Play interactive tour

Edit tour

Windows Analysis Report OFFER-8768777765554-PDF.exe

Overview

General Information

Sample Name:	OFFER-8768777765554-PDF.exe
Analysis ID:	435174
MD5:	dd34ccb897fa3b88af6d3da17b713b3a
SHA1:	01f5eebafc304ec00e25c2c52751cc24d05dd8c9
SHA256:	709cc1b84208f4dd7f541a50772c7888f704561866eccd4b1aee0e1ba6e3ac74
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

OFFER-8768777765554-PDF.exe (PID: 5804 cmdline: 'C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe' MD5: DD34CCB897FA3B88AF6D3DA17B713B3A)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://onedrive.live.com/download?cid=51D628A65732BF05&resid=51D628A65732BF05%21161&authkey=ABg4zwujoOrC4rM, https://onedrive.live.com/download?cid=CC6C941704A208C4&resid=CC6C941704"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
OFFER-8768777765554-PDF.exe	JoeSecurity_GuLoader_1	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: OFFER-8768777765554-PDF.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cid=51D628A65732BF05&resid=51D628A65732BF05%21161&authkey=ABg4zwujoOrC4rM, https://onedrive.live.com/download?cid=CC6C941704A208C4&resid=CC6C941704"}

Multi AV Scanner detection for submitted file

Show sources

Source: OFFER-8768777765554-PDF.exe

Virustotal: Detection: 13%

Perma Link

Source: OFFER-8768777765554-PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://onedrive.live.com/download?cid=51D628A65732BF05&resid=51D628A65732BF05%21161&authkey=ABg4zwujoOrC4rM, https://onedrive.live.com/download?cid=CC6C941704A208C4&resid=CC6C941704

Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577399025.00000000006AA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5A9F NtAllocateVirtualMemory,	0_2_022E5A9F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E574E NtAllocateVirtualMemory,	0_2_022E574E
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5B47 NtAllocateVirtualMemory,	0_2_022E5B47
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5BB0 NtAllocateVirtualMemory,	0_2_022E5BB0
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5B93 NtAllocateVirtualMemory,	0_2_022E5B93

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_0040DCBE	0_2_0040DCBE
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5A9F	0_2_022E5A9F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3E2B	0_2_022E3E2B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8233	0_2_022E8233
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E761E	0_2_022E761E
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E1212	0_2_022E1212
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E0E6B	0_2_022E0E6B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E96A1	0_2_022E96A1
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3E87	0_2_022E3E87
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8A98	0_2_022E8A98
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E06C4	0_2_022E06C4
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E12D5	0_2_022E12D5
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3F3D	0_2_022E3F3D
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E230E	0_2_022E230E
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2F1B	0_2_022E2F1B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E574E	0_2_022E574E
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E374B	0_2_022E374B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E5B47	0_2_022E5B47
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2751	0_2_022E2751
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2F8B	0_2_022E2F8B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3783	0_2_022E3783
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3F95	0_2_022E3F95
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2BC4	0_2_022E2BC4
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E1BC1	0_2_022E1BC1
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E283B	0_2_022E283B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E0000	0_2_022E0000
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E587C	0_2_022E587C
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E1043	0_2_022E1043
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2C56	0_2_022E2C56
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E4055	0_2_022E4055
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8C53	0_2_022E8C53
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E40AD	0_2_022E40AD
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E10AB	0_2_022E10AB
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2CA3	0_2_022E2CA3
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E4CBC	0_2_022E4CBC
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E6089	0_2_022E6089
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8C91	0_2_022E8C91
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E10CD	0_2_022E10CD
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E292F	0_2_022E292F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E0D25	0_2_022E0D25
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E4523	0_2_022E4523
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E211D	0_2_022E211D
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E0D6D	0_2_022E0D6D
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E1167	0_2_022E1167
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2564	0_2_022E2564
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2944	0_2_022E2944
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E11A7	0_2_022E11A7
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E05BE	0_2_022E05BE
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E4D89	0_2_022E4D89
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E11E3	0_2_022E11E3
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3DE3	0_2_022E3DE3
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E29FF	0_2_022E29FF

Source: OFFER-8768777765554-PDF.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: OFFER-8768777765554-PDF.exe, 00000000.00000000.194465860.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameStemmeskred7.exe vs OFFER-8768777765554-PDF.exe
Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577492034.00000000021C0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStemmeskred7.exeFE2Xe vs OFFER-8768777765554-PDF.exe
Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577518185.00000000022D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs OFFER-8768777765554-PDF.exe
Source: OFFER-8768777765554-PDF.exe	Binary or memory string: OriginalFilenameStemmeskred7.exe vs OFFER-8768777765554-PDF.exe

Source: OFFER-8768777765554-PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

File created: C:\Users\user\AppData\Local\Temp\~DF5C597FFB7E664D03.TMP

Jump to behavior

Source: OFFER-8768777765554-PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OFFER-8768777765554-PDF.exe

Virustotal: Detection: 13%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: OFFER-8768777765554-PDF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.OFFER-8768777765554-PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OFFER-8768777765554-PDF.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_0040506F pushfd ; retf	0_2_0040508C
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00408090 push BAD2BC25h; retf	0_2_004080B9
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00404D00 push ds; ret	0_2_00404D0F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00405535 push cs; ret	0_2_00405553
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00408D99 push cs; ret	0_2_00408DA3
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00404206 push ebp; ret	0_2_00404207
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00407E0B push ds; retf	0_2_00407E0D
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00404A19 push edx; iretd	0_2_00404A53
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_00405619 push es; ret	0_2_0040561F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8D5B push eax; ret	0_2_022E8D63

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8A98	0_2_022E8A98
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8C53	0_2_022E8C53
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E6089	0_2_022E6089
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8C91	0_2_022E8C91
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E05BE	0_2_022E05BE

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	RDTSC instruction interceptor: First address: 00000000022E012B second address: 00000000022E012B instructions:
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	RDTSC instruction interceptor: First address: 00000000022E0392 second address: 00000000022E0392 instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	RDTSC instruction interceptor: First address: 00000000022E012B second address: 00000000022E012B instructions:
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	RDTSC instruction interceptor: First address: 00000000022E0392 second address: 00000000022E0392 instructions:
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	RDTSC instruction interceptor: First address: 00000000022E548D second address: 00000000022E548D instructions: 0x00000000 rdtsc 0x00000002 mov eax, 8513714Ah 0x00000007 sub eax, BC31FDEAh 0x0000000c sub eax, D99E02B9h 0x00000011 add eax, 10BC8F5Ah 0x00000016 cpuid 0x00000018 popad 0x00000019 jmp 00007FF5107330C6h 0x0000001b cmp ax, 0000AF66h 0x0000001f call 00007FF5107330D7h 0x00000024 lfence 0x00000027 mov edx, 0ACECDC1h 0x0000002c xor edx, 9CCC939Eh 0x00000032 add edx, 5020915Ah 0x00000038 xor edx, 99DCEFADh 0x0000003e mov edx, dword ptr [edx] 0x00000040 lfence 0x00000043 ret 0x00000044 sub edx, esi 0x00000046 ret 0x00000047 pop ecx 0x00000048 jmp 00007FF5107330C2h 0x0000004a cmp edx, ecx 0x0000004c add edi, edx 0x0000004e test dl, cl 0x00000050 dec ecx 0x00000051 cmp ecx, 00000000h 0x00000054 jne 00007FF51073307Dh 0x00000056 mov dword ptr [ebp+00000200h], esi 0x0000005c mov esi, ecx 0x0000005e push esi 0x0000005f mov esi, dword ptr [ebp+00000200h] 0x00000065 cmp ch, bh 0x00000067 call 00007FF5107330F6h 0x0000006c call 00007FF510733112h 0x00000071 lfence 0x00000074 mov edx, 0ACECDC1h 0x00000079 xor edx, 9CCC939Eh 0x0000007f add edx, 5020915Ah 0x00000085 xor edx, 99DCEFADh 0x0000008b mov edx, dword ptr [edx] 0x0000008d lfence 0x00000090 ret 0x00000091 mov esi, edx 0x00000093 pushad 0x00000094 rdtsc

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Code function: 0_2_022E3E2B rdtsc

0_2_022E3E2B

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

API coverage: 8.5 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Code function: 0_2_022E3E2B rdtsc

0_2_022E3E2B

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E8A98 mov eax, dword ptr fs:[00000030h]	0_2_022E8A98
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E536F mov eax, dword ptr fs:[00000030h]	0_2_022E536F
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E374B mov eax, dword ptr fs:[00000030h]	0_2_022E374B
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E3783 mov eax, dword ptr fs:[00000030h]	0_2_022E3783
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E2BC4 mov eax, dword ptr fs:[00000030h]	0_2_022E2BC4
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E7C09 mov eax, dword ptr fs:[00000030h]	0_2_022E7C09
Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe	Code function: 0_2_022E811C mov eax, dword ptr fs:[00000030h]	0_2_022E811C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577434686.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577434686.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577434686.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: OFFER-8768777765554-PDF.exe, 00000000.00000002.577434686.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe

Code function: 0_2_022E1453 cpuid

0_2_022E1453

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery41	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery311	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OFFER-8768777765554-PDF.exe	13%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?cid=51D628A65732BF05&resid=51D628A65732BF05%21161&authkey=ABg4zwujoOrC4rM, https://onedrive.live.com/download?cid=CC6C941704A208C4&resid=CC6C941704	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	435174
Start date:	16.06.2021
Start time:	05:32:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OFFER-8768777765554-PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 52.5% (good quality ratio 31.2%) Quality average: 37.6% Quality standard deviation: 35.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Max analysis timeout: 220s exceeded, the analysis took too long Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, RuntimeBroker.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.8993604994375675
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OFFER-8768777765554-PDF.exe
File size:	94208
MD5:	dd34ccb897fa3b88af6d3da17b713b3a
SHA1:	01f5eebafc304ec00e25c2c52751cc24d05dd8c9
SHA256:	709cc1b84208f4dd7f541a50772c7888f704561866eccd4b1aee0e1ba6e3ac74
SHA512:	a27103e8c475bfe2edbbc1d6de7b9526fc2eca1b0ac2f029c784088fc635892d3fe5c402fe8c55971face6309bd17b8f326c1b384a940803fd4ea1eede4b9f29
SSDEEP:	1536:0VktxQ6lleR1nwjoWlc7hyCTyStNCEXHa3y2C/u5W3EUanOYA2nJ29GLwb7zN9gm:0OXQqlG1w0WqwCTySPNu5W3EUanOYA2a
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c.S............&........ .......$......Rich....................PE..L....:.H.................@...0......D........P....@........

File Icon


Icon Hash:	11c0c48486cc08c4

Static PE Info

General
Entrypoint:	0x401644
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x48913AA8 [Thu Jul 31 04:08:08 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d5d16d1b76210dd28c8586fe9bac3119

Entrypoint Preview

Instruction
push 00402794h
call 00007FF510CDF283h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dh, bl
je 00007FF510CDF27Dh
cwde
rol byte ptr [ecx+19h], 00000043h
wait
call far 0FA0h : FF9A47FDh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
pop ss
add eax, dword ptr [edi+00h]
add byte ptr [eax], al
outsd
jo 00007FF510CDF304h
imul esp, dword ptr [ebx+esi*2+6Eh], 65676E69h
jc 00007FF510CDF292h
pop es
inc ecx
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add dh, bl
scasb
adc al, 00h
jo 00007FF510CDF2F3h
cmpsd
dec edi
xchg eax, edi
cli
sbb dword ptr [edi+58h], 97C001B7h
mov ch, 3Fh
std
out dx, eax
xchg eax, edx
and al, byte ptr [eax+esi*4+53h]
inc ebx
mov byte ptr [3A942196h], al
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop esi
or al, byte ptr [eax]
add byte ptr [ecx+0Ah], bl
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [edx+4Fh], dl
push ebx
inc ecx
dec ebp
push ebp
dec esi
inc esp
inc ecx
push ebx
add byte ptr [73000F01h], cl
je 00007FF510CDF30Bh
jc 00007FF510CDF2F7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13b94	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0xd86	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x190	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x131c8	0x14000	False	0.495971679688	data	6.27184152045	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0x1b84	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0xd86	0x1000	False	0.346435546875	data	3.582300179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x17c5e	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x173b6	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 16776176, next used block 10526884
RT_GROUP_ICON	0x17394	0x22	data
RT_VERSION	0x17120	0x274	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLineInputStr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaErase, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaI2I4, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaInStrB, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaVarLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, __vbaFPInt, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Stemmeskred7
FileVersion	1.00
CompanyName	Violet Solution
Comments	Violet Solution
ProductName	opridsninger
ProductVersion	1.00
OriginalFilename	Stemmeskred7.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: OFFER-8768777765554-PDF.exe PID: 5804 Parent PID: 5696

General

Start time:	05:33:09
Start date:	16/06/2021
Path:	C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OFFER-8768777765554-PDF.exe'
Imagebase:	0x400000
File size:	94208 bytes
MD5 hash:	DD34CCB897FA3B88AF6D3DA17B713B3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: OFFER-8768777765554-PDF.exe PID: 5804 Parent PID: 5696 OFFER-8768777765554-PDF.exeCOMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	73%
Signature Coverage:	52.4%
Total number of Nodes:	523
Total number of Limit Nodes:	19

Executed Functions

Function 022E574E, Relevance: 1.9, APIs: 1, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 69b248f5eb48717a5b55b4e4770cfe6ceafeca9016f6fed424941847c7a5fbd6
Instruction ID: 7d8e561e8287b73d16db67873826f60dd8dca3c8cfa47aa36387d3774c6298b6
Opcode Fuzzy Hash: 69b248f5eb48717a5b55b4e4770cfe6ceafeca9016f6fed424941847c7a5fbd6
Instruction Fuzzy Hash: D3D166715343868FDF349EB888D87E937A2AF0531CFD5005ED8978B269C735898ADB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E5A9F, Relevance: 1.7, APIs: 1, Instructions: 151
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 022E5CA6

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 12b1580cb88ed6afe704c7b20e0a36b8cdcb0031e71c6139c8fdb254ba7150fa
Instruction ID: 908e32586566435721a40a5114aec36d77bde8879330072d16ace39c4ce91aac
Opcode Fuzzy Hash: 12b1580cb88ed6afe704c7b20e0a36b8cdcb0031e71c6139c8fdb254ba7150fa
Instruction Fuzzy Hash: F8513671524345CFDF749EA8C8907EA77A1AF16354FD1051EDC8ADB264C3758982CF02

Uniqueness

Uniqueness Score: -1.00%

Function 022E5B47, Relevance: 1.6, APIs: 1, Instructions: 143
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 022E5CA6

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7dbb6633f3be611bd0947c82aec78fa96a6d5311545e618306b3f875c3bc2976
Instruction ID: 275c841d0a8f97167faab5925c0b1071caa6b06bdf4d1d4a926776bf630f1f92
Opcode Fuzzy Hash: 7dbb6633f3be611bd0947c82aec78fa96a6d5311545e618306b3f875c3bc2976
Instruction Fuzzy Hash: A3513371528385CFEF649EA8C8907EA77B1AF15318FC1001EDC8ACB2A4C3758982CF02

Uniqueness

Uniqueness Score: -1.00%

Function 022E5BB0, Relevance: 1.6, APIs: 1, Instructions: 120
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 022E5CA6

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c2ef351154fd522164ed497badb69803817f3911d8c6b685d7d064b06966120e
Instruction ID: 906f238ffb86c62189b903b7fc166d353118aad0caba9ea977137d125d1bea1a
Opcode Fuzzy Hash: c2ef351154fd522164ed497badb69803817f3911d8c6b685d7d064b06966120e
Instruction Fuzzy Hash: 1A412571528385CFDF649EA8CC907EA7BB1AF25318F85041EDCCA9B164C3318982DB56

Uniqueness

Uniqueness Score: -1.00%

Function 022E5B93, Relevance: 1.6, APIs: 1, Instructions: 98
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 022E5CA6

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b5fad6eed3b155155da9ee1f6e70e1515066ab6cd8944fd69ee197fa72f4245b
Instruction ID: 4440e3fd2ea5eddde09802689773ac2603d4ee94e9a1d0ebf6fcbe267dcf8b41
Opcode Fuzzy Hash: b5fad6eed3b155155da9ee1f6e70e1515066ab6cd8944fd69ee197fa72f4245b
Instruction Fuzzy Hash: 5B41E071528385CFDF749EA8C8907EA77B1BF16358F95041ADC8ADB264C3319A82CF06

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCBE, Relevance: 1.4, APIs: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,0000F000,00001000,?,00411040,?,?,?), ref: 0040DE61

Memory Dump Source

Source File: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 78fe51739af18337ffb0466f99c6c816bac09bc3606635ae22bcd7b704629f7f
Instruction ID: a2ecab26e3da36d737f0f95e5fdd10f0a0b155872d0b55debb7c229a61bc1933
Opcode Fuzzy Hash: 78fe51739af18337ffb0466f99c6c816bac09bc3606635ae22bcd7b704629f7f
Instruction Fuzzy Hash: 7A31C063E257249EC7835970CC40A917B51AF22291722877BED15B71A0FB3A5C4F29C9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD30, Relevance: 253.3, APIs: 117, Strings: 27, Instructions: 1278COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004013F6), ref: 0040FD4E
#526.MSVBVM60(?,00000001,?,?,?,?,004013F6), ref: 0040FD9C
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 0040FDC4
__vbaFreeVar.MSVBVM60 ref: 0040FDD7
__vbaOnError.MSVBVM60(000000FF), ref: 0040FDF5
#610.MSVBVM60(?), ref: 0040FE09
#552.MSVBVM60(?,?,00000001), ref: 0040FE1F
__vbaVarMove.MSVBVM60 ref: 0040FE31
__vbaFreeVar.MSVBVM60 ref: 0040FE3D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403524,0000015C), ref: 0040FE84
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0040FEB6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 0040FF1F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000C0), ref: 0040FF88
__vbaFreeObj.MSVBVM60 ref: 0040FFB1
__vbaVarDup.MSVBVM60 ref: 0040FFDD
#562.MSVBVM60(?), ref: 0040FFEA
__vbaFreeVar.MSVBVM60 ref: 00410008
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00410037
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 004100A0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000C8), ref: 00410109
__vbaFreeObj.MSVBVM60 ref: 00410132
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00410152
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 004101BB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000060), ref: 0041021E
__vbaStrMove.MSVBVM60 ref: 00410258
__vbaFreeObj.MSVBVM60 ref: 00410264
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403524,0000015C), ref: 004102AB
__vbaStrToAnsi.MSVBVM60(?,Expertize,?), ref: 004102DA
__vbaSetSystemError.MSVBVM60(00000000), ref: 004102EC
__vbaFreeStr.MSVBVM60 ref: 00410310
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0041033F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 004103A8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000B8), ref: 00410411
__vbaFreeObj.MSVBVM60 ref: 0041043A
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0041045A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 004104C3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000F0), ref: 0041052C
__vbaStrMove.MSVBVM60 ref: 00410563
__vbaFreeObj.MSVBVM60 ref: 0041056F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,0000071C), ref: 004105AF
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 004105DD
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0041060D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 00410676
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000118), ref: 004106DF
__vbaI2I4.MSVBVM60 ref: 004106FD
__vbaFreeObj.MSVBVM60 ref: 0041070D
#594.MSVBVM60(0000000A), ref: 00410735
__vbaFreeVar.MSVBVM60 ref: 00410741
__vbaVarDup.MSVBVM60 ref: 00410775
#667.MSVBVM60(0000000A), ref: 00410782
__vbaStrMove.MSVBVM60 ref: 0041078D
__vbaFreeVar.MSVBVM60 ref: 00410799
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 004107B5
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004107E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 0041084E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000138), ref: 004108B7
__vbaFreeObj.MSVBVM60 ref: 004108D5
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004108F5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 0041095E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000118), ref: 004109C7
__vbaI2I4.MSVBVM60 ref: 004109E5
__vbaFreeObj.MSVBVM60 ref: 004109F5
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00410A1C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000048), ref: 00410A8A
__vbaStrMove.MSVBVM60 ref: 00410AC1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,000006F8), ref: 00410B3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,000006FC), ref: 00410BBB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,00000700), ref: 00410C39
__vbaStrCopy.MSVBVM60 ref: 00410C94
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,00000704), ref: 00410CF3
__vbaFreeStr.MSVBVM60 ref: 00410D23
__vbaStrCopy.MSVBVM60 ref: 00410D44
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,00000708), ref: 00410D92
__vbaFreeStr.MSVBVM60 ref: 00410DB9
__vbaStrCopy.MSVBVM60 ref: 00410DDB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,0000070C), ref: 00410E43

Part of subcall function 0040DCBE: VirtualAlloc.KERNELBASE(00000000,0000F000,00001000,?,00411040,?,?,?), ref: 0040DE61

__vbaFreeStr.MSVBVM60 ref: 00410E61
__vbaStrCopy.MSVBVM60 ref: 00410E82
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,00000710), ref: 00410ED5
__vbaFreeStr.MSVBVM60 ref: 00410EFC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403554,00000714), ref: 00410F5E
__vbaStrCopy.MSVBVM60 ref: 00410FEA
__vbaFreeStr.MSVBVM60 ref: 00411016
__vbaI4Var.MSVBVM60(00000009,?,?,?), ref: 00411047
__vbaStrToAnsi.MSVBVM60(?,Cuproplumbite,?,?,?), ref: 00411063
__vbaStrMove.MSVBVM60(00000000,?,?,?), ref: 00411077
__vbaSetSystemError.MSVBVM60(?,?,?), ref: 0041107D
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?), ref: 00411091
__vbaR8Str.MSVBVM60(00000000,?,?,?), ref: 00411098
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,?), ref: 004110E7
#705.MSVBVM60(00000002,00000000), ref: 00411123
__vbaStrMove.MSVBVM60 ref: 0041112E
__vbaFreeVar.MSVBVM60 ref: 0041113A
#554.MSVBVM60 ref: 00411147
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00411167
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,0000004C), ref: 004111D0
__vbaChkstk.MSVBVM60 ref: 0041120D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,0000002C), ref: 0041126F
__vbaFreeObj.MSVBVM60 ref: 0041128D

Strings

ucensureret, xrefs: 00410DD0
/, xrefs: 0041114D
SAMFUNDSANSVARETS, xrefs: 00410BF7
Y), xrefs: 00410E8F, 00410E95
Expertize, xrefs: 004102CE
Hydraemic6, xrefs: 00410B06
unbudgeable, xrefs: 00410E77
<]A, xrefs: 0041046C
<]A, xrefs: 0041035B
Basisidia9, xrefs: 00410FDF
Cuproplumbite, xrefs: 00411057
<]A, xrefs: 00410629
UNIVERSALLSNINGERNE, xrefs: 00410755
entertainer, xrefs: 00410874
BULKY, xrefs: 00410F1A
<]A, xrefs: 00410049
<]A, xrefs: 00410801
<]A, xrefs: 00411183
<]A, xrefs: 0040FED2
,8@, xrefs: 00411225
<]A, xrefs: 0041016E
<]A, xrefs: 00410A38
Fustager, xrefs: 00410C89
SUPERMASCULINE, xrefs: 00410D39
<]A, xrefs: 00410907
Effigiating9, xrefs: 00410F1F
TRANSPARENCIES, xrefs: 00410E96

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckHresult$Free$New2$Move$CopyError$System$AnsiChkstk$#526#552#554#562#594#610#667#705AllocListUnicodeVirtual
String ID: ,8@$/$<]A$<]A$<]A$<]A$<]A$<]A$<]A$<]A$<]A$<]A$BULKY$Basisidia9$Cuproplumbite$Effigiating9$Expertize$Fustager$Hydraemic6$SAMFUNDSANSVARETS$SUPERMASCULINE$TRANSPARENCIES$UNIVERSALLSNINGERNE$Y)$entertainer$ucensureret$unbudgeable
API String ID: 3305970385-486493427
Opcode ID: 90a1d07b09d0e5e780a5b7832f7ced7f605ba4c07cf5c743c45768fba80a7b0f
Instruction ID: b09836e425959881c00ac2eed53493007bd6658662152b3aa39dd16ee242cd0b
Opcode Fuzzy Hash: 90a1d07b09d0e5e780a5b7832f7ced7f605ba4c07cf5c743c45768fba80a7b0f
Instruction Fuzzy Hash: 1BD207B4900229DFDB24DF50CD88BD9BBB4BB48305F1081EAE609776A0DBB85AC5DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00413070, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 004130CE
__vbaStrCopy.MSVBVM60 ref: 004130D6
#609.MSVBVM60 ref: 004130D8
#557.MSVBVM60(?), ref: 004130EC
__vbaFreeVar.MSVBVM60 ref: 00413103
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00413124
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 0041314F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000D8), ref: 0041317D
__vbaStrMove.MSVBVM60 ref: 00413188
__vbaFreeObj.MSVBVM60 ref: 00413191
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004131A9
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 004131CE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000078), ref: 004131EE
__vbaFreeObj.MSVBVM60 ref: 004131F3
#569.MSVBVM60(000000C9), ref: 004131FE
#628.MSVBVM60(FGFG,00000001,00000008), ref: 00413222
__vbaStrMove.MSVBVM60 ref: 0041322D
__vbaStrCmp.MSVBVM60(00403AEC,00000000), ref: 00413239
__vbaFreeStr.MSVBVM60 ref: 0041324C
__vbaFreeVar.MSVBVM60 ref: 00413255
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00413276
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 0041329B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000C0), ref: 004132C1
__vbaFreeObj.MSVBVM60 ref: 004132C6
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004132DE
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 00413303
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000F0), ref: 00413329
__vbaStrMove.MSVBVM60 ref: 00413334
__vbaFreeObj.MSVBVM60 ref: 0041333D
#571.MSVBVM60(00000024), ref: 00413345
__vbaFreeStr.MSVBVM60(00413390), ref: 0041337E
__vbaFreeStr.MSVBVM60 ref: 00413383
__vbaFreeStr.MSVBVM60 ref: 00413388
__vbaFreeStr.MSVBVM60 ref: 0041338D

Strings

FGFG, xrefs: 00413217

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$Copy$#557#569#571#609#628
String ID: FGFG
API String ID: 995505225-2759163656
Opcode ID: 51f15f27bd3a0d1d0d26800db3a66869711653b91b1e46e1f2a9c3e26abfb8d3
Instruction ID: 048bffb482636d2ac0d8794fae09c137758c84020e0dec1ec84ca7b13f0a0607
Opcode Fuzzy Hash: 51f15f27bd3a0d1d0d26800db3a66869711653b91b1e46e1f2a9c3e26abfb8d3
Instruction Fuzzy Hash: 779150B1900219EBCB14EFA5DD88EDEBBB8FF48705B10852AF501B72A0DA785945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00401644, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 15%

			_entry_() {
				signed char _t40;
				intOrPtr* _t41;
				signed char _t42;
				signed char _t48;
				signed char _t49;
				signed char _t50;
				signed char _t51;
				signed char _t52;
				signed int _t61;
				void* _t65;
				intOrPtr* _t66;
				signed char _t67;
				signed char _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				signed int _t77;
				void* _t79;
				intOrPtr _t90;

				_push("VB5!6&*"); // executed
				L0040163C(); // executed
				do {
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 ^ _t40;
					 *_t40 =  *_t40 + _t40;
					_t40 = _t40 + 1;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					_t68 = _t68 + _t52;
				} while (_t68 == 0);
				_t41 = _t40;
				asm("rol byte [ecx+0x19], 0x43");
				asm("wait");
				0xfa0();
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				_pop(ss);
				_t42 = _t41 +  *_t70;
				 *_t42 =  *_t42 + _t42;
				asm("outsd");
				if( *_t42 < 0) {
					L6:
					 *_t68 =  *_t68 + 0x3f;
					 *((intOrPtr*)(_t68 + 0x4f)) =  *((intOrPtr*)(_t68 + 0x4f)) + _t68;
					_push(_t52);
					_t65 = 0x40;
					_push(_t79 - 1);
					L7:
					_t66 = _t65 + 1;
					_push(_t52);
					 *0x73000f01 =  *0x73000f01 + _t66;
					_t90 =  *0x73000f01;
					if(_t90 == 0) {
						L15:
						 *_t42 =  *_t42 + _t42;
						L16:
						 *_t42 =  *_t42 + _t42;
						 *((char*)(_t42 + 0x8000)) =  *((char*)(_t42 + 0x8000));
						L17:
						 *_t42 =  *_t42 + 0x80;
						 *_t42 =  *_t42 + _t42;
						 *((intOrPtr*)(_t42 - 0x7fff8000)) =  *((intOrPtr*)(_t42 - 0x7fff8000)) + _t42;
						 *_t42 =  *_t42;
						asm("rol al, 0xc0");
						 *((intOrPtr*)(_t42 + 0x8080)) =  *((intOrPtr*)(_t42 + 0x8080)) + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + 1;
						 *_t42 =  *_t42 + _t42;
						asm("invalid");
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + 1;
						asm("invalid");
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t66 =  *_t66 + _t68;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t66 =  *_t66 + _t42;
						asm("cdq");
						asm("cdq");
						asm("adc [eax], al");
						 *_t42 =  *_t42 + _t42;
						 *((intOrPtr*)(_t66 + 0x90f11f)) =  *((intOrPtr*)(_t66 + 0x90f11f)) + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52 + _t52;
						asm("adc esi, [ebx]");
						 *((intOrPtr*)(_t66 + 0x109100ff)) =  *((intOrPtr*)(_t66 + 0x109100ff)) + _t68;
						_t67 = _t42;
						asm("invalid");
						asm("adc [ecx], cl");
						_t61 = _t66;
						asm("invalid");
						 *(_t67 - 0x40f7ff67) =  *(_t67 - 0x40f7ff67) | _t61;
						asm("invalid");
						 *0x91b8ff00 =  *0x91b8ff00 + 0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00 + 0x91b8ff00;
						 *_t61 =  *_t61 + _t68;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *_t61 =  *_t61 + _t67;
						asm("sbb al, 0x0");
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						asm("invalid");
						 *0x91b8ff00 =  *0x91b8ff00;
						asm("invalid");
						 *0x91b8ff00 =  *0x91b8ff00;
						asm("jecxz 0x1");
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0xFFFFFFFF91B8FFFF =  *((intOrPtr*)(0xffffffff91b8ffff));
						asm("rol dword [eax], 0x0");
						 *0x91b8ff00 =  *0x91b8ff00;
						asm("pushad");
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0x91b8ff00 =  *0x91b8ff00;
						asm("sbb [eax-0x7f7d0000], eax");
						 *0x91b8ff00 =  *0x91b8ff00;
						 *0 =  *0;
						goto __edi;
					}
					if(_t90 < 0) {
						L14:
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42 + _t42;
						 *_t42 =  *_t42;
						 *_t42 =  *_t42;
						goto L15;
					}
					if(_t90 >= 0) {
						goto L17;
					}
					if(_t90 >= 0) {
						goto L16;
					}
					asm("gs insd");
					if(_t90 < 0) {
						goto L15;
					}
					 *[gs:ecx] =  *[gs:ecx] + _t52;
					 *_t42 =  *_t42 + _t42;
					_t69 = _t68 + 1;
					 *_t69 =  *_t69 + _t42;
					 *_t66 =  *_t66 - 1;
					 *_t42 =  *_t42 + _t42;
					asm("insb");
					if ( *_t42 == 0) goto L13;
					_t68 = _t69 + _t69;
					 *_t42 =  *_t42 | _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t66 =  *_t66 + _t42;
					 *_t68 =  *_t68 + _t42;
					 *_t42 =  *_t42 + _t68;
					asm("adc [eax], dl");
					 *_t66 =  *_t66 + _t42;
					 *((intOrPtr*)(_t42 + _t42)) =  *((intOrPtr*)(_t42 + _t42)) + _t42;
					 *_t66 =  *_t66 - _t42;
					 *_t42 =  *_t42 + _t42;
					 *[es:eax] =  *[es:eax] + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 & _t42;
					 *_t66 =  *_t66 + _t42;
					 *_t42 =  *_t42 + _t66;
					 *((intOrPtr*)(_t42 + 0x4e000008)) =  *((intOrPtr*)(_t42 + 0x4e000008)) + _t66;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t66;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t68;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t66 =  *_t66 + _t42;
					 *((intOrPtr*)(_t42 + _t42)) =  *((intOrPtr*)(_t42 + _t42)) + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					asm("rol byte [eax], 0x0");
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					 *_t42 =  *_t42 + _t42;
					goto L14;
				}
				if ( *(_t52 + 0x6e + _t77 * 2) * 0x65676e69 < 0) goto L4;
				_pop(es);
				_t65 = 0x40;
				 *_t42 =  *_t42 + _t42;
				 *_t42 =  *_t42 + _t42;
				_t52 = _t52 + _t52;
				asm("int3");
				 *_t42 =  *_t42 ^ _t42;
				_t68 = _t68 + _t52;
				asm("scasb");
				asm("adc al, 0x0");
				if(_t68 < 0) {
					goto L7;
				}
				asm("cmpsd");
				asm("cli");
				asm("sbb dword [edi+0x58], 0x97c001b7");
				asm("std");
				asm("out dx, eax");
				_t48 = _t68;
				_t68 = _t70 - 1;
				_t49 = _t48 &  *(_t48 + 0x53 + _t77 * 4);
				 *0x3a942196 = _t49;
				_t70 = _t42 - 1;
				asm("lodsd");
				_t50 = _t49;
				asm("stosb");
				 *((intOrPtr*)(_t50 - 0x2d)) =  *((intOrPtr*)(_t50 - 0x2d)) + _t50;
				_t51 = _t52 + 0x00000001 ^  *0xFFFFFFFFB711CFA5;
				_t52 = _t50;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				_pop(_t77);
				_t42 = _t51 |  *_t51;
				 *0x00000049 =  *((intOrPtr*)(0x49)) + _t52;
				 *_t42 =  *_t42 + _t42;
				goto L6;
			}

0x00401644
0x00401649
0x0040164e
0x0040164e
0x00401650
0x00401652
0x00401654
0x00401656
0x00401658
0x00401659
0x0040165b
0x0040165d
0x0040165f
0x0040165f
0x00401663
0x00401664
0x00401668
0x00401669
0x00401670
0x00401672
0x00401674
0x00401676
0x00401678
0x0040167a
0x0040167b
0x0040167e
0x00401680
0x00401681
0x004016f5
0x004016f5
0x004016f7
0x004016fa
0x004016fb
0x004016fd
0x00401700
0x00401700
0x00401701
0x00401702
0x00401702
0x00401708
0x00401783
0x00401783
0x00401784
0x00401784
0x00401786
0x00401787
0x00401787
0x0040178a
0x0040178c
0x00401792
0x00401795
0x00401798
0x004017a0
0x004017a2
0x004017a4
0x004017a6
0x004017aa
0x004017b2
0x004017b6
0x004017b8
0x004017ba
0x004017bc
0x004017be
0x004017c0
0x004017c2
0x004017c4
0x004017c6
0x004017c8
0x004017cc
0x004017ce
0x004017d0
0x004017d2
0x004017d4
0x004017d6
0x004017d8
0x004017da
0x004017db
0x004017dc
0x004017de
0x004017e0
0x004017e6
0x004017e8
0x004017f4
0x004017fa
0x00401802
0x00401805
0x00401807
0x00401809
0x0040180f
0x00401811
0x00401813
0x00401815
0x00401819
0x0040181b
0x0040181d
0x0040181f
0x00401821
0x00401823
0x00401825
0x00401827
0x00401829
0x0040182b
0x0040182d
0x0040182f
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401848
0x0040184e
0x00401851
0x00401852
0x00401853
0x00401855
0x00401857
0x00401859
0x0040185b
0x0040185d
0x00401863
0x00401867
0x00401869
0x00401869
0x0040170a
0x00401771
0x00401771
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x0040177d
0x0040177f
0x00401782
0x00000000
0x00401782
0x0040170c
0x00000000
0x00000000
0x0040170e
0x00000000
0x00000000
0x00401710
0x00401712
0x00000000
0x00000000
0x00401715
0x00401718
0x0040171a
0x0040171b
0x0040171f
0x00401721
0x00401723
0x00401724
0x00401726
0x00401728
0x0040172a
0x0040172c
0x0040172e
0x00401730
0x00401732
0x00401734
0x00401736
0x00401739
0x0040173b
0x0040173d
0x00401740
0x00401742
0x00401744
0x00401746
0x00401748
0x0040174e
0x00401750
0x00401752
0x00401754
0x00401756
0x00401758
0x0040175a
0x0040175c
0x0040175e
0x00401761
0x00401763
0x00401765
0x00401768
0x0040176a
0x0040176c
0x0040176e
0x00401770
0x00000000
0x00401770
0x0040168b
0x0040168d
0x0040168e
0x0040168f
0x00401691
0x00401693
0x00401695
0x00401696
0x00401698
0x0040169a
0x0040169b
0x0040169d
0x00000000
0x00000000
0x0040169f
0x004016a2
0x004016a3
0x004016ac
0x004016ad
0x004016ae
0x004016ae
0x004016af
0x004016b5
0x004016ba
0x004016bb
0x004016c2
0x004016c4
0x004016c5
0x004016c8
0x004016c8
0x004016c9
0x004016cb
0x004016cd
0x004016cf
0x004016d1
0x004016d3
0x004016d5
0x004016d7
0x004016d9
0x004016db
0x004016dd
0x004016df
0x004016e1
0x004016e3
0x004016e5
0x004016e7
0x004016e9
0x004016eb
0x004016ed
0x004016ee
0x004016f0
0x004016f3
0x00000000

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401649

Strings

VB5!6&*, xrefs: 00401644

Memory Dump Source

Source File: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 413304fc87e49b8787cbf3ea19da981c23c55b689e641670966b3969554464a0
Instruction ID: 6c48dc7cbd1364696c35c54fb2dc1a0f0f035683db7b68fcd4f7e9733d927028
Opcode Fuzzy Hash: 413304fc87e49b8787cbf3ea19da981c23c55b689e641670966b3969554464a0
Instruction Fuzzy Hash: 315152A548E7C14FD70387744C696903FB0AE13229B0E46EBC895DF4F3E26E484AD766

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022E761E, Relevance: 7.1, Strings: 5, Instructions: 896COMMON

Download Yara Rule

Strings

>s2+, xrefs: 022E7880
bE$I, xrefs: 022E458F
3J, xrefs: 022E4C64
}/q?, xrefs: 022E539A
>s2+, xrefs: 022E7885

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: >s2+$>s2+$bE$I$}/q?$3J
API String ID: 0-3070882053
Opcode ID: 8c44b38c6729859b9cdef6d577db694cc7713c98f8c7a572a324ff3871c40c7f
Instruction ID: 8cb7dee121e1edcdd77b7ad55302fd2dc0324a5850c05d5fef6294bc20ba5e2a
Opcode Fuzzy Hash: 8c44b38c6729859b9cdef6d577db694cc7713c98f8c7a572a324ff3871c40c7f
Instruction Fuzzy Hash: DD7232B1614345DFDF389E78C9957EA7BA2FF55300F85422EEC8A8B258D3708985DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E2751, Relevance: 4.7, Strings: 3, Instructions: 944COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F
G[Xo, xrefs: 022E2A26
EJ5x, xrefs: 022E2805

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: EJ5x$G[Xo$bE$I
API String ID: 0-1801337898
Opcode ID: 8ed099eb8eaf6d4772b12e55c6c316995df902bc2d3032c3cd1118af480c66b4
Instruction ID: ccae87f9d0a707605e7b3eb7ee79b00f0e2b2d9ecb3b0b91163a6ce4a07d31b2
Opcode Fuzzy Hash: 8ed099eb8eaf6d4772b12e55c6c316995df902bc2d3032c3cd1118af480c66b4
Instruction Fuzzy Hash: B47251B16143499FDF349E78CD947EA77A2FF49300F85422EEC8A8B258D3748985DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E0D25, Relevance: 4.7, Strings: 3, Instructions: 918COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411
}/q?, xrefs: 022E539A

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: Hoa$O?xH$}/q?
API String ID: 2167126740-374400973
Opcode ID: 363d8bd1fa7dc418a0439050d5edb4ebcf0f144d6784d49f0908b01c74aff956
Instruction ID: 15aa05e1b7d8f2d91279bf2919835d0cf123f614d91fe9fc0da1fcc0ad95f59e
Opcode Fuzzy Hash: 363d8bd1fa7dc418a0439050d5edb4ebcf0f144d6784d49f0908b01c74aff956
Instruction Fuzzy Hash: 8C626A7162434A8FDF349EA48C947EE33A3AF95350FD5412EDC8BAB248D7748981DB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E2BC4, Relevance: 3.9, Strings: 2, Instructions: 1353COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F
[:KR, xrefs: 022E2F5F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: [:KR$bE$I
API String ID: 0-681504058
Opcode ID: d64d1d9919fd8856cb0dae92dfa8cede52e580ff00f8dbb380b73cefe568423e
Instruction ID: bd8deac551b34edd792ae74913338d04a74403b9deda3c0d10f325325054c873
Opcode Fuzzy Hash: d64d1d9919fd8856cb0dae92dfa8cede52e580ff00f8dbb380b73cefe568423e
Instruction Fuzzy Hash: 6BB220B161434ADFDF24DF68C8957EA77A2FF49300F95422EDC8A8B218D3749985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E8A98, Relevance: 3.6, Strings: 2, Instructions: 1131COMMON

Download Yara Rule

Strings

fYk, xrefs: 022E8EA3
bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I$fYk
API String ID: 0-3911877772
Opcode ID: 842837b7518a1eace181c9b08ee0ab4d742d9127983a3e60c5382dafe025a15d
Instruction ID: fa588ffb5050bd0f1c7a6eb74cf1375584c8b6fef8cc8410658374392152dbeb
Opcode Fuzzy Hash: 842837b7518a1eace181c9b08ee0ab4d742d9127983a3e60c5382dafe025a15d
Instruction Fuzzy Hash: 6D9259716143858FDF249F78C8987DA7BE2AF46310F85826EDCCA8B299D3748585DB03

Uniqueness

Uniqueness Score: -1.00%

Function 022E6089, Relevance: 3.5, Strings: 2, Instructions: 990COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F
@O, xrefs: 022E62E5

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @O$bE$I
API String ID: 2167126740-1201749089
Opcode ID: ef9092b44f21fd0fd9d4e359385c968b08ffdd682e3f2fb370f7fc10c103e999
Instruction ID: cc4edec2d019db73bbe0e418ab32db7ba90ea6caa11de06cab9e10f89b311dbf
Opcode Fuzzy Hash: ef9092b44f21fd0fd9d4e359385c968b08ffdd682e3f2fb370f7fc10c103e999
Instruction Fuzzy Hash: D38231B16143469FDF349E78CD957EA77A2FF55340F81822EDC8A8B258D3708A85DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E0D6D, Relevance: 2.9, Strings: 2, Instructions: 436COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 5a1c52844f600a780ea028a7c2416580794b15e70428271910e43dc608637e8d
Instruction ID: 20349cdb2606c47f68cfd6cda899c85a837e5fd7842e7cffbad28913b59f9c01
Opcode Fuzzy Hash: 5a1c52844f600a780ea028a7c2416580794b15e70428271910e43dc608637e8d
Instruction Fuzzy Hash: 3BE11875A2434A8FDF385EA4CC947EE33A3AF85350F95412ADC4F9B248DB748981DB12

Uniqueness

Uniqueness Score: -1.00%

Function 022E0E6B, Relevance: 2.9, Strings: 2, Instructions: 384COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: fa094d22c362583db55b4089fa2ee6732c94606f98b6b3435b2db45675116a11
Instruction ID: 2408f5bad285223e3807a168e05061eee5b9722415425af3fd5832fc9750bd37
Opcode Fuzzy Hash: fa094d22c362583db55b4089fa2ee6732c94606f98b6b3435b2db45675116a11
Instruction Fuzzy Hash: 72D13775A3434A8FDF385EA48C947FE23A3AF85350FD5412EDC8B9B248DB744981DA12

Uniqueness

Uniqueness Score: -1.00%

Function 022E10AB, Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 29bb83deeeb316d1ee1981c49f70f55cdc19940b4ddad93b9f1a2a9ddd2f9dd1
Instruction ID: 1bc3d2a7a5277b3d1a02a6039e64aefef3b94fdfbdaa9f32358a75e460e76b24
Opcode Fuzzy Hash: 29bb83deeeb316d1ee1981c49f70f55cdc19940b4ddad93b9f1a2a9ddd2f9dd1
Instruction Fuzzy Hash: ED912671A2434A8FDF385EA4CC947EE23A7AF45350FD5412EDC8F9B248DB744D819A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E1043, Relevance: 2.8, Strings: 2, Instructions: 287COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 2ba9d363e94385cba8cf1685a225d6db6b81dbe5583d881fd21d25546ddcf228
Instruction ID: d735cc771f14d4de92e627a5dcde4bb16a5ce442bda8dd3ad233ef5c4411fdaa
Opcode Fuzzy Hash: 2ba9d363e94385cba8cf1685a225d6db6b81dbe5583d881fd21d25546ddcf228
Instruction Fuzzy Hash: EFA1F675A2434A8FDF385EA4CC547EE23A7AF85350FD5812EDC8F9B248D7744D819A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E10CD, Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: b73d6cc0f6414a58d9388cf1bfa3575f6155c6354f3ee24046f68c5264ef97fd
Instruction ID: a4849bf20c31e3f4a6bb20cc8f5449aa584df7e9fce85f1ed3e3b9b3cb3911fe
Opcode Fuzzy Hash: b73d6cc0f6414a58d9388cf1bfa3575f6155c6354f3ee24046f68c5264ef97fd
Instruction Fuzzy Hash: 519126B1A2434A8FDF385EA4CC547EE23A3AF45354FD5812EDC8F9B248DB744D819A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E1167, Relevance: 2.7, Strings: 2, Instructions: 241COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 3d036ece91fc9e68e5b943929ad37e488de5e9186ecebf23729dbe345f1fa49d
Instruction ID: 7a29b3b9813e9a1a09462c92af712da593bf72350950bdb0f4d07a2aec3c49a3
Opcode Fuzzy Hash: 3d036ece91fc9e68e5b943929ad37e488de5e9186ecebf23729dbe345f1fa49d
Instruction Fuzzy Hash: 4C81147162434A8FDF385EA4CC947FE23A7AF45350FD5412ADC8F9B248DB744D91AA02

Uniqueness

Uniqueness Score: -1.00%

Function 022E1212, Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 168fd865b2808641936f361590cf9e3345aa067eaa5d45ee9225c6595856025d
Instruction ID: 8f9b45005fb738b122f0b9b947c03e09b7e0fb63c9033cc550082f75689fd960
Opcode Fuzzy Hash: 168fd865b2808641936f361590cf9e3345aa067eaa5d45ee9225c6595856025d
Instruction Fuzzy Hash: 367137716343468FDF385EA8CC947EE23A3AF55340FD5852ADC8F8B248DB748D959A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E11A7, Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 253e6ca100be61e9852bc3a1b6b478c84d270cfa49ce15fd33a423c7eda1a8d4
Instruction ID: 2b99874766c56edd702149154ec90a3f64d306c215f234a90b4952b6fcfd1e94
Opcode Fuzzy Hash: 253e6ca100be61e9852bc3a1b6b478c84d270cfa49ce15fd33a423c7eda1a8d4
Instruction Fuzzy Hash: D37116756283468FDF385EA4CC947FE23A3AF45340FD5852EDC8B9B248DB744D91AA02

Uniqueness

Uniqueness Score: -1.00%

Function 022E11E3, Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: cb8044eefbd7c03b7de3782b0c1522666810ae9483cf777bab432681dd213a5d
Instruction ID: 136da9c4d9391819b1bd61a15303021e9bb47edc5da1adfe887e0d73ca1d6730
Opcode Fuzzy Hash: cb8044eefbd7c03b7de3782b0c1522666810ae9483cf777bab432681dd213a5d
Instruction Fuzzy Hash: 1B7109716283468FDF385EA4CC947EE23A3AF55340FD5412EDC8B9B248DB784D959A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E12D5, Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

O?xH, xrefs: 022E13BC
Hoa, xrefs: 022E1411

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: Hoa$O?xH
API String ID: 0-3790608845
Opcode ID: 5c49da8b1f7d896ea3c99bb8bc948f9d978aaf4c296895192f0a4d17c8ecf374
Instruction ID: fe4b06e0749dd4c95dc1979118f7b67fb24728ffc6a3aa874ed4be28810e36a4
Opcode Fuzzy Hash: 5c49da8b1f7d896ea3c99bb8bc948f9d978aaf4c296895192f0a4d17c8ecf374
Instruction Fuzzy Hash: 865128756342468FDF385E98CC947EE23A7AF55340FD5802ADC8F9B208DB748D959A02

Uniqueness

Uniqueness Score: -1.00%

Function 022E8233, Relevance: 2.3, Strings: 1, Instructions: 1005COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 4a7a01f75ebf222c83961d084507b52a746bbe187175242b000a22317ee6547b
Instruction ID: f55fd242eaf30d6aa57a08d0a54a6e367f56a3cca56553e84c4ce9b110f48296
Opcode Fuzzy Hash: 4a7a01f75ebf222c83961d084507b52a746bbe187175242b000a22317ee6547b
Instruction Fuzzy Hash: F78263B1614346DFDF389EB8C9953EA77A2FF45300F95422EDC8A8B258D3708981DB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E230E, Relevance: 2.1, Strings: 1, Instructions: 822COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: bE$I
API String ID: 2167126740-953333549
Opcode ID: 4a17b0a1fd2c37e2ce0d8ef7e45f18cfff1e5103119f9aee0e221c8eee7f7e30
Instruction ID: 4927e4bd6c9f2d28a08beffb857d80142f9ccb20b42d8d32eabc5e0f0308fed9
Opcode Fuzzy Hash: 4a17b0a1fd2c37e2ce0d8ef7e45f18cfff1e5103119f9aee0e221c8eee7f7e30
Instruction Fuzzy Hash: F16222B161434A9FDF349F78C9957EA7BA2FF45300F85422EDC8A8B258D3748985DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E2564, Relevance: 2.1, Strings: 1, Instructions: 810COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: bE$I
API String ID: 2167126740-953333549
Opcode ID: 32e8d539e1f2f788a497c2f4213567312121e8dc12a4e61cfa98da138404c03b
Instruction ID: 8dcd2eabca14a0f65e9a7617102ea8d2c491d70f9905049bf62aabc41c8df787
Opcode Fuzzy Hash: 32e8d539e1f2f788a497c2f4213567312121e8dc12a4e61cfa98da138404c03b
Instruction Fuzzy Hash: 0E6210B161434A9FDF349F68CD957EA7BA2FF45300F95422EDC8A9B218D3748985CB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E05BE, Relevance: 2.0, Strings: 1, Instructions: 792COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: bE$I
API String ID: 2167126740-953333549
Opcode ID: 96f48fc6e18994918c0933a47859945a42f4021bc1aa74d6b34d2a0a7f6d601b
Instruction ID: 97d0847fcd154f61746650300bf018dd2ebd375e8de35ee861d9c878736aa1c5
Opcode Fuzzy Hash: 96f48fc6e18994918c0933a47859945a42f4021bc1aa74d6b34d2a0a7f6d601b
Instruction Fuzzy Hash: 5E5252B16143469FDF389F78C9957EA7BA2FF55300F85422EDC8A8B218D3748985DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E3DE3, Relevance: 1.9, Strings: 1, Instructions: 679COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: df2b53c46f89c438dd9130b3ab8ec854c2d545f182fd4f7de850dfc46c37ef12
Instruction ID: abd9e280d585c78f8eaf63de804156a07752922f28254c82b3ee7d199f6ce37e
Opcode Fuzzy Hash: df2b53c46f89c438dd9130b3ab8ec854c2d545f182fd4f7de850dfc46c37ef12
Instruction Fuzzy Hash: 634222B16143459FDF289F78C9957EA7BA2FF55300F85412EDC8A8B218D3748985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E3E2B, Relevance: 1.9, Strings: 1, Instructions: 661COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 8164c248905ab1487ca6e3d1f0df102867510d9925523b9fe5e5d70f8f72a9be
Instruction ID: d317697b8b58f1492b1ee7308508617403e41c4ab92706f40a836e30f3587693
Opcode Fuzzy Hash: 8164c248905ab1487ca6e3d1f0df102867510d9925523b9fe5e5d70f8f72a9be
Instruction Fuzzy Hash: 6E4221B16143499FDF389F78C9957EA7BA2FF55300F85812EDC8A8B218D3748984CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E3E87, Relevance: 1.9, Strings: 1, Instructions: 645COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: ae4613e004bbb1140742a77e5e42cbb86fee9c7717b1f242724ad97d69cb02fd
Instruction ID: 89a6ce9c9a5ab1d102d8a824fb006a70a7b3a6b68dd4fc17400c8671dcafb153
Opcode Fuzzy Hash: ae4613e004bbb1140742a77e5e42cbb86fee9c7717b1f242724ad97d69cb02fd
Instruction Fuzzy Hash: 144211B16143499FDF389F68CD957EA77A2FF55300F85812EDC8A8B218D3748984DB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E3F3D, Relevance: 1.9, Strings: 1, Instructions: 615COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 30a86c190c657b4afae8d061b0de96857599abd59aa739fd18dbd38fa9dc28f7
Instruction ID: 0aefe0d0878a398ad1059fb7f7e5b0127dacff01640eda4cb4e6377c37a7df71
Opcode Fuzzy Hash: 30a86c190c657b4afae8d061b0de96857599abd59aa739fd18dbd38fa9dc28f7
Instruction Fuzzy Hash: 2E3201B16143499FDF389F68CD957EA77A2FF55300F85812EDC8A8B218D3748A84DB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E3F95, Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 0ff81875119b2c9da7f9e865e399df250dd31243c1d1915641df54c1e4996f4b
Instruction ID: 18db2a532bfb0f879c3a324447fc02dd06fbedd8a34c1607ee6fa2f1e9f9756e
Opcode Fuzzy Hash: 0ff81875119b2c9da7f9e865e399df250dd31243c1d1915641df54c1e4996f4b
Instruction Fuzzy Hash: 093202B16143499FDF389F68CD957EA7BA2FF55300F85812EDC8A8B218D3748984DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E4055, Relevance: 1.8, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 832dcb54f748dd983605e3f7283ad7444582524e9e1d525c20d77108db9f9065
Instruction ID: 30c348a6c59ad45ed89aecb3deed07c9bdb729b4d732673662348da10aa55600
Opcode Fuzzy Hash: 832dcb54f748dd983605e3f7283ad7444582524e9e1d525c20d77108db9f9065
Instruction Fuzzy Hash: B42234B16143499FDF389F68CD957EA77A2FF55300F85822EDC8A8B214D3748A84DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E40AD, Relevance: 1.8, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 3b5a7911ca93a6fc2f7e8968353992d48bf234bd7a787901be166419f87c6a92
Instruction ID: 52c15cad11dabaabac232c347e7b0034c19f5e33f1559a68e5a92ebee51cc125
Opcode Fuzzy Hash: 3b5a7911ca93a6fc2f7e8968353992d48bf234bd7a787901be166419f87c6a92
Instruction Fuzzy Hash: 832214B16143459FDF389F68CD957EA77A2FF55300F85822EDC8A8B214D3748A84DB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E2C56, Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

[:KR, xrefs: 022E2F5F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: [:KR
API String ID: 0-2187104751
Opcode ID: c15bddeae35d508253e663a47b39aa18779d4932e3c428ff1e09a24ffa9c2255
Instruction ID: d8797d6e67a94d4aabc15b611688f0e027bbe0726807872e28b773ea9503713b
Opcode Fuzzy Hash: c15bddeae35d508253e663a47b39aa18779d4932e3c428ff1e09a24ffa9c2255
Instruction Fuzzy Hash: 1DE1E17161474ADFDF24CF68C8D0BEAB7A5BF48310F95422EDC5A9B244C770A991CB82

Uniqueness

Uniqueness Score: -1.00%

Function 022E2CA3, Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

[:KR, xrefs: 022E2F5F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: [:KR
API String ID: 0-2187104751
Opcode ID: 18c8db8ff7f13a97be1c16078151c951bbdea273a8424790670d126713997b28
Instruction ID: d8b31af13eaff58db98a06f09602aa07b475d61c68221e2c5ca296aa37520463
Opcode Fuzzy Hash: 18c8db8ff7f13a97be1c16078151c951bbdea273a8424790670d126713997b28
Instruction Fuzzy Hash: 1CE1F17161434ADFDF24CF68C8D0BEAB7A5BF48310F95422EDC5A9B254C770A991CB82

Uniqueness

Uniqueness Score: -1.00%

Function 022E4523, Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: 7365690f3f71ca1ef65c65d955983818c992a513043c5cad151df402c25c7bbb
Instruction ID: 43756601a4a189c19756f6a5b637b6119dbee35d3dac62ab9878a460071d5c47
Opcode Fuzzy Hash: 7365690f3f71ca1ef65c65d955983818c992a513043c5cad151df402c25c7bbb
Instruction Fuzzy Hash: 2AC127B56143499FDF399E68CD547EA3BA2FF59300F84412DEC8ACB258D7748A84DB01

Uniqueness

Uniqueness Score: -1.00%

Function 022E211D, Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

}/q?, xrefs: 022E539A

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: }/q?
API String ID: 2167126740-188924682
Opcode ID: d99f9f9a0793aa8b5f6cc805fcbf218ee1746f1c497bd64c5e8a939a16e1b254
Instruction ID: f1de0ff118fcd203835b73180cc173e9d16a6d1217e47db20ffb0a3119bae812
Opcode Fuzzy Hash: d99f9f9a0793aa8b5f6cc805fcbf218ee1746f1c497bd64c5e8a939a16e1b254
Instruction Fuzzy Hash: 5D917E716203498FEF349EB088647EB73A3AFA1350FD1411EDC8767248D7758986DB52

Uniqueness

Uniqueness Score: -1.00%

Function 022E06C4, Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

bE$I, xrefs: 022E458F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: bE$I
API String ID: 0-953333549
Opcode ID: c5689e69ffff14c0bc15cc6a50cbb5be8d0400b20083eebf59ed55f1d515da8b
Instruction ID: 0d8626594f8ced121d80c2cddd53b5a8d9ab3e7829d1555c4135e18d9c985433
Opcode Fuzzy Hash: c5689e69ffff14c0bc15cc6a50cbb5be8d0400b20083eebf59ed55f1d515da8b
Instruction Fuzzy Hash: D2915F75624349CBEF209EB0C9607EB37A2AF92350FD1411EDC8BA7248D7758A46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 022E0000, Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

ok, xrefs: 022E025F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: ok
API String ID: 0-3694418724
Opcode ID: 7ffe7dba65292bb5c71dc5e110d13b2621e8d7fb3e56caf0e9ca530fffc983f6
Instruction ID: 6ee3d94ec3e8f34807a72299688a55cabe5055a6639c72a093912d740e832906
Opcode Fuzzy Hash: 7ffe7dba65292bb5c71dc5e110d13b2621e8d7fb3e56caf0e9ca530fffc983f6
Instruction Fuzzy Hash: EF814E71524349CBEF209EF089543EB32A2AF62354FD1411ADC877B248E3B58A46DB92

Uniqueness

Uniqueness Score: -1.00%

Function 022E4CBC, Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

)k:, xrefs: 022E7138

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: )k:
API String ID: 2167126740-4084727042
Opcode ID: ba38b4a2cefc4b5359f00553bfc529490150696f45f1c4c70544efd7a4eaa6a3
Instruction ID: 66390aefeedcd0130cd5200c64549f14de07253d6a196934f9247f598aaf9ebc
Opcode Fuzzy Hash: ba38b4a2cefc4b5359f00553bfc529490150696f45f1c4c70544efd7a4eaa6a3
Instruction Fuzzy Hash: 4C816E71620349DFEF209EB088603EB73A3AF92750FD5411EDC8767248E7758986DB92

Uniqueness

Uniqueness Score: -1.00%

Function 022E2F1B, Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

[:KR, xrefs: 022E2F5F

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: [:KR
API String ID: 0-2187104751
Opcode ID: c36f6745b6b06528ce9a399d696f04720b6358e1c51edd679f268cd7c81189a7
Instruction ID: 50108a8f7871b3922b4890cbf142e97de90d63390bb0323f2fa0286951cec0af
Opcode Fuzzy Hash: c36f6745b6b06528ce9a399d696f04720b6358e1c51edd679f268cd7c81189a7
Instruction Fuzzy Hash: 3D91317162034ACFDF24CF68C8D1BEAB7E1BF09310F95421ED89A9B214C7709985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 022E96A1, Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

}/q?, xrefs: 022E539A

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: }/q?
API String ID: 0-188924682
Opcode ID: f53fd7fe8a6602a9312db116a500ac0afe291a36a3106b327ec6aeeed73c01d6
Instruction ID: 76218bd0546e10ec196c61d93b4226832382973dac72a85bedd074a115520591
Opcode Fuzzy Hash: f53fd7fe8a6602a9312db116a500ac0afe291a36a3106b327ec6aeeed73c01d6
Instruction Fuzzy Hash: 045163726342068FDF388DA8C8A53F93796AF56200FC5452BD853CB25CD3B9C5C9EA12

Uniqueness

Uniqueness Score: -1.00%

Function 022E283B, Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

G[Xo, xrefs: 022E2A26

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: G[Xo
API String ID: 0-3892434268
Opcode ID: 86f7f06bb2de03fb086da92073b578779e02a1005266debce97117f2294ebc06
Instruction ID: d5772f36d81a63b768035efd4a479310b96cf0d91eca787f6f3c39dbf74a3cf2
Opcode Fuzzy Hash: 86f7f06bb2de03fb086da92073b578779e02a1005266debce97117f2294ebc06
Instruction Fuzzy Hash: A0510671214349CFDF348E64CC94BEE77AAAF95320F90461EEC5BDB258C3708985DA52

Uniqueness

Uniqueness Score: -1.00%

Function 022E1BC1, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

}/q?, xrefs: 022E539A

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: }/q?
API String ID: 0-188924682
Opcode ID: a5f3319bbe41d732e02d2213cee094195c13798f8b871cd23ebf99cf50d7f6b9
Instruction ID: 7fe5439d0d44d77344119b52dd63297c5c8fae5a4271321135f926a4dcc5da83
Opcode Fuzzy Hash: a5f3319bbe41d732e02d2213cee094195c13798f8b871cd23ebf99cf50d7f6b9
Instruction Fuzzy Hash: EE510371914345DFDF389E688CA07EA77A7AF98390F91002EEC8A9B254D7714D81DB02

Uniqueness

Uniqueness Score: -1.00%

Function 022E8C53, Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

fYk, xrefs: 022E8EA3

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: fYk
API String ID: 0-2440650808
Opcode ID: 712ce78ca2df51c21040986bfd53e89fbace84d377a7ffd10cb83b7ea45d1552
Instruction ID: f9867f0f281134689a819a6d76f426b696584ce8619dd6560351fbf62d00c6f9
Opcode Fuzzy Hash: 712ce78ca2df51c21040986bfd53e89fbace84d377a7ffd10cb83b7ea45d1552
Instruction Fuzzy Hash: 2A51B7619183828EDF629BB88858756BAD1AF13270F8DC2EDCCD74E0EBD3A54046D717

Uniqueness

Uniqueness Score: -1.00%

Function 022E292F, Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

G[Xo, xrefs: 022E2A26

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: G[Xo
API String ID: 0-3892434268
Opcode ID: fe09bca6f3ec496bc651e892cec40513bb3cebd679e392d9d09cfa37482fdc4e
Instruction ID: 85e9f5147448f7138683c285c77165e084f2a4f7fe0a9a53b29aab78e8ac140f
Opcode Fuzzy Hash: fe09bca6f3ec496bc651e892cec40513bb3cebd679e392d9d09cfa37482fdc4e
Instruction Fuzzy Hash: 66510470218349CFDF388E648C94BEE77A6AF95320FD0461EEC5B9B298C3744985DA16

Uniqueness

Uniqueness Score: -1.00%

Function 022E8C91, Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

fYk, xrefs: 022E8EA3

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: fYk
API String ID: 0-2440650808
Opcode ID: 586b90beb24320b51cb0a5c491dfc300514d8217746f081d82ba2c07b57f2156
Instruction ID: 78459834d2eb6d2cbdb8ef76dcf030558bc434767704195877da5c06350c8419
Opcode Fuzzy Hash: 586b90beb24320b51cb0a5c491dfc300514d8217746f081d82ba2c07b57f2156
Instruction Fuzzy Hash: BA51CA619183828EDF625BB88898756BAD1AF13260F8DC2EDCCD74E0EFD3654046D713

Uniqueness

Uniqueness Score: -1.00%

Function 022E2944, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

G[Xo, xrefs: 022E2A26

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: G[Xo
API String ID: 0-3892434268
Opcode ID: df8bf355eef7af0b1c9676881356dff43a1832a86ed487d60fd9b4f34a3f33f3
Instruction ID: d8088477445ef126db1d0b19443c73d2bd0199943b7e5e8fad3d4f75b5f77cb1
Opcode Fuzzy Hash: df8bf355eef7af0b1c9676881356dff43a1832a86ed487d60fd9b4f34a3f33f3
Instruction Fuzzy Hash: BC41367021474ACFDF388E64CC94BEE77A6AF99310FC0462EEC5B9B295D3708945DA02

Uniqueness

Uniqueness Score: -1.00%

Function 022E29FF, Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

G[Xo, xrefs: 022E2A26

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID: G[Xo
API String ID: 0-3892434268
Opcode ID: 8383de5f21178ab9a87ab914ad0b63fbe90dc5cdb272855984ddb197512da667
Instruction ID: 245a2c9f06cc1e410d4a43f9682322e8997c64c941dd49d8c74cce85e9a6d246
Opcode Fuzzy Hash: 8383de5f21178ab9a87ab914ad0b63fbe90dc5cdb272855984ddb197512da667
Instruction Fuzzy Hash: E2310571218349CFDF389E748C40BEF76A6AF95310FD18A2EEC5787298D3758945DA02

Uniqueness

Uniqueness Score: -1.00%

Function 022E374B, Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d3eeb28f958988ff0ad53c28ddcf1e4d0b6906ba3154061d83c3471b889368
Instruction ID: 598889739132d99740ce8f9b6b4483215a4c6bab7a6c69bff212d478654ea981
Opcode Fuzzy Hash: e8d3eeb28f958988ff0ad53c28ddcf1e4d0b6906ba3154061d83c3471b889368
Instruction Fuzzy Hash: D3D17B75A24349CFEF249EB0C9647EB37A2AF51350FC6411EDC8B67248D3748A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022E4D89, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 21b72a7690ef31796dd82eb156d077c0ae8117920e8ca9ce86d162be876774d5
Instruction ID: 089dfd6828a88cd611a10b60fc63edd764860f1e433ce1ab298c5c8fdcad440c
Opcode Fuzzy Hash: 21b72a7690ef31796dd82eb156d077c0ae8117920e8ca9ce86d162be876774d5
Instruction Fuzzy Hash: 59817D71624349CFEF309EB0C8507EB3392AF52350FC5411ADC876B248D7758A86DB92

Uniqueness

Uniqueness Score: -1.00%

Function 022E2F8B, Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42bac37489ad672aa0007e9771345f6ecff5b9b63cbd1f815deebe39f71748d1
Instruction ID: d1fd8ac4032a34ee01f6b517731b7ace6d34e4f741e937ec57f9a8a181d37ea4
Opcode Fuzzy Hash: 42bac37489ad672aa0007e9771345f6ecff5b9b63cbd1f815deebe39f71748d1
Instruction Fuzzy Hash: 0A81223121034ADFDF24CF68C8D1BEAB7E1BF49310F95421ED89A9B255C7709A85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 022E3783, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee5b1ef8fd2f720bef1850057b3f83ec5a99949ae7359c9b896603703cbdcfb
Instruction ID: 73d09379c4d726efc14e6d8a4805e558c8538e97e82b6a53d40f59329e8d1113
Opcode Fuzzy Hash: 6ee5b1ef8fd2f720bef1850057b3f83ec5a99949ae7359c9b896603703cbdcfb
Instruction Fuzzy Hash: 0C515376A24345CFDF248EA489687FA77E2EF04350F86055E9C4BAB219D3748A80DF42

Uniqueness

Uniqueness Score: -1.00%

Function 022E1453, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f1209f761b49a4460f3bd5ffe117f76b0fb1555a63a933fc7fb21724a5a9bc
Instruction ID: ea345a2d9366fee17557a7c07937af2eba12d8a8cac212525bc2459f580b3fdb
Opcode Fuzzy Hash: f5f1209f761b49a4460f3bd5ffe117f76b0fb1555a63a933fc7fb21724a5a9bc
Instruction Fuzzy Hash: D6413BB4678346CEDF345DD48C447EA33A7AF59340FC4413ADC4F9A20CD3B58A96AA12

Uniqueness

Uniqueness Score: -1.00%

Function 022E587C, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c55ddd4cf6806cc80ee2517df3917710f63184416616dedc4e0a4d21da7f30
Instruction ID: 2299b7109f128352c2952fe4f8a67cb8922cd4525871c71930f5444090400250
Opcode Fuzzy Hash: b3c55ddd4cf6806cc80ee2517df3917710f63184416616dedc4e0a4d21da7f30
Instruction Fuzzy Hash: 68210774628344CFDF388E608C947EEB2A2BF94314F92861E98C656298C7314580DA12

Uniqueness

Uniqueness Score: -1.00%

Function 022E811C, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3106b8968947ad1005b79228e105dcdc66007c79e1d4627a40b22f40cc688e59
Instruction ID: 83ab7be5f3faa8b22b5826cade5861ca5a1564eb51060a43656faa126c288fde
Opcode Fuzzy Hash: 3106b8968947ad1005b79228e105dcdc66007c79e1d4627a40b22f40cc688e59
Instruction Fuzzy Hash: 41F06D783212468FCF28DF54C5D4BAD73A2EB54740FC18069DD8A8F639C730E884DA12

Uniqueness

Uniqueness Score: -1.00%

Function 022E7C09, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f45ff7528e353acff3aadd33ec376ab4f0e224937e261f8559201b535bcf6ed
Instruction ID: fcb8ebf10623066ddde74114faec8019a324cee3a6b4470c3832b3f1645147b6
Opcode Fuzzy Hash: 6f45ff7528e353acff3aadd33ec376ab4f0e224937e261f8559201b535bcf6ed
Instruction Fuzzy Hash: B5B09230620980CFCE99CA49C190E14B3F4BB08A00B411890E00ACBA11C264E800DA00

Uniqueness

Uniqueness Score: -1.00%

Function 022E536F, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.577531426.00000000022E0000.00000040.00000001.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 00411E30, Relevance: 68.5, APIs: 35, Strings: 4, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,004013F6), ref: 00411E4E
#525.MSVBVM60(00000001,?,?,?,?,004013F6), ref: 00411E8A
__vbaStrMove.MSVBVM60(?,?,?,?,004013F6), ref: 00411E95
__vbaStrCmp.MSVBVM60(0040382C,00000000,?,?,?,?,004013F6), ref: 00411EA1
__vbaFreeStr.MSVBVM60(?,?,?,?,004013F6), ref: 00411EB6
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004013F6), ref: 00411ED1
#594.MSVBVM60(0000000A), ref: 00411EF0
__vbaFreeVar.MSVBVM60 ref: 00411EF9
#716.MSVBVM60(0000000A,Crombie,00000000), ref: 00411F18
__vbaChkstk.MSVBVM60 ref: 00411F23
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00411F47
__vbaFreeVar.MSVBVM60 ref: 00411F50
__vbaFPInt.MSVBVM60(?,?,?,?,004013F6), ref: 00411F63
__vbaFpR8.MSVBVM60(?,?,?,?,004013F6), ref: 00411F69
#611.MSVBVM60(?,?,?,?,004013F6), ref: 00411F87
__vbaStrMove.MSVBVM60(?,?,?,?,004013F6), ref: 00411F92
#705.MSVBVM60(00000002,00000000), ref: 00411FB3
__vbaStrMove.MSVBVM60 ref: 00411FBE
__vbaFreeVar.MSVBVM60 ref: 00411FC7
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00411FEE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,0000004C), ref: 0041203F
__vbaChkstk.MSVBVM60(?), ref: 00412074
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,0000001C), ref: 004120B8
__vbaObjSet.MSVBVM60(?,?), ref: 004120EB
__vbaFreeObj.MSVBVM60 ref: 004120F4
__vbaNew2.MSVBVM60(00403850,00415D3C,?,?,?,?,004013F6), ref: 00412114
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403840,00000014), ref: 00412165
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000060), ref: 004121AD
__vbaStrMove.MSVBVM60 ref: 004121DE
__vbaFreeObj.MSVBVM60 ref: 004121E7
__vbaFreeObj.MSVBVM60(00412257), ref: 0041222C
__vbaFreeStr.MSVBVM60 ref: 00412235
__vbaFreeStr.MSVBVM60 ref: 0041223E
__vbaFreeObj.MSVBVM60 ref: 00412247
__vbaFreeStr.MSVBVM60 ref: 00412250

Strings

Crombie, xrefs: 00411F0F
<]A, xrefs: 00412130
<]A, xrefs: 0041200A
]ar, xrefs: 004121F4

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$CheckHresultMove$Chkstk$New2$#525#594#611#705#716ErrorLate
String ID: <]A$<]A$Crombie$]ar
API String ID: 503181555-2367164633
Opcode ID: 3bac956c55a2b6f5244e83ce75ebb5a3128b34eeb3c5ad197c5a3549458bdf3f
Instruction ID: cb6b69e789027cbee6d0cc13207e35e9e3b787b6a9abce0e090d3cef4927ce0f
Opcode Fuzzy Hash: 3bac956c55a2b6f5244e83ce75ebb5a3128b34eeb3c5ad197c5a3549458bdf3f
Instruction Fuzzy Hash: 69C1E9B4900208DFDB14DFA5DA48BDEBBB4FF48305F208169E506BB2A1DB785A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004133C0, Relevance: 54.4, APIs: 23, Strings: 8, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#591.MSVBVM60(?), ref: 0041341C
__vbaStrMove.MSVBVM60 ref: 00413427
__vbaStrCmp.MSVBVM60(Double,00000000), ref: 00413433
__vbaFreeStr.MSVBVM60 ref: 00413446
__vbaFreeVar.MSVBVM60 ref: 00413455
#648.MSVBVM60(00000005), ref: 00413472
__vbaFreeVar.MSVBVM60 ref: 0041347B
#690.MSVBVM60(daffled,Galbanums5,syvendedagsadventistens,Passageres7), ref: 00413491
_adj_fdiv_m64.MSVBVM60 ref: 004134BA
__vbaFpI4.MSVBVM60(43180000,?,435A0000), ref: 004134EE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403524,000002C0,?,435A0000), ref: 00413528
#670.MSVBVM60(00000005), ref: 00413536
__vbaVarTstEq.MSVBVM60(?,00000005), ref: 00413552
__vbaFreeVar.MSVBVM60(?,435A0000), ref: 0041355E
#598.MSVBVM60(?,435A0000), ref: 0041356D
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00413585
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 004135AA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000110), ref: 004135D0
__vbaStrMove.MSVBVM60 ref: 004135DB
__vbaFreeObj.MSVBVM60 ref: 004135E4
__vbaLateMemCall.MSVBVM60(?,G4E8FWJ3IIVeaFpVOIxWSxnP80,00000002), ref: 0041363B
__vbaFreeStr.MSVBVM60(00413685), ref: 00413675
__vbaFreeObj.MSVBVM60 ref: 0041367E

Strings

Galbanums5, xrefs: 00413487
Double, xrefs: 0041342E
slutelementet, xrefs: 004135FF
Ekspansionskortenes8, xrefs: 00413544
G4E8FWJ3IIVeaFpVOIxWSxnP80, xrefs: 00413632
syvendedagsadventistens, xrefs: 00413482
Passageres7, xrefs: 0041347D
daffled, xrefs: 0041348C

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$CheckHresult$Move$#591#598#648#670#690CallLateNew2_adj_fdiv_m64
String ID: Double$Ekspansionskortenes8$G4E8FWJ3IIVeaFpVOIxWSxnP80$Galbanums5$Passageres7$daffled$slutelementet$syvendedagsadventistens
API String ID: 3544221442-1816252260
Opcode ID: 098f0951b3b60ccd8c6004ae787d18eec59032027e6ab3270e73cc57ed9e175f
Instruction ID: 548fe9952cd7500636d3c5cc782520cbeeb50a2181d9d33cb4762b376460d6be
Opcode Fuzzy Hash: 098f0951b3b60ccd8c6004ae787d18eec59032027e6ab3270e73cc57ed9e175f
Instruction Fuzzy Hash: 0F715B70900208EFCB04DFA5DE49ADEBBB8FB48705F20802AF545B72A1D7785A45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00411980, Relevance: 49.8, APIs: 33, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000), ref: 00411A0D
__vbaVarMove.MSVBVM60 ref: 00411A3A
__vbaVarMove.MSVBVM60 ref: 00411A73
__vbaVarMove.MSVBVM60 ref: 00411A9C
__vbaVarMove.MSVBVM60 ref: 00411AC9
#665.MSVBVM60(?,3F800000,?), ref: 00411AD8
__vbaErase.MSVBVM60(00000000,?), ref: 00411AE3
__vbaVarTstNe.MSVBVM60(?,?), ref: 00411B08
__vbaFreeVar.MSVBVM60 ref: 00411B14
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00411B35
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 00411B5A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000F0), ref: 00411B8A
__vbaStrMove.MSVBVM60 ref: 00411B9D
__vbaFreeObj.MSVBVM60 ref: 00411BA6
#598.MSVBVM60 ref: 00411BAC
__vbaHresultCheckObj.MSVBVM60(00000000,004012D0,00403524,00000084), ref: 00411BED
__vbaVarDup.MSVBVM60 ref: 00411C0B
#513.MSVBVM60(?,?,00000002), ref: 00411C1B
__vbaVarTstNe.MSVBVM60(00000002,?), ref: 00411C40
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00411C53
#535.MSVBVM60 ref: 00411C65
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00411C7F
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 00411CA4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000118), ref: 00411CCD
__vbaI2I4.MSVBVM60 ref: 00411CD5
__vbaFreeObj.MSVBVM60 ref: 00411CDE
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00411CF6
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,0000004C), ref: 00411D1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,0000001C,?,?,?,?), ref: 00411D6B
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00411D7C
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00411D85
__vbaFreeObj.MSVBVM60(00411DF1), ref: 00411DE1
__vbaFreeStr.MSVBVM60 ref: 00411DEA

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckFreeHresult$Move$New2$#513#535#598#665EraseListRedim
String ID:
API String ID: 2655101863-0
Opcode ID: 89ba34b7280ad998c92aed117b9247b3f4b845d9375388a23a98620e89e3af17
Instruction ID: 6e8c0ad97856d1d08300fd93de8905f1475bcf00d8db2e9b5a6ec558083fdca7
Opcode Fuzzy Hash: 89ba34b7280ad998c92aed117b9247b3f4b845d9375388a23a98620e89e3af17
Instruction Fuzzy Hash: 6CD138B1900219EFDB14DF94D988FDDBBB8FF48700F1081AAE245A72A1D7745984CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411750, Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0041179F
__vbaInStrB.MSVBVM60(00000000,00403A40,ABC,00000002), ref: 004117B2
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004117D3
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 004117FE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000F8), ref: 0041182C
__vbaStrMove.MSVBVM60 ref: 00411837
__vbaFreeObj.MSVBVM60 ref: 00411846
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0041185B
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,0000004C), ref: 00411880
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,00000028), ref: 0041189C
__vbaFreeObj.MSVBVM60 ref: 004118A1
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004118B6
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,0000004C), ref: 004118DB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,00000024), ref: 00411905
__vbaStrMove.MSVBVM60 ref: 00411914
__vbaFreeObj.MSVBVM60 ref: 0041191D
__vbaFreeStr.MSVBVM60(00411956), ref: 00411949
__vbaFreeStr.MSVBVM60 ref: 0041194E
__vbaFreeStr.MSVBVM60 ref: 00411953

Strings

NONEPIGRAMMATICALLY, xrefs: 004118E6
ABC, xrefs: 004117A7
inductothermy, xrefs: 004118EB

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckFreeHresult$New2$Move$Copy
String ID: ABC$NONEPIGRAMMATICALLY$inductothermy
API String ID: 338840774-1393017364
Opcode ID: 06e49aeb2e4993f8e787206ea25cd6bdbf1cf6d0444385783dfdc84a5f80086e
Instruction ID: 117e1252ff0c6b4d1b62bccbc48f142dd918b167b5160f97e35b0bb3e240817a
Opcode Fuzzy Hash: 06e49aeb2e4993f8e787206ea25cd6bdbf1cf6d0444385783dfdc84a5f80086e
Instruction Fuzzy Hash: 4E5178B0A40209ABCB00EF65DD49EDEBBB8FF58711F10806AF541B32A1D7789945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004136A0, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00403C20,00000005), ref: 004136E5
#684.MSVBVM60(00000000,3FF00000,?), ref: 0041371A
__vbaFpR8.MSVBVM60 ref: 00413720
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00413749
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 0041376E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,0000013C), ref: 004137BF
__vbaFreeObj.MSVBVM60 ref: 004137D2
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004137E7
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 0041380C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000E0), ref: 00413832
__vbaStrMove.MSVBVM60 ref: 00413841
__vbaFreeObj.MSVBVM60 ref: 0041384A
__vbaFpI4.MSVBVM60 ref: 00413857
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403524,000002C8), ref: 0041388D
__vbaFreeStr.MSVBVM60(004138C6), ref: 004138AD
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004138BF

Strings

glow, xrefs: 00413796

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckHresult$Free$New2$#684Construct2DestructMove
String ID: glow
API String ID: 1593299173-3934040341
Opcode ID: 1069b5b895946aed9e00207bdc8b942d46cd9863ef7ce8f99bfff9e64d5d1113
Instruction ID: c034a8e2628488464dc3ecc1f11a6c19abc3ae93189819cb385677796b3c0737
Opcode Fuzzy Hash: 1069b5b895946aed9e00207bdc8b942d46cd9863ef7ce8f99bfff9e64d5d1113
Instruction Fuzzy Hash: F2514EB0900208ABDB04EF55DD48FDEBBB8FF48701F10846AF505B72A5D778A945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00412290, Relevance: 28.7, APIs: 19, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004122F1
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 0041231C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000078), ref: 00412344
__vbaFreeObj.MSVBVM60 ref: 00412349
__vbaFPInt.MSVBVM60 ref: 00412355
__vbaFpR8.MSVBVM60 ref: 0041235B
#611.MSVBVM60 ref: 00412372
__vbaStrMove.MSVBVM60 ref: 00412383
#705.MSVBVM60(?,00000000), ref: 00412398
__vbaStrMove.MSVBVM60 ref: 004123A3
__vbaFreeVar.MSVBVM60 ref: 004123A8
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004123C0
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,0000004C), ref: 004123E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,0000001C), ref: 00412425
__vbaObjSet.MSVBVM60(?,?), ref: 0041243A
__vbaFreeObj.MSVBVM60 ref: 00412443
__vbaFreeObj.MSVBVM60(00412488), ref: 00412471
__vbaFreeStr.MSVBVM60 ref: 00412480
__vbaFreeStr.MSVBVM60 ref: 00412485

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$#611#705
String ID:
API String ID: 2896190466-0
Opcode ID: 49b4630a707f2342a5147045990a43e246b65d8b4f866a1460666ae8fd124f8c
Instruction ID: d391a4a05813d196f3b41ef2035d3b77a2e093932f057023da1d2159a1cef24c
Opcode Fuzzy Hash: 49b4630a707f2342a5147045990a43e246b65d8b4f866a1460666ae8fd124f8c
Instruction Fuzzy Hash: E4514FB1900208EBCB04DFA5DE48ADEBBB8FF58710F10806AE501B7274DB785945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00413A40, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 00413A8D
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 00413AB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000058), ref: 00413AD6
__vbaVarLateMemCallLd.MSVBVM60(?,?,Value,00000000), ref: 00413AEA
__vbaStrVarVal.MSVBVM60(?,00000000), ref: 00413AF8
#690.MSVBVM60(?,Options,Show Tips at Startup,00000000), ref: 00413B0D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413B1D
__vbaFreeObj.MSVBVM60 ref: 00413B29
__vbaFreeVar.MSVBVM60 ref: 00413B32
__vbaFreeVar.MSVBVM60(00413B6F), ref: 00413B68

Strings

Show Tips at Startup, xrefs: 00413B02
Value, xrefs: 00413ADD
Options, xrefs: 00413B07

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#690CallLateListNew2
String ID: Options$Show Tips at Startup$Value
API String ID: 2162649039-3815377432
Opcode ID: 4347d6c4b5b30a5c06aec14edad1a7f80699f515177ff788989ab784d0581473
Instruction ID: a8408c5436f1b12e350c5f191b60db2351e4512d3e6f363a3fe7afd0b48ebf4c
Opcode Fuzzy Hash: 4347d6c4b5b30a5c06aec14edad1a7f80699f515177ff788989ab784d0581473
Instruction Fuzzy Hash: 263170B1D40204ABCB04DF95DD49EDEBBBCFF58742F10846AF501B31A1D678AA44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0, Relevance: 19.6, APIs: 13, Instructions: 128COMMON

Download Yara Rule

APIs

#648.MSVBVM60(0000000A), ref: 00411518
__vbaFreeVar.MSVBVM60 ref: 00411521
#614.MSVBVM60(00000000,40220000), ref: 0041152D
__vbaFpR8.MSVBVM60 ref: 00411533
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 0041155C
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 00411587
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000078), ref: 004115AF
__vbaFreeObj.MSVBVM60 ref: 004115B4
__vbaOnError.MSVBVM60(00000000), ref: 004115BB
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004115D3
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,0000004C), ref: 004115F8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A18,0000002C), ref: 00411634
__vbaFreeObj.MSVBVM60 ref: 0041163D

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckHresult$Free$New2$#614#648Error
String ID:
API String ID: 2064784593-0
Opcode ID: 01413c3588145e15ec4fe22b9e713819eaf2490bde00e0c87a8d04d01bfc6253
Instruction ID: da50b38853fb2f0f83049d9bb978b7cc823b8940e72d00507ba35c6545f4d0dd
Opcode Fuzzy Hash: 01413c3588145e15ec4fe22b9e713819eaf2490bde00e0c87a8d04d01bfc6253
Instruction Fuzzy Hash: 804140B1900204EBCB00EF55DE89ADEBBB9FF48701F20846AF605B72A1D7789941CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004138E0, Relevance: 18.1, APIs: 12, Instructions: 89COMMON

Download Yara Rule

APIs

#648.MSVBVM60(?), ref: 00413938
__vbaFreeVar.MSVBVM60 ref: 00413943
__vbaStrCmp.MSVBVM60(00403C3C,00000000), ref: 00413954
#645.MSVBVM60(?,00000000), ref: 00413975
__vbaStrMove.MSVBVM60 ref: 00413980
__vbaStrCmp.MSVBVM60(00403C3C,00000000), ref: 0041398C
__vbaFreeStr.MSVBVM60 ref: 0041399E
__vbaFreeStr.MSVBVM60(00413A0D), ref: 00413A06

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$Free$#645#648Move
String ID:
API String ID: 2957232524-0
Opcode ID: ebe22848a62cf22a25969e5cdfaa40b8b8b7ae6c178ee6de00196ca89a46cc6f
Instruction ID: cd3ab74b771bb31ff8d342aba5171423bd133d89f5bceeabd156280509dc92c1
Opcode Fuzzy Hash: ebe22848a62cf22a25969e5cdfaa40b8b8b7ae6c178ee6de00196ca89a46cc6f
Instruction Fuzzy Hash: 853181B4D00249EBCB00DFA5DA45AEEBBB8EF48701F20811AE955B3260D7745A41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402D41, Relevance: 16.6, APIs: 11, Instructions: 97COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_000013F6), ref: 0041139C
#696.MSVBVM60(00403A2C), ref: 004113A7
__vbaNew2.MSVBVM60(00403850,00415D3C), ref: 004113C9
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014), ref: 004113F4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,000000D0), ref: 00411422
__vbaStrMove.MSVBVM60 ref: 00411431
__vbaFreeObj.MSVBVM60 ref: 0041143A
#535.MSVBVM60 ref: 00411440
__vbaHresultCheckObj.MSVBVM60(00000000,00401280,00403554,0000071C), ref: 00411461
__vbaFreeStr.MSVBVM60(00411496), ref: 0041148E
__vbaFreeStr.MSVBVM60 ref: 00411493

Memory Dump Source

Source File: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#535#696CopyMoveNew2
String ID:
API String ID: 4004134498-0
Opcode ID: 1651e6fb6217797b40c9043a7beff3e763d77e1a96279e5c9f086e7c6975c4dd
Instruction ID: e343998909d23fd7468c35b6fa02ca0f31ec44f9ae87d6ea46fdba3e8aac8156
Opcode Fuzzy Hash: 1651e6fb6217797b40c9043a7beff3e763d77e1a96279e5c9f086e7c6975c4dd
Instruction Fuzzy Hash: 34315370900209EBCB00DFA5DD89EDEBBB8FF48705F10806AE505B76A0D7785945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00411680, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00403850,00415D3C,?,?,?,?,?,?,?,?,?,?,004013F6), ref: 004116C4
__vbaHresultCheckObj.MSVBVM60(00000000,02DFED94,00403840,00000014,?,?,?,?,?,?,?,?,?,?,004013F6), ref: 004116E9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403860,00000078,?,?,?,?,?,?,?,?,?,?,004013F6), ref: 0041170D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004013F6), ref: 00411716

Memory Dump Source

Source File: 00000000.00000002.577257628.000000000040F000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.577240940.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.577248237.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.577264856.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.577272086.0000000000417000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFFER-8768777765554-PDF.jbxd

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: d6c556cfac8697e8f7986d476c3bca482dc4f093a247e28c14d290621612ff89
Instruction ID: fb602fee9238e94c5567c4f06410567dccd99697fd43e6dfed162ecb77ac7b0d
Opcode Fuzzy Hash: d6c556cfac8697e8f7986d476c3bca482dc4f093a247e28c14d290621612ff89
Instruction Fuzzy Hash: 331191B1940605ABCB109F95CD4AFEFBBB8FF58701F108466F601B32B0D67C65818BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report OFFER-8768777765554-PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: OFFER-8768777765554-PDF.exe PID: 5804 Parent PID: 5696

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: OFFER-8768777765554-PDF.exe PID: 5804 Parent PID: 5696 OFFER-8768777765554-PDF.exeCOMMON

Execution Graph

Function 022E574E, Relevance: 1.9, APIs: 1, Instructions: 354
COMMON

Function 022E5A9F, Relevance: 1.7, APIs: 1, Instructions: 151
memorynativeCOMMON

Function 022E5B47, Relevance: 1.6, APIs: 1, Instructions: 143
memorynativeCOMMON

Function 022E5BB0, Relevance: 1.6, APIs: 1, Instructions: 120
memorynativeCOMMON

Function 022E5B93, Relevance: 1.6, APIs: 1, Instructions: 98
memorynativeCOMMON

Function 0040DCBE, Relevance: 1.4, APIs: 1, Instructions: 106
memoryCOMMON

Function 00413070, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 249
COMMON

Function 00401644, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176
COMMON