm("fld1");
				_push(_t1040);
				_push(_t1040);
				 *_t1095 = _t1156;
				asm("fld1");
				_push(_t1040);
				_push(_t1040);
				 *_t1095 = _t1156;
				asm("fld1");
				_push(_t1040);
				_push(_t1040);
				_v128 = _t1156;
				asm("fld1");
				_push(_t1040);
				_push(_t1040);
				 *_t1095 = _t1156;
				L0040175A();
				L00401778();
				asm("fcomp qword [0x4013f0]");
				asm("fnstsw ax");
				asm("sahf");
				if( *_t100 == 0) {
					_v744 = _v744 & 0x00000000;
				} else {
					_v744 = 1;
				}
				_v544 =  ~_v744;
				_push( &_v360);
				_push( &_v344);
				_push(2);
				L00401754();
				_t1096 = _t1095 + 0xc;
				if(_v544 != 0) {
					_v8 = 0xc;
					_t1019 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, 0x22ae);
					asm("fclex");
					_v544 = _t1019;
					if(_v544 >= 0) {
						_v748 = _v748 & 0x00000000;
					} else {
						_push(0x15c);
						_push(0x40d0c8);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v748 = _t1019;
					}
				}
				_v8 = 0xe;
				_t761 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
				asm("fclex");
				_v544 = _t761;
				if(_v544 >= 0) {
					_v752 = _v752 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x40d0c8);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v752 = _t761;
				}
				_v8 = 0xf;
				_t764 =  *((intOrPtr*)( *_a4 + 0x708))(_a4);
				_v544 = _t764;
				if(_v544 >= 0) {
					_v756 = _v756 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v756 = _t764;
				}
				_v8 = 0x10;
				_v504 = 0x87c604;
				_v492 = 0x5a28;
				_t769 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v492,  &_v504);
				_v544 = _t769;
				if(_v544 >= 0) {
					_v760 = _v760 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v760 = _t769;
				}
				_v8 = 0x11;
				if( *0x416010 != 0) {
					_v764 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v764 = 0x416010;
				}
				_t773 =  &_v300;
				L0040178A();
				_v544 = _t773;
				_t777 =  *((intOrPtr*)( *_v544 + 0x1c0))(_v544,  &_v284, _t773,  *((intOrPtr*)( *((intOrPtr*)( *_v764)) + 0x30c))( *_v764));
				asm("fclex");
				_v548 = _t777;
				if(_v548 >= 0) {
					_v768 = _v768 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x40d8a0);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v768 = _t777;
				}
				_v504 = 0x52693f;
				_t192 =  &_v504; // 0x52693f
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, _v284, _t192);
				L0040174E();
				L0040177E();
				_v8 = 0x12;
				_t200 =  &_v504; // 0x52693f
				 *((intOrPtr*)( *_a4 + 0x738))(_a4, _t200);
				_t204 =  &_v504; // 0x52693f
				_v276 =  *_t204;
				_v8 = 0x13;
				if( *0x416010 != 0) {
					_v772 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v772 = 0x416010;
				}
				_t790 =  &_v300;
				L0040178A();
				_v544 = _t790;
				_t794 =  *((intOrPtr*)( *_v544 + 0xd0))(_v544,  &_v304, _t790,  *((intOrPtr*)( *((intOrPtr*)( *_v772)) + 0x314))( *_v772));
				asm("fclex");
				_v548 = _t794;
				if(_v548 >= 0) {
					_v776 = _v776 & 0x00000000;
				} else {
					_push(0xd0);
					_push(0x40d8b0);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v776 = _t794;
				}
				L00401748();
				_t796 =  &_v344;
				L00401742();
				_v504 = _t796;
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4,  &_v504, L"KORTSPILLER", _t796,  &_v344, _v304, 0, 0);
				_push( &_v304);
				_push( &_v300);
				_push(2);
				L0040173C();
				_t1098 = _t1096 + 0x1c;
				L00401760();
				_v8 = 0x14;
				if( *0x416010 != 0) {
					_v780 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v780 = 0x416010;
				}
				_t806 =  &_v300;
				L0040178A();
				_v544 = _t806;
				_t810 =  *((intOrPtr*)( *_v544 + 0xe8))(_v544,  &_v492, _t806,  *((intOrPtr*)( *((intOrPtr*)( *_v780)) + 0x304))( *_v780));
				asm("fclex");
				_v548 = _t810;
				if(_v548 >= 0) {
					_v784 = _v784 & 0x00000000;
				} else {
					_push(0xe8);
					_push(0x40d8dc);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v784 = _t810;
				}
				_v500 = _v492;
				_v496 = 0x11;
				 *((intOrPtr*)( *_a4 + 0x720))(_a4,  &_v496,  &_v500);
				L0040177E();
				_v8 = 0x15;
				 *((intOrPtr*)( *_a4 + 0x734))(_a4,  &_v492);
				_v128 = _v492;
				_v8 = 0x16;
				 *((intOrPtr*)( *_a4 + 0x734))(_a4,  &_v492);
				_v60 = _v492;
				_v8 = 0x17;
				_t829 =  *((intOrPtr*)( *_a4 + 0x708))(_a4);
				_v544 = _t829;
				if(_v544 >= 0) {
					_v788 = _v788 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v788 = _t829;
				}
				_v8 = 0x18;
				if( *0x416010 != 0) {
					_v792 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v792 = 0x416010;
				}
				_t833 =  &_v300;
				L0040178A();
				_v544 = _t833;
				_t837 =  *((intOrPtr*)( *_v544 + 0x58))(_v544,  &_v504, _t833,  *((intOrPtr*)( *((intOrPtr*)( *_v792)) + 0x2fc))( *_v792));
				asm("fclex");
				_v548 = _t837;
				if(_v548 >= 0) {
					_v796 = _v796 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x40d8ec);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v796 = _t837;
				}
				_v508 = _v504;
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4,  &_v508, L"Incipient");
				_t1057 =  &_v300;
				L0040177E();
				_v8 = 0x19;
				_t846 =  *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v504);
				_v544 = _t846;
				if(_v544 >= 0) {
					_v800 = _v800 & 0x00000000;
				} else {
					_push(0x710);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v800 = _t846;
				}
				_v152 = _v504;
				_v8 = 0x1a;
				 *((intOrPtr*)( *_a4 + 0x734))(_a4,  &_v492);
				_v44 = _v492;
				_v8 = 0x1b;
				_t856 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v504);
				_v544 = _t856;
				if(_v544 >= 0) {
					_v804 = _v804 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v804 = _t856;
				}
				_v220 = _v504;
				_v8 = 0x1c;
				_v504 = 0x82762a;
				 *_t1098 =  *0x4013ec;
				_t861 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _t1057,  &_v504);
				_v544 = _t861;
				if(_v544 >= 0) {
					_v808 = _v808 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v808 = _t861;
				}
				_v8 = 0x1d;
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4);
				_v8 = 0x1e;
				_v504 =  *0x4013e8;
				 *_t1098 =  *0x4013e0;
				 *((intOrPtr*)( *_a4 + 0x730))(_a4,  &_v504, _t1057, _t1057);
				_v8 = 0x1f;
				if( *0x416010 != 0) {
					_v812 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v812 = 0x416010;
				}
				_t1060 =  *((intOrPtr*)( *_v812));
				_t872 =  &_v300;
				L0040178A();
				_v544 = _t872;
				_t876 =  *((intOrPtr*)( *_v544 + 0x130))(_v544,  &_v304, _t872,  *((intOrPtr*)(_t1060 + 0x30c))( *_v812));
				asm("fclex");
				_v548 = _t876;
				if(_v548 >= 0) {
					_v816 = _v816 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x40d8a0);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v816 = _t876;
				}
				_t877 =  &_v344;
				L00401748();
				L00401742();
				_v504 = _t877;
				_v408 =  *0x4013d8;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4, _t1060, _t1060,  &_v504, _t877, _t877, _v304, 0, 0);
				L0040173C();
				_t1100 = _t1098 + 0x1c;
				L00401760();
				_v8 = 0x20;
				_v504 = 0x5c52c3;
				 *_t1100 =  *0x4013d0;
				_t887 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v344,  &_v504, 2,  &_v300,  &_v304);
				_v544 = _t887;
				if(_v544 >= 0) {
					_v820 = _v820 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v820 = _t887;
				}
				_v8 = 0x21;
				if( *0x416010 != 0) {
					_v824 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v824 = 0x416010;
				}
				_t891 =  &_v300;
				L0040178A();
				_v544 = _t891;
				_t895 =  *((intOrPtr*)( *_v544 + 0x68))(_v544,  &_v504, _t891,  *((intOrPtr*)( *((intOrPtr*)( *_v824)) + 0x30c))( *_v824));
				asm("fclex");
				_v548 = _t895;
				if(_v548 >= 0) {
					_v828 = _v828 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x40d8a0);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v828 = _t895;
				}
				_v508 = _v504;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, L"Diisatogen",  &_v508);
				_t1065 =  &_v300;
				L0040177E();
				_v8 = 0x22;
				_v532 =  *0x4013c8;
				 *_t1100 =  *0x4013c0;
				_t904 =  *((intOrPtr*)( *_a4 + 0x714))(_a4, _t1065, _t1065,  &_v532);
				_v544 = _t904;
				if(_v544 >= 0) {
					_v832 = _v832 & 0x00000000;
				} else {
					_push(0x714);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v544);
					L00401790();
					_v832 = _t904;
				}
				_v8 = 0x23;
				_v504 = 0x53e0c3;
				 *_t1100 =  *0x4013b8;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4, _t1065, _t1065,  &_v504);
				_v8 = 0x24;
				if( *0x416010 != 0) {
					_v836 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v836 = 0x416010;
				}
				_t912 =  &_v300;
				L0040178A();
				_v544 = _t912;
				_t916 =  *((intOrPtr*)( *_v544 + 0xb8))(_v544,  &_v492, _t912,  *((intOrPtr*)( *((intOrPtr*)( *_v836)) + 0x314))( *_v836));
				asm("fclex");
				_v548 = _t916;
				if(_v548 >= 0) {
					_v840 = _v840 & 0x00000000;
				} else {
					_push(0xb8);
					_push(0x40d8b0);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v840 = _t916;
				}
				if( *0x416010 != 0) {
					_v844 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v844 = 0x416010;
				}
				_t920 =  &_v304;
				L0040178A();
				_v552 = _t920;
				_t924 =  *((intOrPtr*)( *_v552 + 0x120))(_v552,  &_v504, _t920,  *((intOrPtr*)( *((intOrPtr*)( *_v844)) + 0x300))( *_v844));
				asm("fclex");
				_v556 = _t924;
				if(_v556 >= 0) {
					_v848 = _v848 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x40d930);
					_push(_v552);
					_push(_v556);
					L00401790();
					_v848 = _t924;
				}
				_v508 = _v504;
				_v496 = _v492;
				_t931 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v496,  &_v508);
				_v560 = _t931;
				if(_v560 >= 0) {
					_v852 = _v852 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v560);
					L00401790();
					_v852 = _t931;
				}
				_push( &_v304);
				_push( &_v300);
				_push(2);
				L0040173C();
				_t1101 = _t1100 + 0xc;
				_v8 = 0x25;
				if( *0x416010 != 0) {
					_v856 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v856 = 0x416010;
				}
				_t1074 =  *((intOrPtr*)( *_v856));
				_t937 =  &_v300;
				L0040178A();
				_v544 = _t937;
				_t941 =  *((intOrPtr*)( *_v544 + 0x80))(_v544,  &_v504, _t937,  *((intOrPtr*)(_t1074 + 0x304))( *_v856));
				asm("fclex");
				_v548 = _t941;
				if(_v548 >= 0) {
					_v860 = _v860 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x40d8dc);
					_push(_v544);
					_push(_v548);
					L00401790();
					_v860 = _t941;
				}
				_v508 = 0x3f578b;
				 *_t1101 = _v504;
				_t945 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _t1074,  &_v508);
				_v552 = _t945;
				if(_v552 >= 0) {
					_v864 = _v864 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40d0fc);
					_push(_a4);
					_push(_v552);
					L00401790();
					_v864 = _t945;
				}
				L0040177E();
				_v8 = 0x26;
				_push(0xffffffff);
				L00401736();
				_v8 = 0x27;
				_v400 = _v400 & 0x00000000;
				_v396 = _v396 & 0x00000000;
				_v408 = 6;
				_t1076 =  &_v124;
				L00401730();
				while(1) {
					_v8 = 0x29;
					_v532 =  *0x4013b0;
					 *_t1101 =  *0x4013a8;
					_t950 =  *((intOrPtr*)( *_a4 + 0x700))(_a4, _t1076, _t1076,  &_v532,  &_v540);
					_v544 = _t950;
					if(_v544 >= 0) {
						_v868 = _v868 & 0x00000000;
					} else {
						_push(0x700);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v868 = _t950;
					}
					_v272 = _v540;
					_v8 = 0x2a;
					_t953 =  *((intOrPtr*)( *_a4 + 0x708))(_a4);
					_v544 = _t953;
					if(_v544 >= 0) {
						_v872 = _v872 & 0x00000000;
					} else {
						_push(0x708);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v872 = _t953;
					}
					_v8 = 0x2b;
					_v504 = 0xaa43d022;
					_v492 = 0x58;
					_t958 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v492,  &_v504);
					_v544 = _t958;
					if(_v544 >= 0) {
						_v876 = _v876 & 0x00000000;
					} else {
						_push(0x70c);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v876 = _t958;
					}
					_v8 = 0x2c;
					if( *0x416010 != 0) {
						_v880 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v880 = 0x416010;
					}
					_t962 =  &_v300;
					L0040178A();
					_v544 = _t962;
					_t966 =  *((intOrPtr*)( *_v544 + 0x1c0))(_v544,  &_v284, _t962,  *((intOrPtr*)( *((intOrPtr*)( *_v880)) + 0x30c))( *_v880));
					asm("fclex");
					_v548 = _t966;
					if(_v548 >= 0) {
						_v884 = _v884 & 0x00000000;
					} else {
						_push(0x1c0);
						_push(0x40d8a0);
						_push(_v544);
						_push(_v548);
						L00401790();
						_v884 = _t966;
					}
					if( *0x416010 != 0) {
						_v888 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v888 = 0x416010;
					}
					_t970 =  &_v304;
					L0040178A();
					_v552 = _t970;
					_t974 =  *((intOrPtr*)( *_v552 + 0x178))(_v552,  &_v308, _t970,  *((intOrPtr*)( *((intOrPtr*)( *_v888)) + 0x308))( *_v888));
					asm("fclex");
					_v556 = _t974;
					if(_v556 >= 0) {
						_v892 = _v892 & 0x00000000;
					} else {
						_push(0x178);
						_push(0x40d890);
						_push(_v552);
						_push(_v556);
						L00401790();
						_v892 = _t974;
					}
					_t975 =  &_v344;
					L00401748();
					L00401742();
					_v504 = _t975;
					 *((intOrPtr*)( *_a4 + 0x728))(_a4, _v284,  &_v504, _t975, _t975, _v308, 0, 0);
					L0040174E();
					L0040173C();
					_t1101 = _t1101 + 0x20;
					_t1084 =  &_v344;
					L00401760();
					_v8 = 0x2d;
					 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v504, 3,  &_v300,  &_v304,  &_v308);
					_v280 = _v504;
					_v8 = 0x2e;
					_v504 = 0x74261a;
					 *((intOrPtr*)( *_a4 + 0x72c))(_a4,  &_v504, L"Nonmonastic");
					_v8 = 0x2f;
					 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v504);
					_v108 = _v504;
					_v8 = 0x30;
					_t1000 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v504);
					_v544 = _t1000;
					if(_v544 >= 0) {
						_v896 = _v896 & 0x00000000;
					} else {
						_push(0x6f8);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v896 = _t1000;
					}
					_v148 = _v504;
					_v8 = 0x31;
					_v532 =  *0x4013a0;
					_v716 =  *0x401398;
					_t1005 =  *((intOrPtr*)( *_a4 + 0x714))(_a4, _t1084, _t1084,  &_v532);
					_v544 = _t1005;
					if(_v544 >= 0) {
						_v900 = _v900 & 0x00000000;
					} else {
						_push(0x714);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v900 = _t1005;
					}
					_v8 = 0x32;
					_t1009 =  *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v504);
					_v544 = _t1009;
					if(_v544 >= 0) {
						_v904 = _v904 & 0x00000000;
					} else {
						_push(0x710);
						_push(0x40d0fc);
						_push(_a4);
						_push(_v544);
						L00401790();
						_v904 = _t1009;
					}
					_v56 = _v504;
					_v8 = 0x33;
					_v400 = 1;
					_v408 = 2;
					_push( &_v124);
					_push( &_v408);
					_t1013 =  &_v344;
					_push(_t1013);
					L0040172A();
					_t1089 = _t1013;
					_t1076 =  &_v124;
					L00401730();
					_v8 = 0x34;
					_v400 = 0x11110;
					_v408 = 0x8003;
					_push( &_v124);
					_t1015 =  &_v408;
					_push(_t1015);
					L00401724();
					if(_t1015 == 0) {
						break;
					}
				}
				_v8 = 0x37;
				_v400 = 0xea;
				do {
					_t1089 = _t1089 + 1;
				} while (_t1089 != 0x32a497);
				_push(_t1089 + 0xdf564);
				goto ( *__ecx);
			}

0x0040e406
0x0040e412
0x0040e41a
0x0040e41d
0x0040e42a
0x0040e433
0x0040e436
0x0040e445
0x0040e448
0x0040e44f
0x0040e460
0x0040e466
0x0040e468
0x0040e475
0x0040e497
0x0040e477
0x0040e477
0x0040e47c
0x0040e481
0x0040e484
0x0040e48a
0x0040e48f
0x0040e48f
0x0040e49e
0x0040e4b4
0x0040e4ba
0x0040e4bc
0x0040e4c9
0x0040e4eb
0x0040e4cb
0x0040e4cb
0x0040e4d0
0x0040e4d5
0x0040e4d8
0x0040e4de
0x0040e4e3
0x0040e4e3
0x0040e500
0x0040e506
0x0040e50d
0x0040e51b
0x0040e538
0x0040e51d
0x0040e51d
0x0040e522
0x0040e527
0x0040e52c
0x0040e52c
0x0040e54a
0x0040e565
0x0040e568
0x0040e56a
0x0040e577
0x0040e599
0x0040e579
0x0040e579
0x0040e57b
0x0040e580
0x0040e586
0x0040e58c
0x0040e591
0x0040e591
0x0040e5a6
0x0040e5ac
0x0040e5b6
0x0040e5ca
0x0040e5d7
0x0040e5d8
0x0040e5d9
0x0040e5da
0x0040e5e9
0x0040e5ec
0x0040e5ee
0x0040e5fb
0x0040e61d
0x0040e5fd
0x0040e5fd
0x0040e5ff
0x0040e604
0x0040e60a
0x0040e610
0x0040e615
0x0040e615
0x0040e62a
0x0040e630
0x0040e630
0x0040e630
0x0040e637
0x0040e640
0x0040e641
0x0040e64c
0x0040e64c
0x0040e651
0x0040e658
0x0040e65e
0x0040e663
0x0040e668
0x0040e66e
0x0040e670
0x0040e671
0x0040e673
0x0040e67a
0x0040e67f
0x0040e67f
0x0040e684
0x0040e692
0x0040e6af
0x0040e694
0x0040e694
0x0040e699
0x0040e69e
0x0040e6a3
0x0040e6a3
0x0040e6d3
0x0040e6da
0x0040e6df
0x0040e6fa
0x0040e700
0x0040e702
0x0040e70f
0x0040e734
0x0040e711
0x0040e711
0x0040e716
0x0040e71b
0x0040e721
0x0040e727
0x0040e72c
0x0040e72c
0x0040e741
0x0040e747
0x0040e747
0x0040e754
0x0040e75a
0x0040e764
0x0040e76c
0x0040e76d
0x0040e777
0x0040e782
0x0040e787
0x0040e78d
0x0040e792
0x0040e799
0x0040e7a3
0x0040e7ad
0x0040e7b7
0x0040e7c7
0x0040e7ce
0x0040e7cf
0x0040e7d1
0x0040e7d2
0x0040e7d3
0x0040e7d6
0x0040e7d8
0x0040e7d9
0x0040e7da
0x0040e7dd
0x0040e7df
0x0040e7e0
0x0040e7e1
0x0040e7e4
0x0040e7e6
0x0040e7e7
0x0040e7e8
0x0040e7eb
0x0040e7f0
0x0040e7f5
0x0040e7fb
0x0040e7fd
0x0040e7fe
0x0040e80c
0x0040e800
0x0040e800
0x0040e800
0x0040e81b
0x0040e828
0x0040e82f
0x0040e830
0x0040e832
0x0040e837
0x0040e843
0x0040e845
0x0040e859
0x0040e85f
0x0040e861
0x0040e86e
0x0040e890
0x0040e870
0x0040e870
0x0040e875
0x0040e87a
0x0040e87d
0x0040e883
0x0040e888
0x0040e888
0x0040e86e
0x0040e897
0x0040e8a6
0x0040e8ac
0x0040e8ae
0x0040e8bb
0x0040e8dd
0x0040e8bd
0x0040e8bd
0x0040e8c2
0x0040e8c7
0x0040e8ca
0x0040e8d0
0x0040e8d5
0x0040e8d5
0x0040e8e4
0x0040e8f3
0x0040e8f9
0x0040e906
0x0040e928
0x0040e908
0x0040e908
0x0040e90d
0x0040e912
0x0040e915
0x0040e91b
0x0040e920
0x0040e920
0x0040e92f
0x0040e936
0x0040e940
0x0040e95f
0x0040e965
0x0040e972
0x0040e994
0x0040e974
0x0040e974
0x0040e979
0x0040e97e
0x0040e981
0x0040e987
0x0040e98c
0x0040e98c
0x0040e99b
0x0040e9a9
0x0040e9c6
0x0040e9ab
0x0040e9ab
0x0040e9b0
0x0040e9b5
0x0040e9ba
0x0040e9ba
0x0040e9ea
0x0040e9f1
0x0040e9f6
0x0040ea11
0x0040ea17
0x0040ea19
0x0040ea26
0x0040ea4b
0x0040ea28
0x0040ea28
0x0040ea2d
0x0040ea32
0x0040ea38
0x0040ea3e
0x0040ea43
0x0040ea43
0x0040ea52
0x0040ea5c
0x0040ea71
0x0040ea7d
0x0040ea88
0x0040ea8d
0x0040ea94
0x0040eaa3
0x0040eaa9
0x0040eaaf
0x0040eab5
0x0040eac3
0x0040eae0
0x0040eac5
0x0040eac5
0x0040eaca
0x0040eacf
0x0040ead4
0x0040ead4
0x0040eb04
0x0040eb0b
0x0040eb10
0x0040eb2b
0x0040eb31
0x0040eb33
0x0040eb40
0x0040eb65
0x0040eb42
0x0040eb42
0x0040eb47
0x0040eb4c
0x0040eb52
0x0040eb58
0x0040eb5d
0x0040eb5d
0x0040eb7d
0x0040eb85
0x0040eb8c
0x0040eb91
0x0040ebab
0x0040ebb7
0x0040ebbe
0x0040ebbf
0x0040ebc1
0x0040ebc6
0x0040ebcf
0x0040ebd4
0x0040ebe2
0x0040ebff
0x0040ebe4
0x0040ebe4
0x0040ebe9
0x0040ebee
0x0040ebf3
0x0040ebf3
0x0040ec23
0x0040ec2a
0x0040ec2f
0x0040ec4a
0x0040ec50
0x0040ec52
0x0040ec5f
0x0040ec84
0x0040ec61
0x0040ec61
0x0040ec66
0x0040ec6b
0x0040ec71
0x0040ec77
0x0040ec7c
0x0040ec7c
0x0040ec92
0x0040ec99
0x0040ecb8
0x0040ecc4
0x0040ecc9
0x0040ecdf
0x0040ecec
0x0040ecf0
0x0040ed06
0x0040ed13
0x0040ed17
0x0040ed26
0x0040ed2c
0x0040ed39
0x0040ed5b
0x0040ed3b
0x0040ed3b
0x0040ed40
0x0040ed45
0x0040ed48
0x0040ed4e
0x0040ed53
0x0040ed53
0x0040ed62
0x0040ed70
0x0040ed8d
0x0040ed72
0x0040ed72
0x0040ed77
0x0040ed7c
0x0040ed81
0x0040ed81
0x0040edb1
0x0040edb8
0x0040edbd
0x0040edd8
0x0040eddb
0x0040eddd
0x0040edea
0x0040ee0c
0x0040edec
0x0040edec
0x0040edee
0x0040edf3
0x0040edf9
0x0040edff
0x0040ee04
0x0040ee04
0x0040ee19
0x0040ee33
0x0040ee39
0x0040ee3f
0x0040ee44
0x0040ee5a
0x0040ee60
0x0040ee6d
0x0040ee8f
0x0040ee6f
0x0040ee6f
0x0040ee74
0x0040ee79
0x0040ee7c
0x0040ee82
0x0040ee87
0x0040ee87
0x0040ee9c
0x0040eea2
0x0040eeb8
0x0040eec5
0x0040eec9
0x0040eedf
0x0040eee5
0x0040eef2
0x0040ef14
0x0040eef4
0x0040eef4
0x0040eef9
0x0040eefe
0x0040ef01
0x0040ef07
0x0040ef0c
0x0040ef0c
0x0040ef21
0x0040ef27
0x0040ef2e
0x0040ef46
0x0040ef51
0x0040ef57
0x0040ef64
0x0040ef86
0x0040ef66
0x0040ef66
0x0040ef6b
0x0040ef70
0x0040ef73
0x0040ef79
0x0040ef7e
0x0040ef7e
0x0040ef8d
0x0040ef9c
0x0040efa2
0x0040efaf
0x0040efbd
0x0040efcf
0x0040efd5
0x0040efe3
0x0040f000
0x0040efe5
0x0040efe5
0x0040efea
0x0040efef
0x0040eff4
0x0040eff4
0x0040f01a
0x0040f024
0x0040f02b
0x0040f030
0x0040f04b
0x0040f051
0x0040f053
0x0040f060
0x0040f085
0x0040f062
0x0040f062
0x0040f067
0x0040f06c
0x0040f072
0x0040f078
0x0040f07d
0x0040f07d
0x0040f096
0x0040f09d
0x0040f0a6
0x0040f0ab
0x0040f0c0
0x0040f0cb
0x0040f0e1
0x0040f0e6
0x0040f0ef
0x0040f0f4
0x0040f0fb
0x0040f113
0x0040f11e
0x0040f124
0x0040f131
0x0040f153
0x0040f133
0x0040f133
0x0040f138
0x0040f13d
0x0040f140
0x0040f146
0x0040f14b
0x0040f14b
0x0040f15a
0x0040f168
0x0040f185
0x0040f16a
0x0040f16a
0x0040f16f
0x0040f174
0x0040f179
0x0040f179
0x0040f1a9
0x0040f1b0
0x0040f1b5
0x0040f1d0
0x0040f1d3
0x0040f1d5
0x0040f1e2
0x0040f204
0x0040f1e4
0x0040f1e4
0x0040f1e6
0x0040f1eb
0x0040f1f1
0x0040f1f7
0x0040f1fc
0x0040f1fc
0x0040f211
0x0040f22b
0x0040f231
0x0040f237
0x0040f23c
0x0040f249
0x0040f25e
0x0040f269
0x0040f26f
0x0040f27c
0x0040f29e
0x0040f27e
0x0040f27e
0x0040f283
0x0040f288
0x0040f28b
0x0040f291
0x0040f296
0x0040f296
0x0040f2a5
0x0040f2ac
0x0040f2c5
0x0040f2d0
0x0040f2d6
0x0040f2e4
0x0040f301
0x0040f2e6
0x0040f2e6
0x0040f2eb
0x0040f2f0
0x0040f2f5
0x0040f2f5
0x0040f325
0x0040f32c
0x0040f331
0x0040f34c
0x0040f352
0x0040f354
0x0040f361
0x0040f386
0x0040f363
0x0040f363
0x0040f368
0x0040f36d
0x0040f373
0x0040f379
0x0040f37e
0x0040f37e
0x0040f394
0x0040f3b1
0x0040f396
0x0040f396
0x0040f39b
0x0040f3a0
0x0040f3a5
0x0040f3a5
0x0040f3d5
0x0040f3dc
0x0040f3e1
0x0040f3fc
0x0040f402
0x0040f404
0x0040f411
0x0040f436
0x0040f413
0x0040f413
0x0040f418
0x0040f41d
0x0040f423
0x0040f429
0x0040f42e
0x0040f42e
0x0040f443
0x0040f450
0x0040f46d
0x0040f473
0x0040f480
0x0040f4a2
0x0040f482
0x0040f482
0x0040f487
0x0040f48c
0x0040f48f
0x0040f495
0x0040f49a
0x0040f49a
0x0040f4af
0x0040f4b6
0x0040f4b7
0x0040f4b9
0x0040f4be
0x0040f4c1
0x0040f4cf
0x0040f4ec
0x0040f4d1
0x0040f4d1
0x0040f4d6
0x0040f4db
0x0040f4e0
0x0040f4e0
0x0040f506
0x0040f510
0x0040f517
0x0040f51c
0x0040f537
0x0040f53d
0x0040f53f
0x0040f54c
0x0040f571
0x0040f54e
0x0040f54e
0x0040f553
0x0040f558
0x0040f55e
0x0040f564
0x0040f569
0x0040f569
0x0040f578
0x0040f590
0x0040f59b
0x0040f5a1
0x0040f5ae
0x0040f5d0
0x0040f5b0
0x0040f5b0
0x0040f5b5
0x0040f5ba
0x0040f5bd
0x0040f5c3
0x0040f5c8
0x0040f5c8
0x0040f5dd
0x0040f5e2
0x0040f5e9
0x0040f5eb
0x0040f5f0
0x0040f5f7
0x0040f5fe
0x0040f605
0x0040f615
0x0040f618
0x0040f61d
0x0040f61d
0x0040f62a
0x0040f646
0x0040f651
0x0040f657
0x0040f664
0x0040f686
0x0040f666
0x0040f666
0x0040f66b
0x0040f670
0x0040f673
0x0040f679
0x0040f67e
0x0040f67e
0x0040f693
0x0040f699
0x0040f6a8
0x0040f6ae
0x0040f6bb
0x0040f6dd
0x0040f6bd
0x0040f6bd
0x0040f6c2
0x0040f6c7
0x0040f6ca
0x0040f6d0
0x0040f6d5
0x0040f6d5
0x0040f6e4
0x0040f6eb
0x0040f6f5
0x0040f714
0x0040f71a
0x0040f727
0x0040f749
0x0040f729
0x0040f729
0x0040f72e
0x0040f733
0x0040f736
0x0040f73c
0x0040f741
0x0040f741
0x0040f750
0x0040f75e
0x0040f77b
0x0040f760
0x0040f760
0x0040f765
0x0040f76a
0x0040f76f
0x0040f76f
0x0040f79f
0x0040f7a6
0x0040f7ab
0x0040f7c6
0x0040f7cc
0x0040f7ce
0x0040f7db
0x0040f800
0x0040f7dd
0x0040f7dd
0x0040f7e2
0x0040f7e7
0x0040f7ed
0x0040f7f3
0x0040f7f8
0x0040f7f8
0x0040f80e
0x0040f82b
0x0040f810
0x0040f810
0x0040f815
0x0040f81a
0x0040f81f
0x0040f81f
0x0040f84f
0x0040f856
0x0040f85b
0x0040f876
0x0040f87c
0x0040f87e
0x0040f88b
0x0040f8b0
0x0040f88d
0x0040f88d
0x0040f892
0x0040f897
0x0040f89d
0x0040f8a3
0x0040f8a8
0x0040f8a8
0x0040f8c1
0x0040f8c8
0x0040f8d1
0x0040f8d6
0x0040f8f1
0x0040f8fd
0x0040f919
0x0040f91e
0x0040f921
0x0040f927
0x0040f92c
0x0040f942
0x0040f94e
0x0040f954
0x0040f95b
0x0040f979
0x0040f97f
0x0040f995
0x0040f9a1
0x0040f9a4
0x0040f9ba
0x0040f9c0
0x0040f9cd
0x0040f9ef
0x0040f9cf
0x0040f9cf
0x0040f9d4
0x0040f9d9
0x0040f9dc
0x0040f9e2
0x0040f9e7
0x0040f9e7
0x0040f9fc
0x0040fa02
0x0040fa0f
0x0040fa24
0x0040fa2f
0x0040fa35
0x0040fa42
0x0040fa64
0x0040fa44
0x0040fa44
0x0040fa49
0x0040fa4e
0x0040fa51
0x0040fa57
0x0040fa5c
0x0040fa5c
0x0040fa6b
0x0040fa81
0x0040fa87
0x0040fa94
0x0040fab6
0x0040fa96
0x0040fa96
0x0040fa9b
0x0040faa0
0x0040faa3
0x0040faa9
0x0040faae
0x0040faae
0x0040fac3
0x0040fac6
0x0040facd
0x0040fad7
0x0040fae4
0x0040faeb
0x0040faec
0x0040faf2
0x0040faf3
0x0040faf8
0x0040fafa
0x0040fafd
0x0040fb02
0x0040fb09
0x0040fb13
0x0040fb20
0x0040fb21
0x0040fb27
0x0040fb28
0x0040fb32
0x00000000
0x00000000
0x0040fb34
0x0040fb39
0x0040fb40
0x0040fb4a
0x0040fb4a
0x0040fb4d
0x0040fb5b
0x0040fb5e

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 0040E412
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0C8,00000114), ref: 0040E48A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0C8,00000110), ref: 0040E4DE
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 0040E527
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D844,0000004C), ref: 0040E58C
__vbaChkstk.MSVBVM60(?), ref: 0040E5CA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D864,0000001C), ref: 0040E610
__vbaObjSet.MSVBVM60(?,?), ref: 0040E641
__vbaFreeObj.MSVBVM60(?,?), ref: 0040E64C
_CIsqrt.MSVBVM60(?,?), ref: 0040E65E
__vbaFpR8.MSVBVM60(?,?), ref: 0040E663
#532.MSVBVM60(Convictfish), ref: 0040E67F
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 0040E69E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E6DA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D890,00000130), ref: 0040E727
#645.MSVBVM60(00000008,00000000), ref: 0040E76D
__vbaStrMove.MSVBVM60(00000008,00000000), ref: 0040E777
__vbaFreeObj.MSVBVM60(00000008,00000000), ref: 0040E782
__vbaFreeVar.MSVBVM60(00000008,00000000), ref: 0040E78D
#674.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A,00000008,00000000), ref: 0040E7EB
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A,00000008,00000000), ref: 0040E7F0
__vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A,?,?,?,?,?,?,?,?,0000000A,0000000A,00000008,00000000), ref: 0040E832
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0C8,0000015C), ref: 0040E883
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0C8,000002B4), ref: 0040E8D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000708), ref: 0040E91B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,0000070C), ref: 0040E987
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 0040E9B5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E9F1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8A0,000001C0), ref: 0040EA3E
__vbaFreeStr.MSVBVM60 ref: 0040EA7D
__vbaFreeObj.MSVBVM60 ref: 0040EA88
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 0040EACF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EB0B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8B0,000000D0), ref: 0040EB58
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040EB7D
__vbaI4Var.MSVBVM60(?,?,?,?,?,?,?,00401556), ref: 0040EB8C
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,00401556), ref: 0040EBC1
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,00401556), ref: 0040EBCF
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,?,?,?,?,?,00401556), ref: 0040EBEE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EC2A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8DC,000000E8), ref: 0040EC77
__vbaFreeObj.MSVBVM60 ref: 0040ECC4
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000708), ref: 0040ED4E
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 0040ED7C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EDB8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8EC,00000058), ref: 0040EDFF
__vbaFreeObj.MSVBVM60 ref: 0040EE3F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000710), ref: 0040EE82
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,000006F8), ref: 0040EF07
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,000006FC,?,0082762A), ref: 0040EF79
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,0082762A), ref: 0040EFEF
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,0082762A), ref: 0040F02B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8A0,00000130,?,?,?,0082762A), ref: 0040F078
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,0082762A), ref: 0040F09D
__vbaI4Var.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401556), ref: 0040F0A6
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,00000000), ref: 0040F0E1
__vbaFreeVar.MSVBVM60(?,?,00000000), ref: 0040F0EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,000006FC,?,?,?,?,?,?,?,?,?,005C52C3), ref: 0040F146
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 0040F174
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F1B0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8A0,00000068), ref: 0040F1F7
__vbaFreeObj.MSVBVM60 ref: 0040F237
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000714,?,?,?), ref: 0040F291
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,0053E0C3,?,?,?), ref: 0040F2F0
__vbaObjSet.MSVBVM60(?,00000000,?,?,0053E0C3,?,?,?), ref: 0040F32C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8B0,000000B8,?,?,0053E0C3,?,?,?), ref: 0040F379
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,0053E0C3,?,?,?), ref: 0040F3A0
__vbaObjSet.MSVBVM60(?,00000000,?,?,0053E0C3,?,?,?), ref: 0040F3DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D930,00000120,?,?,0053E0C3,?,?,?), ref: 0040F429
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,0000070C,?,?,0053E0C3,?,?,?), ref: 0040F495
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,0053E0C3,?,?,?), ref: 0040F4B9
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,?,00000000), ref: 0040F4DB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F517
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8DC,00000080), ref: 0040F564
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,000006FC,?,003F578B), ref: 0040F5C3
__vbaFreeObj.MSVBVM60(?,003F578B), ref: 0040F5DD
__vbaOnError.MSVBVM60(000000FF,?,003F578B), ref: 0040F5EB
__vbaVarMove.MSVBVM60(000000FF,?,003F578B), ref: 0040F618
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000700,?,?,?,?,00008003,?,?,00000002,?,?,?,?), ref: 0040F679
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000708,?,?,?,?,00008003,?,?,00000002,?,?,?,?), ref: 0040F6D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,0000070C,?,?,?,?,00008003,?,?,00000002,?,?,?,?), ref: 0040F73C
__vbaNew2.MSVBVM60(0040C818,00416010,00000000,?,0040D0FC,0000070C,?,?,?,?,00008003,?,?,00000002,?), ref: 0040F76A
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,000000FF,?,003F578B), ref: 0040F7A6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D8A0,000001C0,?,?,?,?,00008003,?,?,00000002,?,?,?,?), ref: 0040F7F3
__vbaNew2.MSVBVM60(0040C818,00416010,00000000,00000000,0040D8A0,000001C0,?,?,?,?,00008003,?,?,00000002,?), ref: 0040F81A
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,000000FF,?,003F578B), ref: 0040F856
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D890,00000178,?,?,?,?,00008003,?,?,00000002,?,?,?,?), ref: 0040F8A3
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?,?,000000FF,?,003F578B), ref: 0040F8C8
__vbaI4Var.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F8D1
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000), ref: 0040F8FD
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F919
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F927
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,000006F8), ref: 0040F9E2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000714,?,?,?,00000000,?,0040D0FC,000006F8), ref: 0040FA57
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D0FC,00000710,?,?,?,00000000,?,0040D0FC,000006F8), ref: 0040FAA9
__vbaVarAdd.MSVBVM60(?,00000002,?,?,?,?), ref: 0040FAF3
__vbaVarMove.MSVBVM60(?,00000002,?,?,?,?), ref: 0040FAFD
__vbaVarTstLt.MSVBVM60(00008003,?,?,00000002,?,?,?,?), ref: 0040FB28

Strings

KORTSPILLER, xrefs: 0040EB97
Convictfish, xrefs: 0040E67A
Nonmonastic, xrefs: 0040F965
?iR, xrefs: 0040EA5C, 0040EA62
Incipient, xrefs: 0040EE1F
Diisatogen, xrefs: 0040F21E
X, xrefs: 0040F6F5
(Z, xrefs: 0040E940
7, xrefs: 0040FB39

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$List$CallLateMove$Chkstk$#532#645#674ErrorIsqrt
String ID: (Z$7$?iR$Convictfish$Diisatogen$Incipient$KORTSPILLER$Nonmonastic$X
API String ID: 1439572163-3770842000
Opcode ID: 727ed6600ccb3921ab7406039ece3220d27ebdeb82988a7503776d0169512178
Instruction ID: 1d616ce03ef67229ec2f9c57606c360f441f0b5d4e7bea152b743ef0799f28b0
Opcode Fuzzy Hash: 727ed6600ccb3921ab7406039ece3220d27ebdeb82988a7503776d0169512178
Instruction Fuzzy Hash: ADE20575941229EFDB21DF50CC48BD9BBB4BB08304F1084FAE509AB2A1CB799B95DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004017B0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 75%

			_entry_(signed int __eax, void* __ebx, intOrPtr* __ecx, signed int* __edx, signed int __edi, void* __esi) {
				signed int _t31;
				signed int _t32;
				signed char _t38;
				signed int* _t41;
				signed int* _t42;
				signed int _t48;
				void* _t50;
				signed int _t55;
				signed int* _t62;

				_t44 = __edi;
				_t41 = __edx;
				_push("VB5!6&*"); // executed
				L004017A8(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t31 = __eax - 1;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *__ecx =  *__ecx + __ebx;
				asm("sbb eax, 0xa18b28b3");
				_t48 = __esi - 1;
				_t34 = 0xb9;
				_t38 = __ecx - 1 + 1;
				asm("cmpsb");
				asm("ror dword [edi+0x6325], 1");
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				asm("outsb");
				 *0x41462220 =  *0x41462220 & 0x000000b9;
				_t55 =  *0x41462220;
				if(_t55 >= 0) {
					L9:
					 *_t31 =  *_t31 + _t31;
					goto L10;
				} else {
					if(_t55 < 0) {
						L8:
						 *((intOrPtr*)(_t50 - 0x56)) =  *((intOrPtr*)(_t50 - 0x56)) + _t34;
						goto L9;
					} else {
						if(_t55 < 0) {
							L7:
							 *_t31 =  *_t31 + _t31;
							 *_t31 =  *_t31 + _t31;
							 *_t31 =  *_t31 + _t31;
							goto L8;
						} else {
							asm("outsd");
							if(_t55 == 0) {
								L10:
								 *(_t38 + 0x9000000) =  *(_t38 + 0x9000000) ^ _t38;
								_t41[0x19] = _t41[0x19] + _t38;
								goto L11;
							} else {
								asm("insd");
								if(_t55 == 0) {
									L11:
									_t41 = _t41 - 1;
									_t62 = _t41;
									if(_t62 < 0) {
										_push(0x6c);
										if(_t62 < 0) {
											 *0x46000801 =  *0x46000801 + _t38;
											goto L14;
										}
										goto L17;
									}
								} else {
									 *_t31 =  *_t31 ^ _t31;
									_pop(es);
									if( *_t31 >= 0) {
										L14:
										_t48 = _t41[0x19] * 0x676e696c;
										 *_t38 =  *_t38 + _t34;
										 *_t31 =  *_t31 + _t31;
										_t42 =  &(_t41[0]);
										 *_t38 =  *_t38 + _t31;
										asm("out 0xa8, al");
										 *_t31 =  *_t31 + _t31;
										asm("insb");
										if ( *_t31 == 0) goto L15;
										 *((intOrPtr*)(_t42 + _t34 + 0x4d)) =  *((intOrPtr*)(_t42 + _t34 + 0x4d)) + _t31;
										asm("fisubr word [eax]");
										 *_t31 =  *_t31 + _t31;
										if ( *_t31 <= 0) goto L16;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 - _t31;
										 *_t31 =  *_t31 + _t31;
										asm("adc [ecx], al");
										 *_t31 =  *_t31 + _t31;
										L17:
										 *_t38 =  *_t38 + _t31;
										 *((intOrPtr*)(_t31 + _t31)) =  *((intOrPtr*)(_t31 + _t31)) + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										_push(0xa8);
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *((intOrPtr*)(_t44 - 0x43)) =  *((intOrPtr*)(_t44 - 0x43)) + _t38;
										_t31 = 0xce7fc900;
										 *0xc1b1ed00 =  *0xc1b1ed00 << 1;
										 *((intOrPtr*)(_t48 - 2)) =  *((intOrPtr*)(_t48 - 2)) + _t38 + _t34;
										asm("clc");
										 *((intOrPtr*)(_t50 - 0x41ffb2b9)) =  *((intOrPtr*)(_t50 - 0x41ffb2b9)) + _t34;
									} else {
										asm("adc [ecx+0x5a], dl");
										asm("lahf");
										 *((intOrPtr*)(_t50 - 0x50)) =  *((intOrPtr*)(_t50 - 0x50)) + 0x2201f807;
										asm("jecxz 0xffffffb0");
										asm("lds eax, [eax]");
										asm("movsd");
										asm("in al, dx");
										asm("fisubr dword [ecx+ecx*2]");
										_t38 = 0x30;
										asm("enter 0x1563, 0x6b");
										_t44 = __edi *  *__edx - 1;
										asm("lodsd");
										_t32 = _t31;
										asm("stosb");
										 *((intOrPtr*)(_t32 - 0x2d)) =  *((intOrPtr*)(_t32 - 0x2d)) + _t32;
										_t31 = 0x000000b9 ^  *0xFFFFFFFFB711CF96;
										_t34 = _t32;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										 *_t31 =  *_t31 + _t31;
										goto L7;
									}
								}
							}
						}
					}
				}
				 *((intOrPtr*)(_t48 + 0x22009d8f)) =  *((intOrPtr*)(_t48 + 0x22009d8f)) + _t34;
				asm("sti");
				asm("jecxz 0x2");
				return _t31;
			}

0x004017b0
0x004017b0
0x004017b0
0x004017b5
0x004017ba
0x004017bc
0x004017be
0x004017c0
0x004017c2
0x004017c4
0x004017c5
0x004017c7
0x004017c9
0x004017cb
0x004017cd
0x004017d3
0x004017d4
0x004017d6
0x004017d7
0x004017d8
0x004017de
0x004017e0
0x004017e2
0x004017e4
0x004017e6
0x004017e7
0x004017e7
0x004017ed
0x00401863
0x00401863
0x00000000
0x004017ef
0x004017ef
0x00401860
0x00401860
0x00000000
0x004017f1
0x004017f1
0x0040185b
0x0040185b
0x0040185d
0x0040185f
0x00000000
0x004017f3
0x004017f3
0x004017f4
0x00401865
0x00401865
0x0040186b
0x00000000
0x004017f6
0x004017f6
0x004017f7
0x0040186c
0x0040186c
0x0040186c
0x0040186d
0x00401870
0x00401873
0x00401875
0x00000000
0x00401875
0x00000000
0x00401873
0x004017fa
0x0040180a
0x0040180c
0x0040180d
0x0040187a
0x0040187b
0x00401882
0x00401884
0x00401886
0x00401887
0x00401889
0x0040188b
0x0040188d
0x0040188e
0x00401894
0x00401897
0x0040189d
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018ae
0x004018ae
0x004018b0
0x004018b3
0x004018b5
0x004018b7
0x004018bc
0x004018be
0x004018c0
0x004018c2
0x004018c4
0x004018c6
0x004018c8
0x004018ca
0x004018cd
0x004018d4
0x004018da
0x004018dd
0x004018de
0x0040180f
0x0040180f
0x00401812
0x00401813
0x0040181a
0x0040181c
0x0040181e
0x0040181f
0x00401822
0x00401825
0x00401827
0x0040182e
0x0040182f
0x00401836
0x00401838
0x00401839
0x0040183c
0x0040183c
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401845
0x00401847
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x00401859
0x00000000
0x00401859
0x0040180d
0x004017f7
0x004017f4
0x004017f1
0x004017ef
0x004018e2
0x004018e8
0x004018e9
0x004018eb

APIs

#100.MSVBVM60(VB5!6&*), ref: 004017B5

Strings

VB5!6&*, xrefs: 004017B0

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 6007475514c40ec07619d88debb2e7b35a20a99b07795e18fd4e59f299c27e87
Instruction ID: 3a7710c2331fd6e34075427bab75eb08442ac9ea950d2935770e04e58b47077c
Opcode Fuzzy Hash: 6007475514c40ec07619d88debb2e7b35a20a99b07795e18fd4e59f299c27e87
Instruction Fuzzy Hash: 5741222644E7C44FE303A73449266557FB1AE23354B1A88EBC4C1EF0F3D26A190AD76A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2C8, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f281314705c0518f252b46a962bc845430335c15cfca23171f9883f10e3b91
Instruction ID: 264ad27160033da00f90da832736c60df22e90d8c05ed6a1830901b41334258e
Opcode Fuzzy Hash: c2f281314705c0518f252b46a962bc845430335c15cfca23171f9883f10e3b91
Instruction Fuzzy Hash: 2FB01220F84001AAD20087D4CD4142331C0D6403C03204C7BFC12E52D0DAB8CC04827E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A62460, Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

TI, xrefs: 02A60874
Msi.dll, xrefs: 02A6402E
[M, xrefs: 02A608E3

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID: Msi.dll$TI$[M
API String ID: 0-3671584619
Opcode ID: 72ee3f1d8f700fa3224fdf9959e7dcefa6a63837f8272b1cb53a8e14356d48f5
Instruction ID: ff043064742fcad99aa2319ad7d7c55a0ad4768830386bc2a18d4ee12885ce18
Opcode Fuzzy Hash: 72ee3f1d8f700fa3224fdf9959e7dcefa6a63837f8272b1cb53a8e14356d48f5
Instruction Fuzzy Hash: F3716A30694301AFEF216F348D9CBF9B7A5AF067A8F514106FD426B1D0DFA48885CA41

Uniqueness

Uniqueness Score: -1.00%

Function 02A61B93, Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f83a9c2c669ed9ab162687f3f05dc1445d93ddc92f05b5a32f7e5d7b077b8e2
Instruction ID: aed8f76f2bbe7407304103b2119164991bb25ecb1957350540672d108b152512
Opcode Fuzzy Hash: 5f83a9c2c669ed9ab162687f3f05dc1445d93ddc92f05b5a32f7e5d7b077b8e2
Instruction Fuzzy Hash: 86F11171B44702EFD7149F28CDD8BF6B3A2BF05750F984229EC9993280DF64A885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A6218F, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a667332098472edcb4201665b362ec7f6ea01f0fff1889d82e99ec21b029a91
Instruction ID: 46ca5e3d23167f41ca9056a5f2176636380037da6a2aafec30a39c7ae84ef590
Opcode Fuzzy Hash: 8a667332098472edcb4201665b362ec7f6ea01f0fff1889d82e99ec21b029a91
Instruction Fuzzy Hash: CC41F572684601EBCB285A2CCD8DFF573B5FF05B60F144329AC69A3291DF14A889CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02A62463, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23089c1d0126be034a94bdeb2609becc07bdfb745987ff01c5509423e8e1103e
Instruction ID: edc70823a79bb89e93ef7967f35944fd32da2dda8af01cd7b14b61670e8f0839
Opcode Fuzzy Hash: 23089c1d0126be034a94bdeb2609becc07bdfb745987ff01c5509423e8e1103e
Instruction Fuzzy Hash: E8313430A80701EFEF215F288EADBF4B7B1EF05B58F554159EE422B5E2CB758485CA12

Uniqueness

Uniqueness Score: -1.00%

Function 02A6249B, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bbf8e691c0e2a33216053fb20be29d405a3d65ec7a38da12ba8f71d412e447
Instruction ID: d5a22bd27df3fc3d78f301172e9360c40ec1591567c2f142073cd4e5effb5f44
Opcode Fuzzy Hash: 01bbf8e691c0e2a33216053fb20be29d405a3d65ec7a38da12ba8f71d412e447
Instruction Fuzzy Hash: A221F530A90701EBEF216F288E6DFF4B7B1EF01B58F554155EE412B5E2CB718485CA16

Uniqueness

Uniqueness Score: -1.00%

Function 02A658C4, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8ae57f8f1782742d4c10a56093baa8ae7af659460ec148c93265f6032c050
Instruction ID: 6550be363e87fb54476e717076035485d872be9dc1eaf6407462a70cd200ec43
Opcode Fuzzy Hash: 05b8ae57f8f1782742d4c10a56093baa8ae7af659460ec148c93265f6032c050
Instruction Fuzzy Hash: 0AF09A36A14201CFC725CB14C6CCB7A73B1AF49760F9185A9E80287214DB20DC44CA21

Uniqueness

Uniqueness Score: -1.00%

Function 02A65695, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208a0bbfa4563cffe0581b4c12143e2513d8e33e13db78426830538cd02fe3d5
Instruction ID: 79f91772d671926aec8843796d2814d2508bdd62a2084b206a5b2c139a8384e6
Opcode Fuzzy Hash: 208a0bbfa4563cffe0581b4c12143e2513d8e33e13db78426830538cd02fe3d5
Instruction Fuzzy Hash: 81E06858A90B16DAEE1A110C4E7A7F133B1EA072A0DF8347ECD83529039706C58F8482

Uniqueness

Uniqueness Score: -1.00%

Function 02A632A5, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b434eb99fcd26a5edbbc6b3fd785ea5a5d96bf059d4fbfbff9dfa5cb0aa984
Instruction ID: 92a0d8bf04734df265e1556160a4b41598a5b600f794ed14d826b2dd352c111e
Opcode Fuzzy Hash: b8b434eb99fcd26a5edbbc6b3fd785ea5a5d96bf059d4fbfbff9dfa5cb0aa984
Instruction Fuzzy Hash: E1D09E666816849BEF15DE08C967BC0B3F0AB15A88F4511E89D01DBB13D215E9198745

Uniqueness

Uniqueness Score: -1.00%

Function 02A632A2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a6b9effe40c6b35e367252bc8ae8b021696d348c26a15aa7019ee57b5c1d87
Instruction ID: 58872a6b07a31351b22ae11b276cda81026a342946e03e694df5b522b7e838f4
Opcode Fuzzy Hash: d1a6b9effe40c6b35e367252bc8ae8b021696d348c26a15aa7019ee57b5c1d87
Instruction Fuzzy Hash: F5C04CB67416808FEF05CE14C585B9073B4AB26E88B0944D8D842DB612C314E905C700

Uniqueness

Uniqueness Score: -1.00%

Function 02A65169, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.743758094.0000000002A60000.00000040.00000001.sdmp, Offset: 02A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aedc46e298cfa233abc682b5d317c704000b7a9340072a53758e1ae734737be
Instruction ID: af79cad872ef90245eaff777101cb0908b8ccb611861b9bf4b2e270e1dc3e31a
Opcode Fuzzy Hash: 2aedc46e298cfa233abc682b5d317c704000b7a9340072a53758e1ae734737be
Instruction Fuzzy Hash: 41B09274716680CFC669CA08C180E24B3B0B744600B514490E4138BA11CB24E800C900

Uniqueness

Uniqueness Score: -1.00%

Function 004147A9, Relevance: 55.9, APIs: 37, Instructions: 353
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E004147A9(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v64;
				char _v72;
				char _v80;
				char _v88;
				char* _v96;
				char _v104;
				intOrPtr _v112;
				char _v120;
				char _v124;
				char _v128;
				void* _v132;
				signed int _v136;
				char _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				signed int _v156;
				intOrPtr* _v168;
				signed int _v172;
				intOrPtr* _v176;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				char _v192;
				intOrPtr _v196;
				char _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				intOrPtr* _v216;
				signed int _v220;
				short _t154;
				char* _t162;
				char* _t166;
				signed int _t170;
				char* _t171;
				char* _t180;
				signed int _t184;
				char* _t188;
				signed int _t192;
				char* _t197;
				signed int _t201;
				char* _t202;
				signed int _t205;
				char* _t212;
				intOrPtr _t228;
				void* _t235;
				void* _t237;
				intOrPtr _t238;
				void* _t243;
				signed int _t251;
				char _t255;
				char _t257;
				void* _t258;

				_t238 = _t237 - 0xc;
				 *[fs:0x0] = _t238;
				L00401550();
				_v16 = _t238;
				_v12 = 0x401530;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401556, _t235);
				L00401688();
				_v96 =  &_v36;
				_v104 = 0x4008;
				_push( &_v104);
				_push( &_v72);
				L004015F8();
				_v112 = 0x40dbfc;
				_v120 = 0x8008;
				_push( &_v72);
				_t154 =  &_v120;
				_push(_t154);
				L004016A0();
				_v132 = _t154;
				_t212 =  &_v72;
				L00401760();
				if(_v132 != 0) {
					if( *0x416010 != 0) {
						_v168 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v168 = 0x416010;
					}
					_t180 =  &_v44;
					L0040178A();
					_v132 = _t180;
					_t184 =  *((intOrPtr*)( *_v132 + 0x170))(_v132,  &_v124, _t180,  *((intOrPtr*)( *((intOrPtr*)( *_v168)) + 0x2fc))( *_v168));
					asm("fclex");
					_v136 = _t184;
					if(_v136 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x170);
						_push(0x40d8ec);
						_push(_v132);
						_push(_v136);
						L00401790();
						_v172 = _t184;
					}
					if( *0x416010 != 0) {
						_v176 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v176 = 0x416010;
					}
					_t188 =  &_v48;
					L0040178A();
					_v140 = _t188;
					_t192 =  *((intOrPtr*)( *_v140 + 0x168))(_v140,  &_v52, _t188,  *((intOrPtr*)( *((intOrPtr*)( *_v176)) + 0x300))( *_v176));
					asm("fclex");
					_v144 = _t192;
					if(_v144 >= 0) {
						_v180 = _v180 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x40d930);
						_push(_v140);
						_push(_v144);
						L00401790();
						_v180 = _t192;
					}
					_push(0);
					_push(0);
					_push(_v52);
					_push( &_v72);
					L00401748();
					_t243 = _t238 + 0x10;
					if( *0x416010 != 0) {
						_v184 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v184 = 0x416010;
					}
					_t228 =  *((intOrPtr*)( *_v184));
					_t197 =  &_v56;
					L0040178A();
					_v148 = _t197;
					_t201 =  *((intOrPtr*)( *_v148 + 0x128))(_v148,  &_v128, _t197,  *((intOrPtr*)(_t228 + 0x304))( *_v184));
					asm("fclex");
					_v152 = _t201;
					if(_v152 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x40d8dc);
						_push(_v148);
						_push(_v152);
						L00401790();
						_v188 = _t201;
					}
					L004016F4();
					asm("fild dword [ebp-0x7c]");
					_v192 =  *0x401528;
					_t257 = _v192;
					_v124 = _t257;
					_t202 =  &_v72;
					L00401742();
					_v196 = _t202;
					asm("fild dword [ebp-0xc0]");
					_v200 = _t257;
					_t258 = _v200;
					_v132 = _t258;
					asm("fild dword [ebp-0x78]");
					_v204 = _t258;
					_v136 = _v204;
					_t255 =  *0x401520;
					_v140 = _t255;
					_t205 =  *((intOrPtr*)( *_a4 + 0x2c8))(_a4, 6, _t228, _t228, _t228, _t202, _t228, _t201);
					asm("fclex");
					_v156 = _t205;
					_t251 = _v156;
					if(_t251 >= 0) {
						_v208 = _v208 & 0x00000000;
					} else {
						_push(0x2c8);
						_push(0x40d0c8);
						_push(_a4);
						_push(_v156);
						L00401790();
						_v208 = _t205;
					}
					_push( &_v52);
					_push( &_v56);
					_push( &_v48);
					_push( &_v44);
					_push(4);
					L0040173C();
					_t238 = _t243 + 0x14;
					_t212 =  &_v72;
					L00401760();
				}
				_v80 = 0x80020004;
				_v88 = 0xa;
				_v64 = 0x80020004;
				_v72 = 0xa;
				_push( &_v88);
				_push( &_v72);
				asm("fld1");
				_push(_t212);
				_push(_t212);
				_v72 = _t255;
				asm("fld1");
				_push(_t212);
				_push(_t212);
				_v80 = _t255;
				asm("fld1");
				_push(_t212);
				_push(_t212);
				_v88 = _t255;
				L004015F2();
				L00401778();
				asm("fcomp qword [0x4014b8]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t251 == 0) {
					_v212 = _v212 & 0x00000000;
				} else {
					_v212 = 1;
				}
				_v132 =  ~_v212;
				_push( &_v88);
				_push( &_v72);
				_push(2);
				L00401754();
				_t162 = _v132;
				if(_t162 != 0) {
					if( *0x416010 != 0) {
						_v216 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v216 = 0x416010;
					}
					_t166 =  &_v44;
					L0040178A();
					_v132 = _t166;
					_t170 =  *((intOrPtr*)( *_v132 + 0x1b8))(_v132,  &_v48, _t166,  *((intOrPtr*)( *((intOrPtr*)( *_v216)) + 0x2fc))( *_v216));
					asm("fclex");
					_v136 = _t170;
					if(_v136 >= 0) {
						_v220 = _v220 & 0x00000000;
					} else {
						_push(0x1b8);
						_push(0x40d8ec);
						_push(_v132);
						_push(_v136);
						L00401790();
						_v220 = _t170;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(_v48);
					_t171 =  &_v72;
					_push(_t171);
					L00401748();
					_push(_t171);
					L004016AC();
					L0040176C();
					_push(_t171);
					_push( &_v88);
					L004015EC();
					_push(0x10);
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v28);
					L00401706();
					L0040174E();
					_push( &_v48);
					_push( &_v44);
					_push(2);
					L0040173C();
					_push( &_v88);
					_t162 =  &_v72;
					_push(_t162);
					_push(2);
					L00401754();
				}
				_v32 = 0x1a0bc3;
				asm("wait");
				_push(0x414d09);
				L0040177E();
				L0040174E();
				return _t162;
			}

0x004147ac
0x004147bb
0x004147c7
0x004147cf
0x004147d2
0x004147d9
0x004147e8
0x004147f3
0x004147fb
0x004147fe
0x00414808
0x0041480c
0x0041480d
0x00414812
0x00414819
0x00414823
0x00414824
0x00414827
0x00414828
0x0041482d
0x00414831
0x00414834
0x0041483f
0x0041484c
0x00414869
0x0041484e
0x0041484e
0x00414853
0x00414858
0x0041485d
0x0041485d
0x0041488d
0x00414891
0x00414896
0x004148a5
0x004148ab
0x004148ad
0x004148ba
0x004148dc
0x004148bc
0x004148bc
0x004148c1
0x004148c6
0x004148c9
0x004148cf
0x004148d4
0x004148d4
0x004148ea
0x00414907
0x004148ec
0x004148ec
0x004148f1
0x004148f6
0x004148fb
0x004148fb
0x0041492b
0x0041492f
0x00414934
0x0041494c
0x00414952
0x00414954
0x00414961
0x00414986
0x00414963
0x00414963
0x00414968
0x0041496d
0x00414973
0x00414979
0x0041497e
0x0041497e
0x0041498d
0x0041498f
0x00414991
0x00414997
0x00414998
0x0041499d
0x004149a7
0x004149c4
0x004149a9
0x004149a9
0x004149ae
0x004149b3
0x004149b8
0x004149b8
0x004149de
0x004149e8
0x004149ec
0x004149f1
0x00414a09
0x00414a0f
0x00414a11
0x00414a1e
0x00414a43
0x00414a20
0x00414a20
0x00414a25
0x00414a2a
0x00414a30
0x00414a36
0x00414a3b
0x00414a3b
0x00414a50
0x00414a56
0x00414a59
0x00414a5f
0x00414a66
0x00414a69
0x00414a6d
0x00414a72
0x00414a78
0x00414a7e
0x00414a84
0x00414a8b
0x00414a8e
0x00414a91
0x00414a9e
0x00414aa1
0x00414aa8
0x00414ab5
0x00414abb
0x00414abd
0x00414ac3
0x00414aca
0x00414aec
0x00414acc
0x00414acc
0x00414ad1
0x00414ad6
0x00414ad9
0x00414adf
0x00414ae4
0x00414ae4
0x00414af6
0x00414afa
0x00414afe
0x00414b02
0x00414b03
0x00414b05
0x00414b0a
0x00414b0d
0x00414b10
0x00414b10
0x00414b15
0x00414b1c
0x00414b23
0x00414b2a
0x00414b34
0x00414b38
0x00414b39
0x00414b3b
0x00414b3c
0x00414b3d
0x00414b40
0x00414b42
0x00414b43
0x00414b44
0x00414b47
0x00414b49
0x00414b4a
0x00414b4b
0x00414b4e
0x00414b53
0x00414b58
0x00414b5e
0x00414b60
0x00414b61
0x00414b6f
0x00414b63
0x00414b63
0x00414b63
0x00414b7e
0x00414b85
0x00414b89
0x00414b8a
0x00414b8c
0x00414b94
0x00414b9a
0x00414ba7
0x00414bc4
0x00414ba9
0x00414ba9
0x00414bae
0x00414bb3
0x00414bb8
0x00414bb8
0x00414be8
0x00414bec
0x00414bf1
0x00414c00
0x00414c06
0x00414c08
0x00414c15
0x00414c37
0x00414c17
0x00414c17
0x00414c1c
0x00414c21
0x00414c24
0x00414c2a
0x00414c2f
0x00414c2f
0x00414c3e
0x00414c40
0x00414c42
0x00414c44
0x00414c47
0x00414c4a
0x00414c4b
0x00414c53
0x00414c54
0x00414c5e
0x00414c63
0x00414c67
0x00414c68
0x00414c6d
0x00414c70
0x00414c7a
0x00414c7b
0x00414c7c
0x00414c7d
0x00414c7e
0x00414c80
0x00414c83
0x00414c8b
0x00414c93
0x00414c97
0x00414c98
0x00414c9a
0x00414ca5
0x00414ca6
0x00414ca9
0x00414caa
0x00414cac
0x00414cb1
0x00414cb4
0x00414cbb
0x00414cbc
0x00414cfb
0x00414d03
0x00414d08

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 004147C7
__vbaStrCopy.MSVBVM60(?,?,?,?,00401556), ref: 004147F3
#524.MSVBVM60(?,00004008), ref: 0041480D
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,00004008), ref: 00414828
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,00004008), ref: 00414834
__vbaNew2.MSVBVM60(0040C818,00416010,00008008,?,?,?,?,00004008), ref: 00414858
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00414891
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8EC,00000170,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 004148CF
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 004148F6
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0041492F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D930,00000168), ref: 00414979
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00414998
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,00401556), ref: 004149B3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004149EC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8DC,00000128), ref: 00414A36
__vbaFpI4.MSVBVM60(00000000,?,0040D8DC,00000128), ref: 00414A50
__vbaI4Var.MSVBVM60(?,?,00000000), ref: 00414A6D
__vbaHresultCheckObj.MSVBVM60(00000000,00401530,0040D0C8,000002C8,?,?,?,?,?,00000000), ref: 00414ADF
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,?,?,?,00000000), ref: 00414B05
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,00401556), ref: 00414B10
#676.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A,00008008,?,?,?,?,00004008), ref: 00414B4E
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A,00008008,?,?,?,?,00004008), ref: 00414B53
__vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A), ref: 00414B8C
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,00401556), ref: 00414BB3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414BEC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8EC,000001B8), ref: 00414C2A
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,00000000), ref: 00414C4B
__vbaStrVarMove.MSVBVM60(00000000,?,?,?,?,?,?,00401556), ref: 00414C54
__vbaStrMove.MSVBVM60(00000000,?,?,?,?,?,?,00401556), ref: 00414C5E
#716.MSVBVM60(?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414C68
__vbaChkstk.MSVBVM60(?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414C70
__vbaLateIdSt.MSVBVM60(?,00000000,?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414C83
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414C8B
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414C9A
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 00414CAC
__vbaFreeObj.MSVBVM60(00414D09), ref: 00414CFB
__vbaFreeStr.MSVBVM60(00414D09), ref: 00414D03

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ListNew2$Late$CallChkstkMove$#524#676#716Copy
String ID:
API String ID: 918814116-0
Opcode ID: 5b38c296cf7e9700d21e46e426603d1d85562541846e8f19f77bd6325d176018
Instruction ID: 98186599713cddfbee69deaf6ddfcebba8a31ee388844f29f3b536ba564d951a
Opcode Fuzzy Hash: 5b38c296cf7e9700d21e46e426603d1d85562541846e8f19f77bd6325d176018
Instruction Fuzzy Hash: F0E12D71900218EFDB10EFA0CD45BDEBBB8BF48304F1045AAE149B71A1DB799A84DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00414D30, Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00414D30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				void* _v32;
				char _v36;
				char _v40;
				signed int _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				signed int _v84;
				void* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				intOrPtr* _v104;
				signed int _v108;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v172;
				signed int _t157;
				signed int _t162;
				signed int _t168;
				signed int _t173;
				char* _t174;
				char* _t178;
				signed int _t182;
				char* _t186;
				signed int _t190;
				signed int _t196;
				signed int _t201;
				void* _t223;
				void* _t225;
				intOrPtr _t226;
				signed int _t234;

				_t226 = _t225 - 0xc;
				 *[fs:0x0] = _t226;
				L00401550();
				_v16 = _t226;
				_v12 = 0x401540;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401556, _t223);
				if( *0x416408 != 0) {
					_v124 = 0x416408;
				} else {
					_push(0x416408);
					_push(0x40d854);
					L00401784();
					_v124 = 0x416408;
				}
				_v80 =  *_v124;
				_t157 =  *((intOrPtr*)( *_v80 + 0x14))(_v80,  &_v48);
				asm("fclex");
				_v84 = _t157;
				if(_v84 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d844);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v128 = _t157;
				}
				_v88 = _v48;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L00401550();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t162 =  *((intOrPtr*)( *_v88 + 0x13c))(_v88, L"beredskabslageretserotis", 0x10);
				asm("fclex");
				_v92 = _t162;
				if(_v92 >= 0) {
					_v132 = _v132 & 0x00000000;
				} else {
					_push(0x13c);
					_push(0x40dab0);
					_push(_v88);
					_push(_v92);
					L00401790();
					_v132 = _t162;
				}
				L0040177E();
				if( *0x416408 != 0) {
					_v136 = 0x416408;
				} else {
					_push(0x416408);
					_push(0x40d854);
					L00401784();
					_v136 = 0x416408;
				}
				_v80 =  *_v136;
				_t168 =  *((intOrPtr*)( *_v80 + 0x14))(_v80,  &_v48);
				asm("fclex");
				_v84 = _t168;
				if(_v84 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d844);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v140 = _t168;
				}
				_v88 = _v48;
				_t173 =  *((intOrPtr*)( *_v88 + 0x140))(_v88,  &_v76);
				asm("fclex");
				_v92 = _t173;
				_t234 = _v92;
				if(_t234 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x40dab0);
					_push(_v88);
					_push(_v92);
					L00401790();
					_v144 = _t173;
				}
				_t174 = _v76;
				_v28 = _t174;
				L0040177E();
				asm("fld1");
				L004015C2();
				L00401778();
				asm("fcomp qword [0x401418]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t234 != 0) {
					if( *0x416010 != 0) {
						_v148 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v148 = 0x416010;
					}
					_t178 =  &_v48;
					L0040178A();
					_v80 = _t178;
					_t182 =  *((intOrPtr*)( *_v80 + 0x1e0))(_v80,  &_v36, _t178,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x2fc))( *_v148));
					asm("fclex");
					_v84 = _t182;
					if(_v84 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x40d8ec);
						_push(_v80);
						_push(_v84);
						L00401790();
						_v152 = _t182;
					}
					if( *0x416010 != 0) {
						_v156 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v156 = 0x416010;
					}
					_t186 =  &_v52;
					L0040178A();
					_v88 = _t186;
					_t190 =  *((intOrPtr*)( *_v88 + 0xf8))(_v88, 0,  &_v40, _t186,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x30c))( *_v156));
					asm("fclex");
					_v92 = _t190;
					if(_v92 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x40d8a0);
						_push(_v88);
						_push(_v92);
						L00401790();
						_v160 = _t190;
					}
					if( *0x416408 != 0) {
						_v164 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v164 = 0x416408;
					}
					_v96 =  *_v164;
					_t196 =  *((intOrPtr*)( *_v96 + 0x4c))(_v96,  &_v56);
					asm("fclex");
					_v100 = _t196;
					if(_v100 >= 0) {
						_v168 = _v168 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x40d844);
						_push(_v96);
						_push(_v100);
						L00401790();
						_v168 = _t196;
					}
					_v104 = _v56;
					_t201 =  *((intOrPtr*)( *_v104 + 0x24))(_v104, _v36, _v40,  &_v44);
					asm("fclex");
					_v108 = _t201;
					if(_v108 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x24);
						_push(0x40d864);
						_push(_v104);
						_push(_v108);
						L00401790();
						_v172 = _t201;
					}
					_v120 = _v44;
					_v44 = _v44 & 0x00000000;
					L0040176C();
					_push( &_v40);
					_push( &_v36);
					_push(2);
					L004016FA();
					_push( &_v56);
					_push( &_v52);
					_t174 =  &_v48;
					_push(_t174);
					_push(3);
					L0040173C();
				}
				asm("wait");
				_push(0x415188);
				L0040174E();
				return _t174;
			}

0x00414d33
0x00414d42
0x00414d4e
0x00414d56
0x00414d59
0x00414d60
0x00414d6f
0x00414d79
0x00414d93
0x00414d7b
0x00414d7b
0x00414d80
0x00414d85
0x00414d8a
0x00414d8a
0x00414d9f
0x00414dae
0x00414db1
0x00414db3
0x00414dba
0x00414dd3
0x00414dbc
0x00414dbc
0x00414dbe
0x00414dc3
0x00414dc6
0x00414dc9
0x00414dce
0x00414dce
0x00414dda
0x00414ddd
0x00414de4
0x00414dee
0x00414df8
0x00414df9
0x00414dfa
0x00414dfb
0x00414e09
0x00414e0f
0x00414e11
0x00414e18
0x00414e34
0x00414e1a
0x00414e1a
0x00414e1f
0x00414e24
0x00414e27
0x00414e2a
0x00414e2f
0x00414e2f
0x00414e3b
0x00414e47
0x00414e64
0x00414e49
0x00414e49
0x00414e4e
0x00414e53
0x00414e58
0x00414e58
0x00414e76
0x00414e85
0x00414e88
0x00414e8a
0x00414e91
0x00414ead
0x00414e93
0x00414e93
0x00414e95
0x00414e9a
0x00414e9d
0x00414ea0
0x00414ea5
0x00414ea5
0x00414eb7
0x00414ec6
0x00414ecc
0x00414ece
0x00414ed1
0x00414ed5
0x00414ef4
0x00414ed7
0x00414ed7
0x00414edc
0x00414ee1
0x00414ee4
0x00414ee7
0x00414eec
0x00414eec
0x00414efb
0x00414eff
0x00414f06
0x00414f0b
0x00414f0d
0x00414f12
0x00414f17
0x00414f1d
0x00414f1f
0x00414f20
0x00414f2d
0x00414f4a
0x00414f2f
0x00414f2f
0x00414f34
0x00414f39
0x00414f3e
0x00414f3e
0x00414f6e
0x00414f72
0x00414f77
0x00414f86
0x00414f8c
0x00414f8e
0x00414f95
0x00414fb4
0x00414f97
0x00414f97
0x00414f9c
0x00414fa1
0x00414fa4
0x00414fa7
0x00414fac
0x00414fac
0x00414fc2
0x00414fdf
0x00414fc4
0x00414fc4
0x00414fc9
0x00414fce
0x00414fd3
0x00414fd3
0x00415003
0x00415007
0x0041500c
0x0041501d
0x00415023
0x00415025
0x0041502c
0x0041504b
0x0041502e
0x0041502e
0x00415033
0x00415038
0x0041503b
0x0041503e
0x00415043
0x00415043
0x00415059
0x00415076
0x0041505b
0x0041505b
0x00415060
0x00415065
0x0041506a
0x0041506a
0x00415088
0x00415097
0x0041509a
0x0041509c
0x004150a3
0x004150bf
0x004150a5
0x004150a5
0x004150a7
0x004150ac
0x004150af
0x004150b2
0x004150b7
0x004150b7
0x004150c9
0x004150de
0x004150e1
0x004150e3
0x004150ea
0x00415106
0x004150ec
0x004150ec
0x004150ee
0x004150f3
0x004150f6
0x004150f9
0x004150fe
0x004150fe
0x00415110
0x00415113
0x0041511d
0x00415125
0x00415129
0x0041512a
0x0041512c
0x00415137
0x0041513b
0x0041513c
0x0041513f
0x00415140
0x00415142
0x00415147
0x0041514a
0x0041514b
0x00415182
0x00415187

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00414D4E
__vbaNew2.MSVBVM60(0040D854,00416408,?,?,?,?,00401556), ref: 00414D85
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000014), ref: 00414DC9
__vbaChkstk.MSVBVM60(00000000,?,0040D844,00000014), ref: 00414DEE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DAB0,0000013C), ref: 00414E2A
__vbaFreeObj.MSVBVM60(00000000,?,0040DAB0,0000013C), ref: 00414E3B
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 00414E53
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000014), ref: 00414EA0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DAB0,00000140), ref: 00414EE7
__vbaFreeObj.MSVBVM60(00000000,?,0040DAB0,00000140), ref: 00414F06
_CIlog.MSVBVM60(00000000,?,0040DAB0,00000140), ref: 00414F0D
__vbaFpR8.MSVBVM60(00000000,?,0040DAB0,00000140), ref: 00414F12
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 00414F39
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414F72
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8EC,000001E0), ref: 00414FA7
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 00414FCE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415007
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8A0,000000F8), ref: 0041503E
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 00415065
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000004C), ref: 004150B2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D864,00000024), ref: 004150F9
__vbaStrMove.MSVBVM60(00000000,?,0040D864,00000024), ref: 0041511D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041512C
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,00401556), ref: 00415142
__vbaFreeStr.MSVBVM60(00415188), ref: 00415182

Strings

beredskabslageretserotis, xrefs: 00414DFC

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$ChkstkList$IlogMove
String ID: beredskabslageretserotis
API String ID: 3953314252-1729175064
Opcode ID: 8cdfe08c5e4cfc32ea681178cda6e205eddae5bb59224b91858298ee19f52ccd
Instruction ID: b83bd634875e2fa59fd438d6f63cf46260812abf897a0b666b4436be0759664b
Opcode Fuzzy Hash: 8cdfe08c5e4cfc32ea681178cda6e205eddae5bb59224b91858298ee19f52ccd
Instruction Fuzzy Hash: 03D1DF75D00218EFDB10EFE4C945BDDBBB5BB48304F20806AE106BB2A1D7799989DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004130E3, Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004130E3(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v44;
				char _v52;
				char* _v60;
				char _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				short _v88;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr* _v120;
				signed int _v124;
				void* _t94;
				char* _t98;
				signed int _t101;
				signed int _t107;
				signed int _t112;
				char* _t116;
				char* _t120;
				signed int _t124;
				intOrPtr _t154;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t154;
				_t94 = 0x68;
				L00401550();
				_v12 = _t154;
				_v8 = 0x401450;
				L00401688();
				_push(1);
				L00401682();
				if(_t94 != 0x800000) {
					_v60 = L"boardingkortene";
					_v68 = 8;
					L004016DC();
					_push( &_v52);
					L004016BE();
					L0040176C();
					L00401760();
				}
				if( *0x416010 != 0) {
					_v100 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v100 = 0x416010;
				}
				_t98 =  &_v36;
				L0040178A();
				_v72 = _t98;
				_t101 =  *((intOrPtr*)( *_v72 + 0x128))(_v72, _t98,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x314))( *_v100));
				asm("fclex");
				_v76 = _t101;
				if(_v76 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40d8b0);
					_push(_v72);
					_push(_v76);
					L00401790();
					_v104 = _t101;
				}
				L0040177E();
				if( *0x416408 != 0) {
					_v108 = 0x416408;
				} else {
					_push(0x416408);
					_push(0x40d854);
					L00401784();
					_v108 = 0x416408;
				}
				_v72 =  *_v108;
				_t107 =  *((intOrPtr*)( *_v72 + 0x14))(_v72,  &_v36);
				asm("fclex");
				_v76 = _t107;
				if(_v76 >= 0) {
					_v112 = _v112 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d844);
					_push(_v72);
					_push(_v76);
					L00401790();
					_v112 = _t107;
				}
				_v80 = _v36;
				_t112 =  *((intOrPtr*)( *_v80 + 0x50))(_v80,  &_v32);
				asm("fclex");
				_v84 = _t112;
				if(_v84 >= 0) {
					_v116 = _v116 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x40dab0);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v116 = _t112;
				}
				_push(_v32);
				_push(0);
				L0040167C();
				asm("sbb eax, eax");
				_v88 =  ~( ~_t112 + 1);
				L0040174E();
				L0040177E();
				_t116 = _v88;
				if(_t116 != 0) {
					if( *0x416010 != 0) {
						_v120 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v120 = 0x416010;
					}
					_t120 =  &_v36;
					L0040178A();
					_v72 = _t120;
					_t124 =  *((intOrPtr*)( *_v72 + 0x170))(_v72,  &_v32, _t120,  *((intOrPtr*)( *((intOrPtr*)( *_v120)) + 0x308))( *_v120));
					asm("fclex");
					_v76 = _t124;
					if(_v76 >= 0) {
						_v124 = _v124 & 0x00000000;
					} else {
						_push(0x170);
						_push(0x40d890);
						_push(_v72);
						_push(_v76);
						L00401790();
						_v124 = _t124;
					}
					_v96 = _v32;
					_v32 = _v32 & 0x00000000;
					_v44 = _v96;
					_v52 = 8;
					_t116 =  &_v52;
					_push(_t116);
					L00401676();
					L0040177E();
					L00401760();
				}
				_push(0x413399);
				L0040174E();
				L0040174E();
				return _t116;
			}

0x004130e8
0x004130f3
0x004130f4
0x004130fd
0x004130fe
0x00413106
0x00413109
0x00413116
0x0041311b
0x0041311d
0x00413127
0x00413129
0x00413130
0x0041313d
0x00413145
0x00413146
0x00413150
0x00413158
0x00413158
0x00413164
0x0041317e
0x00413166
0x00413166
0x0041316b
0x00413170
0x00413175
0x00413175
0x00413199
0x0041319d
0x004131a2
0x004131ad
0x004131b3
0x004131b5
0x004131bc
0x004131d8
0x004131be
0x004131be
0x004131c3
0x004131c8
0x004131cb
0x004131ce
0x004131d3
0x004131d3
0x004131df
0x004131eb
0x00413205
0x004131ed
0x004131ed
0x004131f2
0x004131f7
0x004131fc
0x004131fc
0x00413211
0x00413220
0x00413223
0x00413225
0x0041322c
0x00413245
0x0041322e
0x0041322e
0x00413230
0x00413235
0x00413238
0x0041323b
0x00413240
0x00413240
0x0041324c
0x0041325b
0x0041325e
0x00413260
0x00413267
0x00413280
0x00413269
0x00413269
0x0041326b
0x00413270
0x00413273
0x00413276
0x0041327b
0x0041327b
0x00413284
0x00413287
0x00413289
0x00413290
0x00413295
0x0041329c
0x004132a4
0x004132a9
0x004132af
0x004132bc
0x004132d6
0x004132be
0x004132be
0x004132c3
0x004132c8
0x004132cd
0x004132cd
0x004132f1
0x004132f5
0x004132fa
0x00413309
0x0041330f
0x00413311
0x00413318
0x00413334
0x0041331a
0x0041331a
0x0041331f
0x00413324
0x00413327
0x0041332a
0x0041332f
0x0041332f
0x0041333b
0x0041333e
0x00413345
0x00413348
0x0041334f
0x00413352
0x00413353
0x0041335b
0x00413363
0x00413363
0x00413368
0x0041338b
0x00413393
0x00413398

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 004130FE
__vbaStrCopy.MSVBVM60(?,?,?,?,00401556), ref: 00413116
#589.MSVBVM60(00000001,?,?,?,?,00401556), ref: 0041311D
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,00000001,?,?,?,?,00401556), ref: 0041313D
#667.MSVBVM60(?,?,?,?,?,?,?,?,?,00000001,?,?,?,?,00401556), ref: 00413146
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,00000001,?,?,?,?,00401556), ref: 00413150
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,00000001,?,?,?,?,00401556), ref: 00413158
__vbaNew2.MSVBVM60(0040C818,00416010,00000001,?,?,?,?,00401556), ref: 00413170
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041319D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8B0,00000128), ref: 004131CE
__vbaFreeObj.MSVBVM60(00000000,?,0040D8B0,00000128), ref: 004131DF
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 004131F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000014), ref: 0041323B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DAB0,00000050), ref: 00413276
__vbaStrCmp.MSVBVM60(00000000,?), ref: 00413289
__vbaFreeStr.MSVBVM60(00000000,?), ref: 0041329C
__vbaFreeObj.MSVBVM60(00000000,?), ref: 004132A4
__vbaNew2.MSVBVM60(0040C818,00416010,00000000,?), ref: 004132C8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004132F5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D890,00000170), ref: 0041332A
#529.MSVBVM60(00000008), ref: 00413353
__vbaFreeObj.MSVBVM60(00000008), ref: 0041335B
__vbaFreeVar.MSVBVM60(00000008), ref: 00413363
__vbaFreeStr.MSVBVM60(00413399,00000000,?), ref: 0041338B
__vbaFreeStr.MSVBVM60(00413399,00000000,?), ref: 00413393

Strings

boardingkortene, xrefs: 00413129

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#529#589#667ChkstkCopyMove
String ID: boardingkortene
API String ID: 3807652779-3768586927
Opcode ID: 4fbb6f9d25ab97cdd10f1b418a1f55d84d85b4fed29f4f4bacd06ad487488c5e
Instruction ID: 3ebfefaa68306112a2ed109e0180f316a7ca72706e18590901ac4e7cdb31d301
Opcode Fuzzy Hash: 4fbb6f9d25ab97cdd10f1b418a1f55d84d85b4fed29f4f4bacd06ad487488c5e
Instruction Fuzzy Hash: 7381C575E40218AFCF10EFE5C945BDDBBB4BF08705F20452AE001BB2A1DB796986CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00413D35, Relevance: 40.8, APIs: 27, Instructions: 269
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00413D35(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				signed int _v32;
				void* _v36;
				intOrPtr _v44;
				char _v52;
				intOrPtr _v60;
				char _v68;
				char _v84;
				char _v100;
				signed int _v124;
				char _v132;
				signed int _v140;
				char _v148;
				void* _v152;
				void* _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				signed int _v200;
				intOrPtr* _v204;
				signed int _v208;
				signed int _v212;
				char* _t129;
				short _t133;
				short _t145;
				signed int _t151;
				signed int _t156;
				char* _t160;
				signed int _t164;
				char* _t168;
				signed int _t172;
				char* _t177;
				void* _t189;
				void* _t191;
				intOrPtr _t192;
				long long* _t193;
				signed int _t201;
				long long _t206;

				_t192 = _t191 - 0xc;
				 *[fs:0x0] = _t192;
				L00401550();
				_v16 = _t192;
				_v12 = 0x4014d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401556, _t189);
				_push(0x40db40);
				L00401628();
				asm("fcomp dword [0x4014c8]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					if( *0x416010 != 0) {
						_v184 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v184 = 0x416010;
					}
					_t168 =  &_v36;
					L0040178A();
					_v156 = _t168;
					_t172 =  *((intOrPtr*)( *_v156 + 0x50))(_v156,  &_v32, _t168,  *((intOrPtr*)( *((intOrPtr*)( *_v184)) + 0x308))( *_v184));
					asm("fclex");
					_v160 = _t172;
					if(_v160 >= 0) {
						_t23 =  &_v188;
						 *_t23 = _v188 & 0x00000000;
						__eflags =  *_t23;
					} else {
						_push(0x50);
						_push(0x40d890);
						_push(_v156);
						_push(_v160);
						L00401790();
						_v188 = _t172;
					}
					_v180 = _v32;
					_v32 = _v32 & 0x00000000;
					_v44 = _v180;
					_v52 = 8;
					_push( &_v52);
					L00401676();
					L0040177E();
					_t177 =  &_v52;
					L00401760();
				}
				_push( &_v52);
				L00401622();
				_push( &_v68);
				L00401622();
				_v124 = 1;
				_v132 = 2;
				_push(1);
				_push(1);
				_push( &_v68);
				_push( &_v132);
				_t129 =  &_v84;
				_push(_t129);
				L0040172A();
				_push(_t129);
				_push( &_v52);
				_push(0x40db48);
				_push( &_v100);
				L0040161C();
				_v140 = 1;
				_v148 = 0x8002;
				_push( &_v100);
				_t133 =  &_v148;
				_push(_t133);
				L004016A0();
				_v156 = _t133;
				_push( &_v100);
				_push( &_v84);
				_push( &_v52);
				_push( &_v68);
				_push(4);
				L00401754();
				_t193 = _t192 + 0x14;
				if(_v156 != 0) {
					if( *0x416010 != 0) {
						_v192 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v192 = 0x416010;
					}
					_t160 =  &_v36;
					L0040178A();
					_v156 = _t160;
					_t164 =  *((intOrPtr*)( *_v156 + 0x130))(_v156,  &_v32, _t160,  *((intOrPtr*)( *((intOrPtr*)( *_v192)) + 0x308))( *_v192));
					asm("fclex");
					_v160 = _t164;
					_t201 = _v160;
					if(_t201 >= 0) {
						_t70 =  &_v196;
						 *_t70 = _v196 & 0x00000000;
						__eflags =  *_t70;
					} else {
						_push(0x130);
						_push(0x40d890);
						_push(_v156);
						_push(_v160);
						L00401790();
						_v196 = _t164;
					}
					_push(_v32);
					_push(0xd);
					_push(0xffffffff);
					_push(0x20);
					L00401616();
					L0040174E();
					_t177 =  &_v36;
					L0040177E();
				}
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				_push( &_v68);
				_push( &_v52);
				_t206 =  *0x4014c0;
				_push(_t177);
				_push(_t177);
				 *_t193 = _t206;
				asm("fld1");
				_push(_t177);
				_push(_t177);
				 *_t193 = _t206;
				asm("fld1");
				_push(_t177);
				_push(_t177);
				 *_t193 = _t206;
				L00401610();
				L00401778();
				asm("fcomp qword [0x4014b8]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t201 == 0) {
					_t82 =  &_v200;
					 *_t82 = _v200 & 0x00000000;
					__eflags =  *_t82;
				} else {
					_v200 = 1;
				}
				_v156 =  ~_v200;
				_push( &_v68);
				_push( &_v52);
				_push(2);
				L00401754();
				_t145 = _v156;
				if(_t145 != 0) {
					if( *0x416408 != 0) {
						_v204 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v204 = 0x416408;
					}
					_v156 =  *_v204;
					_t151 =  *((intOrPtr*)( *_v156 + 0x1c))(_v156,  &_v36);
					asm("fclex");
					_v160 = _t151;
					if(_v160 >= 0) {
						_t102 =  &_v208;
						 *_t102 = _v208 & 0x00000000;
						__eflags =  *_t102;
					} else {
						_push(0x1c);
						_push(0x40d844);
						_push(_v156);
						_push(_v160);
						L00401790();
						_v208 = _t151;
					}
					_v164 = _v36;
					_t156 =  *((intOrPtr*)( *_v164 + 0x64))(_v164, 1,  &_v152);
					asm("fclex");
					_v168 = _t156;
					if(_v168 >= 0) {
						_t115 =  &_v212;
						 *_t115 = _v212 & 0x00000000;
						__eflags =  *_t115;
					} else {
						_push(0x64);
						_push(0x40da7c);
						_push(_v164);
						_push(_v168);
						L00401790();
						_v212 = _t156;
					}
					_t145 = _v152;
					_v28 = _t145;
					L0040177E();
				}
				asm("wait");
				_push(0x414192);
				return _t145;
			}

0x00413d38
0x00413d47
0x00413d53
0x00413d5b
0x00413d5e
0x00413d65
0x00413d74
0x00413d77
0x00413d7c
0x00413d81
0x00413d87
0x00413d89
0x00413d8a
0x00413d97
0x00413db4
0x00413d99
0x00413d99
0x00413d9e
0x00413da3
0x00413da8
0x00413da8
0x00413dd8
0x00413ddc
0x00413de1
0x00413df9
0x00413dfc
0x00413dfe
0x00413e0b
0x00413e2d
0x00413e2d
0x00413e2d
0x00413e0d
0x00413e0d
0x00413e0f
0x00413e14
0x00413e1a
0x00413e20
0x00413e25
0x00413e25
0x00413e37
0x00413e3d
0x00413e47
0x00413e4a
0x00413e54
0x00413e55
0x00413e5d
0x00413e62
0x00413e65
0x00413e65
0x00413e6d
0x00413e6e
0x00413e76
0x00413e77
0x00413e7c
0x00413e83
0x00413e8a
0x00413e8c
0x00413e91
0x00413e95
0x00413e96
0x00413e99
0x00413e9a
0x00413e9f
0x00413ea3
0x00413ea4
0x00413eac
0x00413ead
0x00413eb2
0x00413ebc
0x00413ec9
0x00413eca
0x00413ed0
0x00413ed1
0x00413ed6
0x00413ee0
0x00413ee4
0x00413ee8
0x00413eec
0x00413eed
0x00413eef
0x00413ef4
0x00413f00
0x00413f0d
0x00413f2a
0x00413f0f
0x00413f0f
0x00413f14
0x00413f19
0x00413f1e
0x00413f1e
0x00413f4e
0x00413f52
0x00413f57
0x00413f6f
0x00413f75
0x00413f77
0x00413f7d
0x00413f84
0x00413fa9
0x00413fa9
0x00413fa9
0x00413f86
0x00413f86
0x00413f8b
0x00413f90
0x00413f96
0x00413f9c
0x00413fa1
0x00413fa1
0x00413fb0
0x00413fb3
0x00413fb5
0x00413fb7
0x00413fb9
0x00413fc1
0x00413fc6
0x00413fc9
0x00413fc9
0x00413fce
0x00413fd5
0x00413fdc
0x00413fe3
0x00413fed
0x00413ff1
0x00413ff2
0x00413ff8
0x00413ff9
0x00413ffa
0x00413ffd
0x00413fff
0x00414000
0x00414001
0x00414004
0x00414006
0x00414007
0x00414008
0x0041400b
0x00414010
0x00414015
0x0041401b
0x0041401d
0x0041401e
0x0041402c
0x0041402c
0x0041402c
0x00414020
0x00414020
0x00414020
0x0041403b
0x00414045
0x00414049
0x0041404a
0x0041404c
0x00414054
0x0041405d
0x0041406a
0x00414087
0x0041406c
0x0041406c
0x00414071
0x00414076
0x0041407b
0x0041407b
0x00414099
0x004140b1
0x004140b4
0x004140b6
0x004140c3
0x004140e5
0x004140e5
0x004140e5
0x004140c5
0x004140c5
0x004140c7
0x004140cc
0x004140d2
0x004140d8
0x004140dd
0x004140dd
0x004140ef
0x0041410c
0x0041410f
0x00414111
0x0041411e
0x00414140
0x00414140
0x00414140
0x00414120
0x00414120
0x00414122
0x00414127
0x0041412d
0x00414133
0x00414138
0x00414138
0x00414147
0x0041414e
0x00414155
0x00414155
0x0041415a
0x0041415b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00413D53
__vbaR4Str.MSVBVM60(0040DB40,?,?,?,?,00401556), ref: 00413D7C
__vbaNew2.MSVBVM60(0040C818,00416010,0040DB40,?,?,?,?,00401556), ref: 00413DA3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413DDC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D890,00000050), ref: 00413E20
#529.MSVBVM60(00000008), ref: 00413E55
__vbaFreeObj.MSVBVM60(00000008), ref: 00413E5D
__vbaFreeVar.MSVBVM60(00000008), ref: 00413E65
#610.MSVBVM60(?,0040DB40,?,?,?,?,00401556), ref: 00413E6E
#610.MSVBVM60(?,?,0040DB40,?,?,?,?,00401556), ref: 00413E77
__vbaVarAdd.MSVBVM60(?,00000002,?,00000001,00000001), ref: 00413E9A
#662.MSVBVM60(?,0040DB48,?,00000000,?,00000002,?,00000001,00000001), ref: 00413EAD
__vbaVarTstNe.MSVBVM60(00008002,?,?,0040DB48,?,00000000,?,00000002,?,00000001,00000001), ref: 00413ED1
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00008002,?,?,0040DB48,?,00000000,?,00000002,?,00000001,00000001), ref: 00413EEF
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,00401556), ref: 00413F19
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413F52
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D890,00000130), ref: 00413F9C
__vbaFileOpen.MSVBVM60(00000020,000000FF,0000000D,?), ref: 00413FB9
__vbaFreeStr.MSVBVM60(00000020,000000FF,0000000D,?), ref: 00413FC1
__vbaFreeObj.MSVBVM60(00000020,000000FF,0000000D,?), ref: 00413FC9
#677.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 0041400B
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 00414010
__vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A), ref: 0041404C
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 00414076
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000001C), ref: 004140D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DA7C,00000064), ref: 00414133
__vbaFreeObj.MSVBVM60(00000000,?,0040DA7C,00000064), ref: 00414155

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#610List$#529#662#677ChkstkFileOpen
String ID:
API String ID: 2840815565-0
Opcode ID: 01f691d45e1b0cab4bcbed0f0ba7d23f6eb9777199849843ba32d7375b9b4fa0
Instruction ID: 0de9519369c7e137ae406f7afe36b8b10e28d2938732152d3bfa2407f718d366
Opcode Fuzzy Hash: 01f691d45e1b0cab4bcbed0f0ba7d23f6eb9777199849843ba32d7375b9b4fa0
Instruction Fuzzy Hash: 01C10B75910228EFDB10DFA1CC45FDDB7B8BB08304F0041AAE109B72A1DB799A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00413AE9, Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00413AE9(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				short _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				char* _v116;
				char _v124;
				void* _v144;
				signed int _v148;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				short _t61;
				char* _t65;
				char* _t69;
				signed int _t73;
				intOrPtr _t98;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t98;
				L00401550();
				_v12 = _t98;
				_v8 = 0x4014a8;
				_v52 = 0xe;
				_v60 = 2;
				_push( &_v60);
				_push( &_v76);
				L00401634();
				_v116 = L"Out of string space";
				_v124 = 0x8008;
				_push( &_v76);
				_t61 =  &_v124;
				_push(_t61);
				L004016A0();
				_v144 = _t61;
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L00401754();
				if(_v144 != 0) {
					if( *0x416010 != 0) {
						_v160 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v160 = 0x416010;
					}
					_t69 =  &_v44;
					L0040178A();
					_v144 = _t69;
					_t73 =  *((intOrPtr*)( *_v144 + 0x50))(_v144,  &_v40, _t69,  *((intOrPtr*)( *((intOrPtr*)( *_v160)) + 0x308))( *_v160));
					asm("fclex");
					_v148 = _t73;
					if(_v148 >= 0) {
						_v164 = _v164 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40d890);
						_push(_v144);
						_push(_v148);
						L00401790();
						_v164 = _t73;
					}
					_v156 = _v40;
					_v40 = _v40 & 0x00000000;
					_v52 = _v156;
					_v60 = 8;
					_v116 = 0x2c9a66;
					_v124 = 3;
					_push(0x10);
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(2);
					_push(L"mzWAioPXbU3m8OfkQa3vEWmR0T26");
					_push(_v24);
					L004016E8();
					L0040177E();
					L00401760();
				}
				_v52 = 1;
				_v60 = 2;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_t65 =  &_v60;
				_push(_t65);
				L0040162E();
				L0040176C();
				L00401760();
				_push(0x40db38);
				L00401694();
				if(_t65 != 2) {
					_push(0x37);
					L004016E2();
					_v28 = _t65;
				}
				_v36 = 0x6d84;
				_push(0x413d18);
				L0040177E();
				L0040174E();
				return _t65;
			}

0x00413aee
0x00413af9
0x00413afa
0x00413b06
0x00413b0e
0x00413b11
0x00413b18
0x00413b1f
0x00413b29
0x00413b2d
0x00413b2e
0x00413b33
0x00413b3a
0x00413b44
0x00413b45
0x00413b48
0x00413b49
0x00413b4e
0x00413b58
0x00413b5c
0x00413b5d
0x00413b5f
0x00413b70
0x00413b7d
0x00413b9a
0x00413b7f
0x00413b7f
0x00413b84
0x00413b89
0x00413b8e
0x00413b8e
0x00413bbe
0x00413bc2
0x00413bc7
0x00413bdf
0x00413be2
0x00413be4
0x00413bf1
0x00413c13
0x00413bf3
0x00413bf3
0x00413bf5
0x00413bfa
0x00413c00
0x00413c06
0x00413c0b
0x00413c0b
0x00413c1d
0x00413c23
0x00413c2d
0x00413c30
0x00413c37
0x00413c3e
0x00413c45
0x00413c48
0x00413c52
0x00413c53
0x00413c54
0x00413c55
0x00413c56
0x00413c59
0x00413c63
0x00413c64
0x00413c65
0x00413c66
0x00413c67
0x00413c69
0x00413c6e
0x00413c71
0x00413c7c
0x00413c84
0x00413c84
0x00413c89
0x00413c90
0x00413c97
0x00413c99
0x00413c9b
0x00413c9d
0x00413c9f
0x00413ca2
0x00413ca3
0x00413cad
0x00413cb5
0x00413cba
0x00413cbf
0x00413cc7
0x00413cc9
0x00413ccb
0x00413cd0
0x00413cd0
0x00413cd3
0x00413cd9
0x00413d0a
0x00413d12
0x00413d17

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00413B06
#652.MSVBVM60(?,00000002,?,?,?,?,?,?,?,?,?,?,?,00401556), ref: 00413B2E
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 00413B49
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 00413B5F
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 00413B89
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413BC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D890,00000050), ref: 00413C06
__vbaChkstk.MSVBVM60(00000000,?,0040D890,00000050), ref: 00413C48
__vbaChkstk.MSVBVM60(00000000,?,0040D890,00000050), ref: 00413C59
__vbaLateMemCall.MSVBVM60(?,mzWAioPXbU3m8OfkQa3vEWmR0T26,00000002), ref: 00413C71
__vbaFreeObj.MSVBVM60 ref: 00413C7C
__vbaFreeVar.MSVBVM60 ref: 00413C84
#703.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413CA3
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413CAD
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413CB5
__vbaI4Str.MSVBVM60(0040DB38,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413CBF
#570.MSVBVM60(00000037,0040DB38,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413CCB
__vbaFreeObj.MSVBVM60(00413D18,0040DB38,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413D0A
__vbaFreeStr.MSVBVM60(00413D18,0040DB38,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413D12

Strings

mzWAioPXbU3m8OfkQa3vEWmR0T26, xrefs: 00413C69
Out of string space, xrefs: 00413B33

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$#570#652#703CallCheckHresultLateListMoveNew2
String ID: Out of string space$mzWAioPXbU3m8OfkQa3vEWmR0T26
API String ID: 1617955232-3832750513
Opcode ID: 4a5753ba99bdc97be2bbd287d068fbb9143595fca5f914a40776dde5a85b1334
Instruction ID: 9deff64b029bf0ada1861eb75701f0f7b8f897a2899fcdc03c89baa089d43b51
Opcode Fuzzy Hash: 4a5753ba99bdc97be2bbd287d068fbb9143595fca5f914a40776dde5a85b1334
Instruction Fuzzy Hash: D751FA71900218ABDB10EFA5CC46BDEBBB9BF04714F10456AF405B72E1DB795A84CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00412924, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00412924(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				intOrPtr _v80;
				char _v88;
				signed int _v96;
				char _v104;
				void* _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				intOrPtr* _v176;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				signed int _v192;
				short _t83;
				char* _t88;
				signed int _t91;
				signed int _t92;
				signed int _t98;
				intOrPtr _t127;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t127;
				L00401550();
				_v12 = _t127;
				_v8 = 0x401408;
				_push(0x40da1c);
				L00401694();
				_push(0xac);
				_push( &_v40);
				L0040169A();
				_v96 = 0x40da28;
				_v104 = 0x8008;
				_push( &_v40);
				_t83 =  &_v104;
				_push(_t83);
				L004016A0();
				_v156 = _t83;
				L00401760();
				if(_v156 != 0) {
					_v80 = 0x80020004;
					_v88 = 0xa;
					_v64 = 0x80020004;
					_v72 = 0xa;
					_v48 = 0x80020004;
					_v56 = 0xa;
					_v96 = L"Invadere";
					_v104 = 8;
					L004016DC();
					_push( &_v88);
					_push( &_v72);
					_push( &_v56);
					_push(0);
					_push( &_v40);
					L00401718();
					_push( &_v88);
					_push( &_v72);
					_push( &_v56);
					_push( &_v40);
					_push(4);
					L00401754();
					_t127 = _t127 + 0x14;
				}
				if( *0x416010 != 0) {
					_v176 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v176 = 0x416010;
				}
				_t88 =  &_v24;
				L0040178A();
				_v156 = _t88;
				_t91 =  *((intOrPtr*)( *_v156 + 0x1bc))(_v156, _t88,  *((intOrPtr*)( *((intOrPtr*)( *_v176)) + 0x300))( *_v176));
				asm("fclex");
				_v160 = _t91;
				if(_v160 >= 0) {
					_v180 = _v180 & 0x00000000;
				} else {
					_push(0x1bc);
					_push(0x40d930);
					_push(_v156);
					_push(_v160);
					L00401790();
					_v180 = _t91;
				}
				L0040177E();
				_t92 = 0;
				if(0 != 0) {
					if( *0x416408 != 0) {
						_v184 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v184 = 0x416408;
					}
					_v156 =  *_v184;
					_t98 =  *((intOrPtr*)( *_v156 + 0x4c))(_v156,  &_v24);
					asm("fclex");
					_v160 = _t98;
					if(_v160 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x40d844);
						_push(_v156);
						_push(_v160);
						L00401790();
						_v188 = _t98;
					}
					_v164 = _v24;
					_v96 = _v96 & 0x00000000;
					_v104 = 2;
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t92 =  *((intOrPtr*)( *_v164 + 0x2c))(_v164, 0x10);
					asm("fclex");
					_v168 = _t92;
					if(_v168 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x40d864);
						_push(_v164);
						_push(_v168);
						L00401790();
						_v192 = _t92;
					}
					L0040177E();
				}
				_push(0x412bf2);
				return _t92;
			}

0x00412929
0x00412934
0x00412935
0x00412941
0x00412949
0x0041294c
0x00412953
0x00412958
0x0041295d
0x00412961
0x00412962
0x00412967
0x0041296e
0x00412978
0x00412979
0x0041297c
0x0041297d
0x00412982
0x0041298c
0x0041299a
0x0041299c
0x004129a3
0x004129aa
0x004129b1
0x004129b8
0x004129bf
0x004129c6
0x004129cd
0x004129da
0x004129e2
0x004129e6
0x004129ea
0x004129eb
0x004129f0
0x004129f1
0x004129f9
0x004129fd
0x00412a01
0x00412a05
0x00412a06
0x00412a08
0x00412a0d
0x00412a0d
0x00412a17
0x00412a34
0x00412a19
0x00412a19
0x00412a1e
0x00412a23
0x00412a28
0x00412a28
0x00412a58
0x00412a5c
0x00412a61
0x00412a75
0x00412a7b
0x00412a7d
0x00412a8a
0x00412aaf
0x00412a8c
0x00412a8c
0x00412a91
0x00412a96
0x00412a9c
0x00412aa2
0x00412aa7
0x00412aa7
0x00412ab9
0x00412abe
0x00412ac2
0x00412acf
0x00412aec
0x00412ad1
0x00412ad1
0x00412ad6
0x00412adb
0x00412ae0
0x00412ae0
0x00412afe
0x00412b16
0x00412b19
0x00412b1b
0x00412b28
0x00412b4a
0x00412b2a
0x00412b2a
0x00412b2c
0x00412b31
0x00412b37
0x00412b3d
0x00412b42
0x00412b42
0x00412b54
0x00412b5a
0x00412b5e
0x00412b68
0x00412b72
0x00412b73
0x00412b74
0x00412b75
0x00412b84
0x00412b87
0x00412b89
0x00412b96
0x00412bb8
0x00412b98
0x00412b98
0x00412b9a
0x00412b9f
0x00412ba5
0x00412bab
0x00412bb0
0x00412bb0
0x00412bc2
0x00412bc2
0x00412bc7
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00412941
__vbaI4Str.MSVBVM60(0040DA1C,?,?,?,?,00401556), ref: 00412958
#608.MSVBVM60(?,00000000,0040DA1C,?,?,?,?,00401556), ref: 00412962
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 0041297D
__vbaFreeVar.MSVBVM60(00008008,?), ref: 0041298C
__vbaVarDup.MSVBVM60(00008008,?), ref: 004129DA
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A,00008008,?), ref: 004129F1
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A,00008008,?), ref: 00412A08
__vbaNew2.MSVBVM60(0040C818,00416010,00008008,?), ref: 00412A23
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412A5C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D930,000001BC), ref: 00412AA2
__vbaFreeObj.MSVBVM60(00000000,?,0040D930,000001BC), ref: 00412AB9
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 00412ADB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000004C), ref: 00412B3D
__vbaChkstk.MSVBVM60(00000000,?,0040D844,0000004C), ref: 00412B68
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D864,0000002C), ref: 00412BAB
__vbaFreeObj.MSVBVM60(00000000,?,0040D864,0000002C), ref: 00412BC2

Strings

Invadere, xrefs: 004129C6

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ChkstkNew2$#595#608List
String ID: Invadere
API String ID: 3259713691-735667722
Opcode ID: f4c0a7a02eaeae0a6da6299c80bb6d26a05d027255416bcd6ef5d99a0f961d9c
Instruction ID: 69417bd2c01ad536cda745e5ee97a8661ff2441ecaf41b6bc694d79031d35e9d
Opcode Fuzzy Hash: f4c0a7a02eaeae0a6da6299c80bb6d26a05d027255416bcd6ef5d99a0f961d9c
Instruction Fuzzy Hash: 61711B71D00318DFDB10DFA1C945BDEB7B9AF05304F1040AAE109BB2A1D7B95A89CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00413886, Relevance: 27.1, APIs: 18, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00413886(void* __ebx, void* __edi, void* __esi, intOrPtr __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				long long _v36;
				signed int _v40;
				char _v56;
				char _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				intOrPtr _v124;
				intOrPtr _v132;
				intOrPtr _v140;
				intOrPtr _v148;
				char _v156;
				void* _v160;
				signed int _v164;
				intOrPtr _v176;
				intOrPtr* _v180;
				signed int _v184;
				char* _t62;
				short _t67;
				signed int _t68;
				signed int _t74;
				void* _t94;
				void* _t96;
				intOrPtr _t97;

				_t97 = _t96 - 0xc;
				 *[fs:0x0] = _t97;
				L00401550();
				_v16 = _t97;
				_v12 = 0x401498;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401556, _t94);
				_push(0);
				_push(3);
				_push(1);
				_push(0);
				_t62 =  &_v76;
				_push(_t62);
				_push(0x10);
				_push(0x880);
				L0040164C();
				_v84 = 2;
				_v92 = 2;
				_push(0);
				_push(_v76);
				L00401646();
				L00401730();
				_v100 = 3;
				_v108 = 2;
				_push(1);
				_push(_v76);
				L00401646();
				L00401730();
				_v116 = 3;
				_v124 = 2;
				_push(2);
				_push(_v76);
				L00401646();
				L00401730();
				_v132 = 4;
				_v140 = 2;
				_push(3);
				_push(_v76);
				L00401646();
				L00401730();
				_push( &_v76);
				asm("fld1");
				_push(_t62);
				 *((intOrPtr*)(_t97 + 0x1c)) = __fp0;
				_push( &_v56);
				L00401652();
				_push( &_v76);
				_push(0);
				L00401640();
				_v148 = 2;
				_v156 = 0x8002;
				_push( &_v56);
				_t67 =  &_v156;
				_push(_t67);
				L004016A0();
				_v160 = _t67;
				L00401760();
				_t68 = _v160;
				if(_t68 != 0) {
					if( *0x416408 != 0) {
						_v180 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v180 = 0x416408;
					}
					_v160 =  *_v180;
					_t74 =  *((intOrPtr*)( *_v160 + 0x48))(_v160, 0x8e,  &_v40);
					asm("fclex");
					_v164 = _t74;
					if(_v164 >= 0) {
						_v184 = _v184 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x40d844);
						_push(_v160);
						_push(_v164);
						L00401790();
						_v184 = _t74;
					}
					_t68 = _v40;
					_v176 = _t68;
					_v40 = _v40 & 0x00000000;
					L0040176C();
				}
				_v36 =  *0x401490;
				asm("wait");
				_push(0x413ac2);
				L0040174E();
				return _t68;
			}

0x00413889
0x00413898
0x004138a4
0x004138ac
0x004138af
0x004138b6
0x004138c5
0x004138c8
0x004138ca
0x004138cc
0x004138ce
0x004138d0
0x004138d3
0x004138d4
0x004138d6
0x004138db
0x004138e3
0x004138ea
0x004138f4
0x004138f6
0x004138f9
0x00413902
0x00413907
0x0041390e
0x00413918
0x0041391a
0x0041391d
0x00413926
0x0041392b
0x00413932
0x0041393c
0x0041393e
0x00413941
0x0041394a
0x0041394f
0x00413956
0x00413966
0x00413968
0x0041396b
0x00413974
0x0041397c
0x0041397d
0x0041397f
0x00413980
0x00413986
0x00413987
0x0041398f
0x00413990
0x00413992
0x00413997
0x004139a1
0x004139ae
0x004139af
0x004139b5
0x004139b6
0x004139bb
0x004139c5
0x004139ca
0x004139d3
0x004139e0
0x004139fd
0x004139e2
0x004139e2
0x004139e7
0x004139ec
0x004139f1
0x004139f1
0x00413a0f
0x00413a2c
0x00413a2f
0x00413a31
0x00413a3e
0x00413a60
0x00413a40
0x00413a40
0x00413a42
0x00413a47
0x00413a4d
0x00413a53
0x00413a58
0x00413a58
0x00413a67
0x00413a6a
0x00413a70
0x00413a7d
0x00413a7d
0x00413a88
0x00413a8b
0x00413a8c
0x00413abc
0x00413ac1

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 004138A4
__vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000,?,?,?,?,00401556), ref: 004138DB
__vbaDerefAry1.MSVBVM60(?,00000000), ref: 004138F9
__vbaVarMove.MSVBVM60(?,00000000), ref: 00413902
__vbaDerefAry1.MSVBVM60(?,00000001,?,?,?,00000000), ref: 0041391D
__vbaVarMove.MSVBVM60(?,00000001,?,?,?,00000000), ref: 00413926
__vbaDerefAry1.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00413941
__vbaVarMove.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 0041394A
__vbaDerefAry1.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 0041396B
__vbaVarMove.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00413974
#665.MSVBVM60(?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?), ref: 00413987
__vbaErase.MSVBVM60(00000000,?,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 00413992
__vbaVarTstNe.MSVBVM60(00008002,?,00000000,?,?,?,?,?,00000003,?,?,?,00000002,?,?,?), ref: 004139B6
__vbaFreeVar.MSVBVM60(00008002,?,00000000,?,?,?,?,?,00000003,?,?,?,00000002,?,?,?), ref: 004139C5
__vbaNew2.MSVBVM60(0040D854,00416408,00008002,?,00000000,?,?,?,?,?,00000003,?,?,?,00000002), ref: 004139EC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000048,?,?,?,?,?,00000003,?,?,?,00000002), ref: 00413A53
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00000003,?,?,?,00000002), ref: 00413A7D
__vbaFreeStr.MSVBVM60(00413AC2,00008002,?,00000000,?,?,?,?,?,00000003,?,?,?,00000002), ref: 00413ABC

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$Ary1Deref$Free$#665CheckChkstkEraseHresultNew2Redim
String ID:
API String ID: 4215882036-0
Opcode ID: c10de09e98c0a1ab470d03ece54d1151865b09bb4c8c24249d4ff914b137b66d
Instruction ID: 766404eb593e14f5917a3da4aec53c0d02d3398d1a32e645ae7a3ca4eca4d704
Opcode Fuzzy Hash: c10de09e98c0a1ab470d03ece54d1151865b09bb4c8c24249d4ff914b137b66d
Instruction Fuzzy Hash: EE510A70A00218AFDF10EF95CC46BDDBBB5AF04704F5040AAE145BB2A1DB795A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004141B1, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E004141B1(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v48;
				char _v64;
				intOrPtr _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				char _v112;
				signed int _v116;
				signed int _v120;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _t53;
				signed int _t55;
				signed int _t58;
				char* _t61;
				char* _t62;
				void* _t73;
				void* _t75;
				intOrPtr _t76;

				_t76 = _t75 - 0xc;
				 *[fs:0x0] = _t76;
				L00401550();
				_v16 = _t76;
				_v12 = 0x4014e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x401556, _t73);
				_v88 = 0x40db38;
				_v96 = 8;
				L004016DC();
				_push( &_v64);
				_t53 =  &_v48;
				_push(_t53);
				L0040160A();
				_v116 = _t53;
				if(_v116 >= 0) {
					_v132 = _v132 & 0x00000000;
				} else {
					_push(_v116);
					L00401604();
					_v132 = _t53;
				}
				_v104 = 2;
				_v112 = 0x8002;
				_push( &_v64);
				_t55 =  &_v112;
				_push(_t55);
				L004016A0();
				_v120 = _t55;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401754();
				_t58 = _v120;
				if(_t58 != 0) {
					if( *0x416408 != 0) {
						_v136 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v136 = 0x416408;
					}
					_v116 =  *_v136;
					_t61 =  &_v48;
					L004015FE();
					L0040170C();
					_t62 =  &_v32;
					L00401712();
					_t58 =  *((intOrPtr*)( *_v116 + 0xc))(_v116, _t62, _t62, _t61, _t61, _t61, _v28, L"MpNW4B9jRO557D8EqRbueLNVktUfHGF1pE52", 0);
					asm("fclex");
					_v120 = _t58;
					if(_v120 >= 0) {
						_v140 = _v140 & 0x00000000;
					} else {
						_push(0xc);
						_push(0x40d844);
						_push(_v116);
						_push(_v120);
						L00401790();
						_v140 = _t58;
					}
					L0040177E();
					L00401760();
				}
				_push(0x414344);
				L0040177E();
				return _t58;
			}

0x004141b4
0x004141c3
0x004141cd
0x004141d5
0x004141d8
0x004141df
0x004141ee
0x004141f1
0x004141f8
0x00414205
0x0041420d
0x0041420e
0x00414211
0x00414212
0x00414217
0x0041421e
0x0041422d
0x00414220
0x00414220
0x00414223
0x00414228
0x00414228
0x00414231
0x00414238
0x00414242
0x00414243
0x00414246
0x00414247
0x0041424c
0x00414253
0x00414257
0x00414258
0x0041425a
0x00414262
0x00414268
0x00414275
0x00414292
0x00414277
0x00414277
0x0041427c
0x00414281
0x00414286
0x00414286
0x004142a4
0x004142b1
0x004142b5
0x004142be
0x004142c4
0x004142c8
0x004142d6
0x004142d9
0x004142db
0x004142e2
0x004142fe
0x004142e4
0x004142e4
0x004142e6
0x004142eb
0x004142ee
0x004142f1
0x004142f6
0x004142f6
0x00414308
0x00414310
0x00414310
0x00414315
0x0041433e
0x00414343

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 004141CD
__vbaVarDup.MSVBVM60 ref: 00414205
#564.MSVBVM60(?,?), ref: 00414212
__vbaHresultCheck.MSVBVM60(00000000,?,?,?,?,?), ref: 00414223
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?), ref: 00414247
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?,?,?,?,?,?), ref: 0041425A
__vbaNew2.MSVBVM60(0040D854,00416408,?,?,00401556), ref: 00414281
__vbaLateMemCallLd.MSVBVM60(?,?,MpNW4B9jRO557D8EqRbueLNVktUfHGF1pE52,00000000), ref: 004142B5
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,00401556), ref: 004142BE
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,?,?,?,?,?,?,00401556), ref: 004142C8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000000C), ref: 004142F1
__vbaFreeObj.MSVBVM60(00000000,?,0040D844,0000000C), ref: 00414308
__vbaFreeVar.MSVBVM60(00000000,?,0040D844,0000000C), ref: 00414310
__vbaFreeObj.MSVBVM60(00414344,?,?,00401556), ref: 0041433E

Strings

MpNW4B9jRO557D8EqRbueLNVktUfHGF1pE52, xrefs: 004142A9

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$#564AddrefCallChkstkLateListNew2
String ID: MpNW4B9jRO557D8EqRbueLNVktUfHGF1pE52
API String ID: 2358069889-1832760962
Opcode ID: 1060d3f7965178951e64bdf57fb7986183cc26c8665d160f894921abe7724059
Instruction ID: 5b73134f8d0435cdfce1586917a0210517f4cc9cfe37b7843f6c44389e2e7c9d
Opcode Fuzzy Hash: 1060d3f7965178951e64bdf57fb7986183cc26c8665d160f894921abe7724059
Instruction Fuzzy Hash: 29410771D00218AFDB10EFE5C945BDEBBB8BB04704F20856AF115B71A2DB785989CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00412CD8, Relevance: 25.7, APIs: 17, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00412CD8(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _v28;
				char _v32;
				char _v48;
				char _v64;
				intOrPtr _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				char _v112;
				void* _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				short _t82;
				char* _t89;
				signed int _t93;
				signed int _t99;
				signed int _t105;
				intOrPtr _t127;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t127;
				L00401550();
				_v12 = _t127;
				_v8 = 0x401430;
				_v88 = 0x40da6c;
				_v96 = 8;
				L004016DC();
				_push(2);
				_push( &_v48);
				_push( &_v64);
				L0040168E();
				_v104 = 0x40da78;
				_v112 = 0x8008;
				_push( &_v64);
				_t82 =  &_v112;
				_push(_t82);
				L004016A0();
				_v116 = _t82;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401754();
				if(_v116 != 0) {
					if( *0x416408 != 0) {
						_v140 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v140 = 0x416408;
					}
					_v116 =  *_v140;
					_t99 =  *((intOrPtr*)( *_v116 + 0x1c))(_v116,  &_v32);
					asm("fclex");
					_v120 = _t99;
					if(_v120 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40d844);
						_push(_v116);
						_push(_v120);
						L00401790();
						_v144 = _t99;
					}
					_v124 = _v32;
					_v88 = 0x80020004;
					_v96 = 0xa;
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t105 =  *((intOrPtr*)( *_v124 + 0x5c))(_v124, 0x10,  &_v28);
					asm("fclex");
					_v128 = _t105;
					if(_v128 >= 0) {
						_v148 = _v148 & 0x00000000;
					} else {
						_push(0x5c);
						_push(0x40da7c);
						_push(_v124);
						_push(_v128);
						L00401790();
						_v148 = _t105;
					}
					_v136 = _v28;
					_v28 = _v28 & 0x00000000;
					L0040176C();
					L0040177E();
				}
				if( *0x416010 != 0) {
					_v152 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v152 = 0x416010;
				}
				_t89 =  &_v32;
				L0040178A();
				_v116 = _t89;
				_v88 = 0x80020004;
				_v96 = 0xa;
				L00401550();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t93 =  *((intOrPtr*)( *_v116 + 0x1b0))(_v116, 0x10, _t89,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x300))( *_v152));
				asm("fclex");
				_v120 = _t93;
				if(_v120 >= 0) {
					_v156 = _v156 & 0x00000000;
				} else {
					_push(0x1b0);
					_push(0x40d930);
					_push(_v116);
					_push(_v120);
					L00401790();
					_v156 = _t93;
				}
				L0040177E();
				_push(0x412f52);
				L0040174E();
				return _t93;
			}

0x00412cdd
0x00412ce8
0x00412ce9
0x00412cf5
0x00412cfd
0x00412d00
0x00412d07
0x00412d0e
0x00412d1b
0x00412d20
0x00412d25
0x00412d29
0x00412d2a
0x00412d2f
0x00412d36
0x00412d40
0x00412d41
0x00412d44
0x00412d45
0x00412d4a
0x00412d51
0x00412d55
0x00412d56
0x00412d58
0x00412d66
0x00412d73
0x00412d90
0x00412d75
0x00412d75
0x00412d7a
0x00412d7f
0x00412d84
0x00412d84
0x00412da2
0x00412db1
0x00412db4
0x00412db6
0x00412dbd
0x00412dd9
0x00412dbf
0x00412dbf
0x00412dc1
0x00412dc6
0x00412dc9
0x00412dcc
0x00412dd1
0x00412dd1
0x00412de3
0x00412de6
0x00412ded
0x00412dfb
0x00412e05
0x00412e06
0x00412e07
0x00412e08
0x00412e11
0x00412e14
0x00412e16
0x00412e1d
0x00412e39
0x00412e1f
0x00412e1f
0x00412e21
0x00412e26
0x00412e29
0x00412e2c
0x00412e31
0x00412e31
0x00412e43
0x00412e49
0x00412e56
0x00412e5e
0x00412e5e
0x00412e6a
0x00412e87
0x00412e6c
0x00412e6c
0x00412e71
0x00412e76
0x00412e7b
0x00412e7b
0x00412eab
0x00412eaf
0x00412eb4
0x00412eb7
0x00412ebe
0x00412ec8
0x00412ed2
0x00412ed3
0x00412ed4
0x00412ed5
0x00412ede
0x00412ee4
0x00412ee6
0x00412eed
0x00412f0c
0x00412eef
0x00412eef
0x00412ef4
0x00412ef9
0x00412efc
0x00412eff
0x00412f04
0x00412f04
0x00412f16
0x00412f1b
0x00412f4c
0x00412f51

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00412CF5
__vbaVarDup.MSVBVM60 ref: 00412D1B
#513.MSVBVM60(?,?,00000002), ref: 00412D2A
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000002), ref: 00412D45
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000002), ref: 00412D58
__vbaNew2.MSVBVM60(0040D854,00416408), ref: 00412D7F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000001C), ref: 00412DCC
__vbaChkstk.MSVBVM60(?), ref: 00412DFB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DA7C,0000005C), ref: 00412E2C
__vbaStrMove.MSVBVM60(00000000,?,0040DA7C,0000005C), ref: 00412E56
__vbaFreeObj.MSVBVM60(00000000,?,0040DA7C,0000005C), ref: 00412E5E
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 00412E76
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412EAF
__vbaChkstk.MSVBVM60(?,00000000), ref: 00412EC8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D930,000001B0), ref: 00412EFF
__vbaFreeObj.MSVBVM60(00000000,?,0040D930,000001B0), ref: 00412F16
__vbaFreeStr.MSVBVM60(00412F52), ref: 00412F4C

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$New2$#513ListMove
String ID:
API String ID: 1144094567-0
Opcode ID: 4286ab388ec761c75076f3bfb5e654c96cbcd0e883d464c58f481e19a042edad
Instruction ID: 1495d55f6e6fffff9718ae414889e3483ac81973271c6d9561d8ab102da909cb
Opcode Fuzzy Hash: 4286ab388ec761c75076f3bfb5e654c96cbcd0e883d464c58f481e19a042edad
Instruction Fuzzy Hash: 3D610871D002189FDF10EFA5C945BDEB7B4BF08704F20846AE105BB2A2DBB95989DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00413635, Relevance: 24.2, APIs: 16, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00413635(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				signed int _v32;
				char _v36;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				void* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				signed int _v120;
				signed int _t94;
				signed int _t99;
				char* _t101;
				signed int _t102;
				signed int _t108;
				void* _t129;
				void* _t131;
				intOrPtr _t132;

				_t132 = _t131 - 0xc;
				 *[fs:0x0] = _t132;
				L00401550();
				_v16 = _t132;
				_v12 = 0x401480;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x60,  *[fs:0x0], 0x401556, _t129);
				L0040165E();
				if( *0x416408 != 0) {
					_v100 = 0x416408;
				} else {
					_push(0x416408);
					_push(0x40d854);
					L00401784();
					_v100 = 0x416408;
				}
				_v72 =  *_v100;
				_t94 =  *((intOrPtr*)( *_v72 + 0x14))(_v72,  &_v36);
				asm("fclex");
				_v76 = _t94;
				if(_v76 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d844);
					_push(_v72);
					_push(_v76);
					L00401790();
					_v104 = _t94;
				}
				_v80 = _v36;
				_t99 =  *((intOrPtr*)( *_v80 + 0x60))(_v80,  &_v32);
				asm("fclex");
				_v84 = _t99;
				if(_v84 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40dab0);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v108 = _t99;
				}
				_v96 = _v32;
				_v32 = _v32 & 0x00000000;
				L0040176C();
				L0040177E();
				_v60 = 0x40da28;
				_v68 = 8;
				L004016DC();
				_t101 =  &_v52;
				_push(_t101);
				L00401658();
				_v72 =  ~(0 | _t101 != 0x00000008);
				L00401760();
				_t102 = _v72;
				if(_t102 != 0) {
					if( *0x416408 != 0) {
						_v112 = 0x416408;
					} else {
						_push(0x416408);
						_push(0x40d854);
						L00401784();
						_v112 = 0x416408;
					}
					_v72 =  *_v112;
					_t108 =  *((intOrPtr*)( *_v72 + 0x4c))(_v72,  &_v36);
					asm("fclex");
					_v76 = _t108;
					if(_v76 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x40d844);
						_push(_v72);
						_push(_v76);
						L00401790();
						_v116 = _t108;
					}
					_v80 = _v36;
					_v60 = 1;
					_v68 = 2;
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t102 =  *((intOrPtr*)( *_v80 + 0x2c))(_v80, 0x10);
					asm("fclex");
					_v84 = _t102;
					if(_v84 >= 0) {
						_v120 = _v120 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x40d864);
						_push(_v80);
						_push(_v84);
						L00401790();
						_v120 = _t102;
					}
					L0040177E();
				}
				_push(0x413867);
				L0040174E();
				return _t102;
			}

0x00413638
0x00413647
0x00413651
0x00413659
0x0041365c
0x00413663
0x00413672
0x00413675
0x00413681
0x0041369b
0x00413683
0x00413683
0x00413688
0x0041368d
0x00413692
0x00413692
0x004136a7
0x004136b6
0x004136b9
0x004136bb
0x004136c2
0x004136db
0x004136c4
0x004136c4
0x004136c6
0x004136cb
0x004136ce
0x004136d1
0x004136d6
0x004136d6
0x004136e2
0x004136f1
0x004136f4
0x004136f6
0x004136fd
0x00413716
0x004136ff
0x004136ff
0x00413701
0x00413706
0x00413709
0x0041370c
0x00413711
0x00413711
0x0041371d
0x00413720
0x0041372a
0x00413732
0x00413737
0x0041373e
0x0041374b
0x00413750
0x00413753
0x00413754
0x00413763
0x0041376a
0x0041376f
0x00413775
0x00413782
0x0041379c
0x00413784
0x00413784
0x00413789
0x0041378e
0x00413793
0x00413793
0x004137a8
0x004137b7
0x004137ba
0x004137bc
0x004137c3
0x004137dc
0x004137c5
0x004137c5
0x004137c7
0x004137cc
0x004137cf
0x004137d2
0x004137d7
0x004137d7
0x004137e3
0x004137e6
0x004137ed
0x004137f7
0x00413801
0x00413802
0x00413803
0x00413804
0x0041380d
0x00413810
0x00413812
0x00413819
0x00413832
0x0041381b
0x0041381b
0x0041381d
0x00413822
0x00413825
0x00413828
0x0041382d
0x0041382d
0x00413839
0x00413839
0x0041383e
0x00413861
0x00413866

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00413651
#554.MSVBVM60(?,?,?,?,00401556), ref: 00413675
__vbaNew2.MSVBVM60(0040D854,00416408,?,?,?,?,00401556), ref: 0041368D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000014), ref: 004136D1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DAB0,00000060), ref: 0041370C
__vbaStrMove.MSVBVM60(00000000,?,0040DAB0,00000060), ref: 0041372A
__vbaFreeObj.MSVBVM60(00000000,?,0040DAB0,00000060), ref: 00413732
__vbaVarDup.MSVBVM60(00000000,?,0040DAB0,00000060), ref: 0041374B
#563.MSVBVM60(?), ref: 00413754
__vbaFreeVar.MSVBVM60(?), ref: 0041376A
__vbaNew2.MSVBVM60(0040D854,00416408,?), ref: 0041378E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,0000004C), ref: 004137D2
__vbaChkstk.MSVBVM60(00000000,?,0040D844,0000004C), ref: 004137F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D864,0000002C), ref: 00413828
__vbaFreeObj.MSVBVM60(00000000,?,0040D864,0000002C), ref: 00413839
__vbaFreeStr.MSVBVM60(00413867,?), ref: 00413861

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2$#554#563Move
String ID:
API String ID: 1771733624-0
Opcode ID: 4055e8337129e47b9a1e1ac57b68edef6b849a59d437c299b6e49624eebe4b92
Instruction ID: 0c9158414036a22dcec7d7ae128a0feff2e08b220836a2c9845f6fc750950333
Opcode Fuzzy Hash: 4055e8337129e47b9a1e1ac57b68edef6b849a59d437c299b6e49624eebe4b92
Instruction Fuzzy Hash: 0B61E375D10218AFDF10EFA5C945BDDBBB5BF04705F10402AE005BB2A1D7B9A986CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041450A, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0041450A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				void* _v32;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				char* _v104;
				char _v112;
				char _v164;
				signed int _v168;
				signed int _v172;
				intOrPtr* _v176;
				signed int _v180;
				short _v184;
				char _v196;
				signed int _v200;
				intOrPtr* _v204;
				signed int _v208;
				signed int _v212;
				char* _t82;
				signed int _t88;
				signed int _t93;
				char* _t98;
				signed int _t109;
				void* _t117;
				void* _t119;
				intOrPtr _t120;

				_t120 = _t119 - 0xc;
				 *[fs:0x0] = _t120;
				L00401550();
				_v16 = _t120;
				_v12 = 0x401510;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401556, _t117);
				L0040165E();
				_v104 =  &_v28;
				_v112 = 0x6003;
				_t82 =  &_v112;
				_push(_t82);
				L004015E6();
				if(_t82 != 0xffff) {
					_v196 =  *0x401508 *  *0x401500;
					_v48 = _v196;
					_t109 =  *((intOrPtr*)( *_a4 + 0x84))(_a4, __ecx);
					asm("fclex");
					_v168 = _t109;
					if(_v168 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x84);
						_push(0x40d0c8);
						_push(_a4);
						_push(_v168);
						L00401790();
						_v200 = _t109;
					}
				}
				if( *0x416408 != 0) {
					_v204 = 0x416408;
				} else {
					_push(0x416408);
					_push(0x40d854);
					L00401784();
					_v204 = 0x416408;
				}
				_v168 =  *_v204;
				_t88 =  *((intOrPtr*)( *_v168 + 0x14))(_v168,  &_v32);
				asm("fclex");
				_v172 = _t88;
				if(_v172 >= 0) {
					_v208 = _v208 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d844);
					_push(_v168);
					_push(_v172);
					L00401790();
					_v208 = _t88;
				}
				_v176 = _v32;
				_t93 =  *((intOrPtr*)( *_v176 + 0x128))(_v176,  &_v164);
				asm("fclex");
				_v180 = _t93;
				if(_v180 >= 0) {
					_v212 = _v212 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40dab0);
					_push(_v176);
					_push(_v180);
					L00401790();
					_v212 = _t93;
				}
				_v184 =  ~(0 | _v164 == 0x00000000);
				L0040177E();
				if(_v184 != 0) {
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v104 = L"Macrofilergalmyglaius";
					_v112 = 8;
					L004016DC();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_push(0);
					_push( &_v48);
					L00401718();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_push( &_v48);
					_push(4);
					L00401754();
				}
				asm("wait");
				_push(0x41478a);
				_t98 =  &_v28;
				_push(_t98);
				_push(0);
				L0040163A();
				return _t98;
			}

0x0041450d
0x0041451c
0x00414528
0x00414530
0x00414533
0x0041453a
0x00414549
0x0041454c
0x00414554
0x00414557
0x0041455e
0x00414561
0x00414562
0x0041456b
0x00414579
0x00414586
0x00414591
0x00414597
0x00414599
0x004145a6
0x004145c8
0x004145a8
0x004145a8
0x004145ad
0x004145b2
0x004145b5
0x004145bb
0x004145c0
0x004145c0
0x004145a6
0x004145d6
0x004145f3
0x004145d8
0x004145d8
0x004145dd
0x004145e2
0x004145e7
0x004145e7
0x00414605
0x0041461d
0x00414620
0x00414622
0x0041462f
0x00414651
0x00414631
0x00414631
0x00414633
0x00414638
0x0041463e
0x00414644
0x00414649
0x00414649
0x0041465b
0x00414676
0x0041467c
0x0041467e
0x0041468b
0x004146b0
0x0041468d
0x0041468d
0x00414692
0x00414697
0x0041469d
0x004146a3
0x004146a8
0x004146a8
0x004146c5
0x004146cf
0x004146dd
0x004146df
0x004146e6
0x004146ed
0x004146f4
0x004146fb
0x00414702
0x00414709
0x00414710
0x0041471d
0x00414725
0x00414729
0x0041472d
0x0041472e
0x00414733
0x00414734
0x0041473c
0x00414740
0x00414744
0x00414748
0x00414749
0x0041474b
0x00414750
0x00414753
0x00414754
0x0041477e
0x00414781
0x00414782
0x00414784
0x00414789

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00414528
#554.MSVBVM60(?,?,?,?,00401556), ref: 0041454C
#556.MSVBVM60(00006003), ref: 00414562
__vbaHresultCheckObj.MSVBVM60(00000000,00401510,0040D0C8,00000084), ref: 004145BB
__vbaNew2.MSVBVM60(0040D854,00416408,00006003), ref: 004145E2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D844,00000014), ref: 00414644
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040DAB0,00000128), ref: 004146A3
__vbaFreeObj.MSVBVM60(00000000,?,0040DAB0,00000128), ref: 004146CF
__vbaVarDup.MSVBVM60(00000000,?,0040DAB0,00000128), ref: 0041471D
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 00414734
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 0041474B
__vbaAryDestruct.MSVBVM60(00000000,?,0041478A), ref: 00414784

Strings

Macrofilergalmyglaius, xrefs: 00414709

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$#554#556#595ChkstkDestructListNew2
String ID: Macrofilergalmyglaius
API String ID: 1152686677-472335039
Opcode ID: f9d840a7053dd587a50dccb54b50fa837061eacf0a73a65b5dce8427b84a6510
Instruction ID: c6f10462a8410d2a8960b47a73627b166beadf5fd8261ae1c87d1085408258ef
Opcode Fuzzy Hash: f9d840a7053dd587a50dccb54b50fa837061eacf0a73a65b5dce8427b84a6510
Instruction Fuzzy Hash: 76610471D01218EFDB10DF94CC45BDEBBB8AF45304F0081AAE109AB1A0D7785A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00414363, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00414363(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				char* _v72;
				intOrPtr _v80;
				intOrPtr _v104;
				intOrPtr _v112;
				char _v132;
				intOrPtr* _v136;
				signed int _v140;
				intOrPtr* _v148;
				signed int _v152;
				char* _t44;
				signed int _t48;
				intOrPtr _t69;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t69;
				L00401550();
				_v12 = _t69;
				_v8 = 0x4014f0;
				_push(0x664908);
				_push(0x26065);
				E0040D2C8();
				_v132 = 0x84;
				L0040171E();
				if(_v132 == 0x19b5e1) {
					_v40 = _a4;
					_v48 = 9;
					_v72 = L"PUNYSHIP";
					_v80 = 8;
					if( *0x416010 != 0) {
						_v148 = 0x416010;
					} else {
						_push(0x416010);
						_push(0x40c818);
						L00401784();
						_v148 = 0x416010;
					}
					_t44 =  &_v32;
					L0040178A();
					_v136 = _t44;
					_t48 =  *((intOrPtr*)( *_v136 + 0x60))(_v136,  &_v132, _t44,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x2fc))( *_v148));
					asm("fclex");
					_v140 = _t48;
					if(_v140 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x40d8ec);
						_push(_v136);
						_push(_v140);
						L00401790();
						_v152 = _t48;
					}
					_v104 = _v132;
					_v112 = 3;
					_push(0x10);
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					0x84 = 0x10;
					L00401550();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(3);
					_push(L"bfP7Mb5wq0D2CskYY5DLQ6YRlv166");
					_push(_v24);
					L004016E8();
					L0040177E();
				}
				_v28 = 0x8114f1;
				_push(0x4144ef);
				L0040177E();
				return 0x84;
			}

0x00414368
0x00414373
0x00414374
0x00414380
0x00414388
0x0041438b
0x00414392
0x00414397
0x0041439c
0x004143a1
0x004143a4
0x004143b0
0x004143b9
0x004143bc
0x004143c3
0x004143ca
0x004143d8
0x004143f5
0x004143da
0x004143da
0x004143df
0x004143e4
0x004143e9
0x004143e9
0x00414419
0x0041441d
0x00414422
0x0041443a
0x0041443d
0x0041443f
0x0041444c
0x0041446e
0x0041444e
0x0041444e
0x00414450
0x00414455
0x0041445b
0x00414461
0x00414466
0x00414466
0x00414478
0x0041447b
0x00414482
0x00414485
0x0041448f
0x00414490
0x00414491
0x00414492
0x00414493
0x00414496
0x004144a0
0x004144a1
0x004144a2
0x004144a3
0x004144a6
0x004144a7
0x004144b1
0x004144b2
0x004144b3
0x004144b4
0x004144b5
0x004144b7
0x004144bc
0x004144bf
0x004144ca
0x004144ca
0x004144cf
0x004144d6
0x004144e9
0x004144ee

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00414380
__vbaSetSystemError.MSVBVM60(00026065,00664908,?,?,?,?,00401556), ref: 004143A4
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 004143E4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041441D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8EC,00000060), ref: 00414461
__vbaChkstk.MSVBVM60(00000000,?,0040D8EC,00000060), ref: 00414485
__vbaChkstk.MSVBVM60(00000000,?,0040D8EC,00000060), ref: 00414496
__vbaChkstk.MSVBVM60(00000000,?,0040D8EC,00000060), ref: 004144A7
__vbaLateMemCall.MSVBVM60(?,bfP7Mb5wq0D2CskYY5DLQ6YRlv166,00000003), ref: 004144BF
__vbaFreeObj.MSVBVM60 ref: 004144CA
__vbaFreeObj.MSVBVM60(004144EF), ref: 004144E9

Strings

PUNYSHIP, xrefs: 004143C3
bfP7Mb5wq0D2CskYY5DLQ6YRlv166, xrefs: 004144B7

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$Free$CallCheckErrorHresultLateNew2System
String ID: PUNYSHIP$bfP7Mb5wq0D2CskYY5DLQ6YRlv166
API String ID: 3041345567-1303529257
Opcode ID: 2df3d04a509712158a009f0527e4087db4cea50aa10e5233028085547ac04ad7
Instruction ID: 00c510bcb7e78817c402d7628f48f1cd0f6582ab4feca03cb3df4bfc0354fe3f
Opcode Fuzzy Hash: 2df3d04a509712158a009f0527e4087db4cea50aa10e5233028085547ac04ad7
Instruction Fuzzy Hash: 3F415170D00218AFCF10EF94C846BDEBBB5BF44704F1084AAF505BB291DBB969849F58

Uniqueness

Uniqueness Score: -1.00%

Function 0041345D, Relevance: 22.6, APIs: 15, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041345D(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				char _v36;
				char _v44;
				char _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				char* _t61;
				signed int _t65;
				char* _t69;
				signed int _t72;
				intOrPtr _t92;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t92;
				_push(0x54);
				L00401550();
				_v12 = _t92;
				_v8 = 0x401470;
				_v36 = 2;
				_v44 = 2;
				_push( &_v44);
				_push( &_v60);
				L00401664();
				_push( &_v60);
				L004016AC();
				L0040176C();
				_push( &_v60);
				_push( &_v44);
				_push(2);
				L00401754();
				if( *0x416010 != 0) {
					_v92 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v92 = 0x416010;
				}
				_t61 =  &_v28;
				L0040178A();
				_v80 = _t61;
				_v68 = 1;
				_v76 = 2;
				L00401550();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t65 =  *((intOrPtr*)( *_v80 + 0x1b8))(_v80, 0x10, _t61,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x300))( *_v92));
				asm("fclex");
				_v84 = _t65;
				if(_v84 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1b8);
					_push(0x40d930);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v96 = _t65;
				}
				L0040177E();
				if( *0x416010 != 0) {
					_v100 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v100 = 0x416010;
				}
				_t69 =  &_v28;
				L0040178A();
				_v80 = _t69;
				_t72 =  *((intOrPtr*)( *_v80 + 0x128))(_v80, _t69,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x314))( *_v100));
				asm("fclex");
				_v84 = _t72;
				if(_v84 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40d8b0);
					_push(_v80);
					_push(_v84);
					L00401790();
					_v104 = _t72;
				}
				L0040177E();
				_push(0x413622);
				L0040174E();
				return _t72;
			}

0x00413462
0x0041346d
0x0041346e
0x00413475
0x00413478
0x00413480
0x00413483
0x0041348a
0x00413491
0x0041349b
0x0041349f
0x004134a0
0x004134a8
0x004134a9
0x004134b3
0x004134bb
0x004134bf
0x004134c0
0x004134c2
0x004134d1
0x004134eb
0x004134d3
0x004134d3
0x004134d8
0x004134dd
0x004134e2
0x004134e2
0x00413506
0x0041350a
0x0041350f
0x00413512
0x00413519
0x00413523
0x0041352d
0x0041352e
0x0041352f
0x00413530
0x00413539
0x0041353f
0x00413541
0x00413548
0x00413564
0x0041354a
0x0041354a
0x0041354f
0x00413554
0x00413557
0x0041355a
0x0041355f
0x0041355f
0x0041356b
0x00413577
0x00413591
0x00413579
0x00413579
0x0041357e
0x00413583
0x00413588
0x00413588
0x004135ac
0x004135b0
0x004135b5
0x004135c0
0x004135c6
0x004135c8
0x004135cf
0x004135eb
0x004135d1
0x004135d1
0x004135d6
0x004135db
0x004135de
0x004135e1
0x004135e6
0x004135e6
0x004135f2
0x004135f7
0x0041361c
0x00413621

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00413478
#613.MSVBVM60(?,00000002,?,?,?,?,?,?,?,00401556), ref: 004134A0
__vbaStrVarMove.MSVBVM60(?,?,00000002,?,?,?,?,?,?,?,00401556), ref: 004134A9
__vbaStrMove.MSVBVM60(?,?,00000002,?,?,?,?,?,?,?,00401556), ref: 004134B3
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,?,?,00000002,?,?,?,?,?,?,?,00401556), ref: 004134C2
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 004134DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041350A
__vbaChkstk.MSVBVM60(?,00000000), ref: 00413523
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D930,000001B8), ref: 0041355A
__vbaFreeObj.MSVBVM60(00000000,?,0040D930,000001B8), ref: 0041356B
__vbaNew2.MSVBVM60(0040C818,00416010), ref: 00413583
__vbaObjSet.MSVBVM60(?,00000000), ref: 004135B0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8B0,00000128), ref: 004135E1
__vbaFreeObj.MSVBVM60(00000000,?,0040D8B0,00000128), ref: 004135F2
__vbaFreeStr.MSVBVM60(00413622), ref: 0041361C

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultMoveNew2$#613List
String ID:
API String ID: 2327097976-0
Opcode ID: 5f45e20af88d115c068755b5b6b93d5974254678d5c1b456dbc11ad815106188
Instruction ID: e737ec4e98ebdf22470d3c1c3c1a708d4a14bd61f1aa06e4fee34e8842915ab9
Opcode Fuzzy Hash: 5f45e20af88d115c068755b5b6b93d5974254678d5c1b456dbc11ad815106188
Instruction Fuzzy Hash: 8751CA75D00208AFCB00EFD5C85ABDDBBB9BF08709F10442AF502BB2A1DBB95585DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004133AC, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E004133AC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				char _v44;
				char* _t14;
				intOrPtr _t28;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t28;
				_push(0x1c);
				L00401550();
				_v12 = _t28;
				_v8 = 0x401460;
				L00401688();
				_push( &_v44);
				L00401670();
				_t14 =  &_v44;
				_push(_t14);
				L004016AC();
				L0040176C();
				L00401760();
				_push(0x40dac4);
				_push(0x40da28);
				_push(0);
				L0040166A();
				if(_t14 != 1) {
					_push(L"overvurderingerbe");
					L00401772();
				}
				_push(0x41344a);
				L0040174E();
				L0040174E();
				return _t14;
			}

0x004133b1
0x004133bc
0x004133bd
0x004133c4
0x004133c7
0x004133cf
0x004133d2
0x004133df
0x004133e7
0x004133e8
0x004133ed
0x004133f0
0x004133f1
0x004133fb
0x00413403
0x00413408
0x0041340d
0x00413412
0x00413414
0x0041341d
0x0041341f
0x00413424
0x00413424
0x00413429
0x0041343c
0x00413444
0x00413449

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 004133C7
__vbaStrCopy.MSVBVM60(?,?,?,?,00401556), ref: 004133DF
#612.MSVBVM60(?,?,?,?,?,00401556), ref: 004133E8
__vbaStrVarMove.MSVBVM60(?,?,?,?,?,?,00401556), ref: 004133F1
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401556), ref: 004133FB
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,00401556), ref: 00413403
__vbaStrComp.MSVBVM60(00000000,0040DA28,0040DAC4,?,?,?,?,?,?,00401556), ref: 00413414
#532.MSVBVM60(overvurderingerbe,00000000,0040DA28,0040DAC4,?,?,?,?,?,?,00401556), ref: 00413424
__vbaFreeStr.MSVBVM60(0041344A,00000000,0040DA28,0040DAC4,?,?,?,?,?,?,00401556), ref: 0041343C
__vbaFreeStr.MSVBVM60(0041344A,00000000,0040DA28,0040DAC4,?,?,?,?,?,?,00401556), ref: 00413444

Strings

overvurderingerbe, xrefs: 0041341F

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#532#612ChkstkCompCopy
String ID: overvurderingerbe
API String ID: 2787426647-2627756068
Opcode ID: f1bea1b0c1131b2010bd8240c53b849bddaaec3bbba04f10ff279a0fada12d4a
Instruction ID: ed1dca1a03f6f7580c177d9fa5c0f54fff1d70eed5f5ecd50817dd1bb15f8358
Opcode Fuzzy Hash: f1bea1b0c1131b2010bd8240c53b849bddaaec3bbba04f10ff279a0fada12d4a
Instruction Fuzzy Hash: 9C015274A40249ABC700FFA5CC53FDE7768EB04758F54443BB101730E1DABC6A458A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00412C05, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00412C05(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				char _v48;
				char* _v56;
				intOrPtr _v64;
				char* _t20;
				void* _t30;
				void* _t32;
				intOrPtr _t33;

				_t33 = _t32 - 0xc;
				 *[fs:0x0] = _t33;
				L00401550();
				_v16 = _t33;
				_v12 = 0x401420;
				_v8 = 0;
				_t20 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x401556, _t30);
				asm("fldz");
				L004015B0();
				L00401778();
				asm("fcomp qword [0x401418]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					_v56 = L"KOLLABORERENDE";
					_v64 = 8;
					L004016DC();
					_t20 =  &_v48;
					_push(_t20);
					L004016BE();
					L0040176C();
					L00401760();
				}
				_v32 = 0x25087b;
				asm("wait");
				_push(0x412cb1);
				L0040174E();
				return _t20;
			}

0x00412c08
0x00412c17
0x00412c21
0x00412c29
0x00412c2c
0x00412c33
0x00412c42
0x00412c45
0x00412c47
0x00412c4c
0x00412c51
0x00412c57
0x00412c59
0x00412c5a
0x00412c5c
0x00412c63
0x00412c70
0x00412c75
0x00412c78
0x00412c79
0x00412c83
0x00412c8b
0x00412c8b
0x00412c90
0x00412c97
0x00412c98
0x00412cab
0x00412cb0

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00412C21
_CIatan.MSVBVM60(?,?,?,?,00401556), ref: 00412C47
__vbaFpR8.MSVBVM60(?,?,?,?,00401556), ref: 00412C4C
__vbaVarDup.MSVBVM60 ref: 00412C70
#667.MSVBVM60(?), ref: 00412C79
__vbaStrMove.MSVBVM60(?), ref: 00412C83
__vbaFreeVar.MSVBVM60(?), ref: 00412C8B
__vbaFreeStr.MSVBVM60(00412CB1), ref: 00412CAB

Strings

KOLLABORERENDE, xrefs: 00412C5C

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#667ChkstkIatanMove
String ID: KOLLABORERENDE
API String ID: 3371078092-809295731
Opcode ID: b7e9e0d81fc666698f088223ce452e03e281ee0deb0c2242251cf733533b8cd0
Instruction ID: 3533ced078be6d9046a2b254019dde8651767b7c6f4eaaa93b1b35d145af2439
Opcode Fuzzy Hash: b7e9e0d81fc666698f088223ce452e03e281ee0deb0c2242251cf733533b8cd0
Instruction Fuzzy Hash: FD011E70D00208ABCB00EFA5D956BDEBBB4BF40744F50852AF101BB1A1DB7855598B99

Uniqueness

Uniqueness Score: -1.00%

Function 00412F65, Relevance: 15.1, APIs: 10, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00412F65(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				char* _t47;
				signed int _t50;
				char* _t54;
				signed int _t58;
				intOrPtr _t75;

				_push(0x401556);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t75;
				_push(0x30);
				L00401550();
				_v12 = _t75;
				_v8 = 0x401440;
				if( *0x416010 != 0) {
					_v56 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v56 = 0x416010;
				}
				_t47 =  &_v24;
				L0040178A();
				_v44 = _t47;
				_t50 =  *((intOrPtr*)( *_v44 + 0x138))(_v44, _t47,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x314))( *_v56));
				asm("fclex");
				_v48 = _t50;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x40d8b0);
					_push(_v44);
					_push(_v48);
					L00401790();
					_v60 = _t50;
				}
				L0040177E();
				if( *0x416010 != 0) {
					_v64 = 0x416010;
				} else {
					_push(0x416010);
					_push(0x40c818);
					L00401784();
					_v64 = 0x416010;
				}
				_t54 =  &_v24;
				L0040178A();
				_v44 = _t54;
				_v32 = 1;
				_v40 = 2;
				L00401550();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t58 =  *((intOrPtr*)( *_v44 + 0x17c))(_v44, 0x10, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x304))( *_v64));
				asm("fclex");
				_v48 = _t58;
				if(_v48 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x17c);
					_push(0x40d8dc);
					_push(_v44);
					_push(_v48);
					L00401790();
					_v68 = _t58;
				}
				L0040177E();
				_push(0x4130d0);
				return _t58;
			}

0x00412f6a
0x00412f75
0x00412f76
0x00412f7d
0x00412f80
0x00412f88
0x00412f8b
0x00412f99
0x00412fb3
0x00412f9b
0x00412f9b
0x00412fa0
0x00412fa5
0x00412faa
0x00412faa
0x00412fce
0x00412fd2
0x00412fd7
0x00412fe2
0x00412fe8
0x00412fea
0x00412ff1
0x0041300d
0x00412ff3
0x00412ff3
0x00412ff8
0x00412ffd
0x00413000
0x00413003
0x00413008
0x00413008
0x00413014
0x00413020
0x0041303a
0x00413022
0x00413022
0x00413027
0x0041302c
0x00413031
0x00413031
0x00413055
0x00413059
0x0041305e
0x00413061
0x00413068
0x00413072
0x0041307c
0x0041307d
0x0041307e
0x0041307f
0x00413088
0x0041308e
0x00413090
0x00413097
0x004130b3
0x00413099
0x00413099
0x0041309e
0x004130a3
0x004130a6
0x004130a9
0x004130ae
0x004130ae
0x004130ba
0x004130bf
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401556), ref: 00412F80
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,00401556), ref: 00412FA5
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401556), ref: 00412FD2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8B0,00000138,?,?,?,?,?,?,?,?,?,?,00401556), ref: 00413003
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401556), ref: 00413014
__vbaNew2.MSVBVM60(0040C818,00416010,?,?,?,?,?,?,?,?,?,?,00401556), ref: 0041302C
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401556), ref: 00413059
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401556), ref: 00413072
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8DC,0000017C), ref: 004130A9
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401556), ref: 004130BA

Memory Dump Source

Source File: 00000001.00000002.739583535.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.739569051.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.739634026.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.739651089.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 83e75afda9e3d81f487fcf708e820a82cd1915af552f43b922929657355e6d25
Instruction ID: 4918f3dbd1a61c6bfe595fc77dc2769ca7b7064828b15a8abac1a8fabecee97c
Opcode Fuzzy Hash: 83e75afda9e3d81f487fcf708e820a82cd1915af552f43b922929657355e6d25
Instruction Fuzzy Hash: A7410975900208AFCB00DFA5C845BDDBBB5AF0C719F20846AF402B72A1CBB95985DF69

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report qhw7KZSA53.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: qhw7KZSA53.exe PID: 5380 Parent PID: 5800

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: qhw7KZSA53.exe PID: 5380 Parent PID: 5800 qhw7KZSA53.exeCOMMON

Executed Functions

Function 0040E3F4, Relevance: 188.6, APIs: 98, Strings: 9, Instructions: 1328COMMON

Function 004017B0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136COMMON

Function 0040E3F4, Relevance: 188.6, APIs: 98, Strings: 9, Instructions: 1328
COMMON

Function 004017B0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136
COMMON

Function 004147A9, Relevance: 55.9, APIs: 37, Instructions: 353
COMMON

Function 00414D30, Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 296
COMMON

Function 004130E3, Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 196
COMMON

Function 00413D35, Relevance: 40.8, APIs: 27, Instructions: 269
COMMON

Function 00413AE9, Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 142
COMMON

Function 00412924, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 170
COMMON

Function 00413886, Relevance: 27.1, APIs: 18, Instructions: 134
COMMON

Function 004141B1, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 106
COMMON

Function 00412CD8, Relevance: 25.7, APIs: 17, Instructions: 166
COMMON

Function 00413635, Relevance: 24.2, APIs: 16, Instructions: 161
COMMON

Function 0041450A, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 149
COMMON

Function 00414363, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108
COMMON

Function 0041345D, Relevance: 22.6, APIs: 15, Instructions: 128
COMMON

Function 004133AC, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 45
COMMON

Function 00412C05, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 47
COMMON

Function 00412F65, Relevance: 15.1, APIs: 10, Instructions: 106
COMMON