Play interactive tour

Edit tour

Windows Analysis Report sVNHE4jjOw.exe

Overview

General Information

Sample Name:	sVNHE4jjOw.exe
Analysis ID:	449805
MD5:	72fe87cb4fd41cf172a9caecbdc6887f
SHA1:	2c8c745378f4a80e96dbabf574d1ac2d6408df69
SHA256:	6d26df7a7163053aa756f62ee4504af93020696cee98a1fc891c600ac76acc1c
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

PE / OLE file has an invalid certificate

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

sVNHE4jjOw.exe (PID: 2412 cmdline: 'C:\Users\user\Desktop\sVNHE4jjOw.exe' MD5: 72FE87CB4FD41CF172A9CAECBDC6887F)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://ceattire.com/bin_BDePikHU25.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: sVNHE4jjOw.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "http://ceattire.com/bin_BDePikHU25.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: sVNHE4jjOw.exe	Virustotal: Detection: 34%			Perma Link
Source: sVNHE4jjOw.exe	ReversingLabs: Detection: 23%

Source: sVNHE4jjOw.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\Dragt1.pdb source: sVNHE4jjOw.exe
Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\Dragt1.pdb@ source: sVNHE4jjOw.exe

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://ceattire.com/bin_BDePikHU25.bin

Source: sVNHE4jjOw.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: sVNHE4jjOw.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: sVNHE4jjOw.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: sVNHE4jjOw.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: sVNHE4jjOw.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: sVNHE4jjOw.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: sVNHE4jjOw.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: sVNHE4jjOw.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: sVNHE4jjOw.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: sVNHE4jjOw.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249561F NtAllocateVirtualMemory,	0_2_0249561F
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495608 NtAllocateVirtualMemory,	0_2_02495608
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495761 NtAllocateVirtualMemory,	0_2_02495761

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_00401470	0_2_00401470
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249561F	0_2_0249561F
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495A62	0_2_02495A62
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492A7D	0_2_02492A7D
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492A1E	0_2_02492A1E
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495AE6	0_2_02495AE6
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024982F3	0_2_024982F3
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02491282	0_2_02491282
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02498299	0_2_02498299
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024922A2	0_2_024922A2
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495AB8	0_2_02495AB8
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493B61	0_2_02493B61
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249830C	0_2_0249830C
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02496B29	0_2_02496B29
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492B26	0_2_02492B26
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492BDA	0_2_02492BDA
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249738E	0_2_0249738E
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493860	0_2_02493860
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02490000	0_2_02490000
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024980B4	0_2_024980B4
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249214C	0_2_0249214C
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024901CD	0_2_024901CD
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024979F8	0_2_024979F8
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024941FC	0_2_024941FC
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495985	0_2_02495985
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249399F	0_2_0249399F
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024949A8	0_2_024949A8
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024979AB	0_2_024979AB
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02490644	0_2_02490644
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249065D	0_2_0249065D
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02494653	0_2_02494653
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02494668	0_2_02494668
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492662	0_2_02492662
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493E65	0_2_02493E65
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495608	0_2_02495608
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249363C	0_2_0249363C
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024986DD	0_2_024986DD
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492EE8	0_2_02492EE8
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024926F6	0_2_024926F6
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02491F7E	0_2_02491F7E
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02498F74	0_2_02498F74
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249470F	0_2_0249470F
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024979AB	0_2_024979AB
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024977D5	0_2_024977D5
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02491F82	0_2_02491F82
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02494787	0_2_02494787
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02498FAD	0_2_02498FAD
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024927BE	0_2_024927BE
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02494C1D	0_2_02494C1D
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493CC0	0_2_02493CC0
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024904C2	0_2_024904C2
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024924DC	0_2_024924DC
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02496CE4	0_2_02496CE4
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024934F9	0_2_024934F9
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02491C99	0_2_02491C99
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02491CAE	0_2_02491CAE
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493506	0_2_02493506
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249351C	0_2_0249351C
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02494511	0_2_02494511
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024945CF	0_2_024945CF

Source: sVNHE4jjOw.exe

Static PE information: invalid certificate

Source: sVNHE4jjOw.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sVNHE4jjOw.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sVNHE4jjOw.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: sVNHE4jjOw.exe, 00000000.00000000.208241006.0000000000438000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDragt1.exe vs sVNHE4jjOw.exe
Source: sVNHE4jjOw.exe	Binary or memory string: OriginalFilenameDragt1.exe vs sVNHE4jjOw.exe

Source: sVNHE4jjOw.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCFF2D9BF10EAD27A.TMP

Jump to behavior

Source: sVNHE4jjOw.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sVNHE4jjOw.exe	Virustotal: Detection: 34%
Source: sVNHE4jjOw.exe	ReversingLabs: Detection: 23%

Source: sVNHE4jjOw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\Dragt1.pdb source: sVNHE4jjOw.exe
Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\Dragt1.pdb@ source: sVNHE4jjOw.exe

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_00404960 push es; ret	0_2_00404965
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B1774 push edx; ret	0_2_021B17A1
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B0218 push edx; ret	0_2_021B0241
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B4A13 push edx; ret	0_2_021B4A41
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B3213 push edx; ret	0_2_021B3241
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B1A13 push edx; ret	0_2_021B1A41
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B6214 push edx; ret	0_2_021B6241
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B5A03 push edx; ret	0_2_021B5A31
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B4205 push edx; ret	0_2_021B4231
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B2A05 push edx; ret	0_2_021B2A31
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B1205 push edx; ret	0_2_021B1231
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B4233 push edx; ret	0_2_021B4261
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B2A33 push edx; ret	0_2_021B2A61
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B1233 push edx; ret	0_2_021B1261
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B5A33 push edx; ret	0_2_021B5A61
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B5225 push edx; ret	0_2_021B5251
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B3A24 push edx; ret	0_2_021B3A51
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B2224 push edx; ret	0_2_021B2251
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B0A24 push edx; ret	0_2_021B0A51
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B6A24 push edx; ret	0_2_021B6A51
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B0A58 push edx; ret	0_2_021B0A81
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B5253 push edx; ret	0_2_021B5281
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B3A54 push edx; ret	0_2_021B3A81
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B2254 push edx; ret	0_2_021B2281
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B6A54 push edx; ret	0_2_021B6A81
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B0248 push edx; ret	0_2_021B0271
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B4A44 push edx; ret	0_2_021B4A71
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B3244 push edx; ret	0_2_021B3271
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B1A44 push edx; ret	0_2_021B1A71
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B6244 push edx; ret	0_2_021B6271
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_021B0278 push edx; ret	0_2_021B02A1

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495A62	0_2_02495A62
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492A7D	0_2_02492A7D
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492A1E	0_2_02492A1E
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493B61	0_2_02493B61
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492B26	0_2_02492B26
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492BDA	0_2_02492BDA
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249385C	0_2_0249385C
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493860	0_2_02493860
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024980B4	0_2_024980B4
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492EE8	0_2_02492EE8
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024924DC	0_2_024924DC
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493506	0_2_02493506
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249351C	0_2_0249351C

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

RDTSC instruction interceptor: First address: 0000000002497129 second address: 0000000002497129 instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	RDTSC instruction interceptor: First address: 0000000002497129 second address: 0000000002497129 instructions:
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	RDTSC instruction interceptor: First address: 00000000024992E8 second address: 00000000024992E8 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp edx, dword ptr [ebp+44h] 0x0000000e jne 00007F638CBCE529h 0x00000010 sub edx, 04h 0x00000013 xor dword ptr [edx], ecx 0x00000015 pushad 0x00000016 lfence 0x00000019 rdtsc

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Code function: 0_2_02493A60 rdtsc

0_2_02493A60

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Code function: 0_2_02493A60 rdtsc

0_2_02493A60

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249320F mov eax, dword ptr fs:[00000030h]	0_2_0249320F
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02492A1E mov eax, dword ptr fs:[00000030h]	0_2_02492A1E
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02495283 mov eax, dword ptr fs:[00000030h]	0_2_02495283
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024980B4 mov eax, dword ptr fs:[00000030h]	0_2_024980B4
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02496F30 mov eax, dword ptr fs:[00000030h]	0_2_02496F30
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_024974A3 mov eax, dword ptr fs:[00000030h]	0_2_024974A3
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_02493506 mov eax, dword ptr fs:[00000030h]	0_2_02493506
Source: C:\Users\user\Desktop\sVNHE4jjOw.exe	Code function: 0_2_0249351C mov eax, dword ptr fs:[00000030h]	0_2_0249351C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: sVNHE4jjOw.exe, 00000000.00000002.1292457219.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: sVNHE4jjOw.exe, 00000000.00000002.1292457219.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: sVNHE4jjOw.exe, 00000000.00000002.1292457219.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: sVNHE4jjOw.exe, 00000000.00000002.1292457219.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\sVNHE4jjOw.exe

Code function: 0_2_02490644 cpuid

0_2_02490644

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery311	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sVNHE4jjOw.exe	35%	Virustotal		Browse
sVNHE4jjOw.exe	24%	ReversingLabs	Win32.Trojan.AgentTesla

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ceattire.com/bin_BDePikHU25.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ceattire.com/bin_BDePikHU25.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	449805
Start date:	16.07.2021
Start time:	11:48:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	sVNHE4jjOw.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Suspected Instruction Hammering Hide Perf
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 53% Number of executed functions: 6 Number of non-executed functions: 76
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:
Entropy (8bit):	4.800085383449222
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sVNHE4jjOw.exe
File size:	267408
MD5:	72fe87cb4fd41cf172a9caecbdc6887f
SHA1:	2c8c745378f4a80e96dbabf574d1ac2d6408df69
SHA256:	6d26df7a7163053aa756f62ee4504af93020696cee98a1fc891c600ac76acc1c
SHA512:	6fa975b8ba69692b6eb278f4145d13fea8d3c64c33d7f9267172f1718f4a4a1f0852cc65f4b16691d152afe9035f038c4c203deecf85e56ecf451448f8a6f60a
SSDEEP:	1536:35/ikBkzm219ZmFtg5sfrWrNjosvNmmCUibm84t3TxY/n:35/pkdPAw0iNVvNnbVZxY/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................................Rich............PE..L..... L.................`..........p........p....@................

File Icon


Icon Hash:	e8ccce8e8ececce8

Static PE Info

General
Entrypoint:	0x401470
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4C20BCC1 [Tue Jun 22 13:38:09 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a6a8fddf213e725d12277ffa52409c50

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Unstaunch1@Strygeork.GUN, CN=ryper, OU=Nonpropa4, O=Twisti8, L=Efterspil4, S=FORDUMM, C=AD
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	7/15/2021 2:48:16 PM 7/15/2022 2:48:16 PM
Subject Chain	E=Unstaunch1@Strygeork.GUN, CN=ryper, OU=Nonpropa4, O=Twisti8, L=Efterspil4, S=FORDUMM, C=AD
Version:	3
Thumbprint MD5:	74A7224C73056759B33CA9EB4F1649A0
Thumbprint SHA-1:	C9DACC639E15797636E4B8185A4E5522E877B0B9
Thumbprint SHA-256:	CEEC9E9D00E6C96EE6ECF708C8F2812C2BC31DADAF84E625E66CEA556F34ABA7
Serial:	00

Entrypoint Preview

Instruction
push 0043195Ch
call 00007F638C76B043h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
pop ds
mov dword ptr [ecx+4B63D25Ch], edx
lodsb
mov dx, fs
dec ebx
push FFFFFFDBh
call far 0000h : 000000B2h
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+6Eh], cl
add byte ptr fs:[eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
adc bh, byte ptr [edx-74h]
sbb al, 48h
dec ebp
into
dec esp
dec edi
mov cl, BEh
stc
and byte ptr [ebx-53h], bh
add dword ptr [edi-08h], 08h
lodsd
push ebx
sbb esp, edx
dec ebx
test esp, esi
xchg eax, edi
fmul st(0), st(1)
and eax, 4F3ADC4Eh
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, dword ptr [ebx]
add eax, dword ptr [eax]
xor esi, dword ptr [ebp+00h]
add byte ptr [eax], al
push es
add byte ptr [edi+ebp*2+6Ch], al
imul esp, dword ptr [ebx+37h], 06010D00h
add byte ptr [ebx+74h], dh
jne 00007F638C76B0B6h
imul esp, dword ptr [ebp+00h], 42000119h
add byte ptr [edx], ah
add byte ptr [ebx], ah
out dx, al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36684	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x7a8a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x40050	0x1440
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1120	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x35bb0	0x36000	False	0.257260923032	data	4.74248188384	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x37000	0xbd4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x38000	0x7a8a	0x8000	False	0.294769287109	data	4.40772584771	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3f422	0x668	data
RT_ICON	0x3f13a	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 998965248, next used block 48059
RT_ICON	0x3ef52	0x1e8	data
RT_ICON	0x3ee2a	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x3df82	0xea8	data
RT_ICON	0x3d6da	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
RT_ICON	0x3d012	0x6c8	data
RT_ICON	0x3caaa	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x3a502	0x25a8	data
RT_ICON	0x3945a	0x10a8	data
RT_ICON	0x38ad2	0x988	data
RT_ICON	0x3866a	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x385bc	0xae	data
RT_VERSION	0x38300	0x2bc	data	Swahili	Kenya
RT_VERSION	0x38300	0x2bc	data	Swahili	Mozambiq

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFPFix, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0441 0x04b0
LegalCopyright	ON24
InternalName	Dragt1
FileVersion	7.00
CompanyName	ON24
LegalTrademarks	ON24
Comments	ON24
ProductName	ON24
ProductVersion	7.00
FileDescription	ON24
OriginalFilename	Dragt1.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Swahili	Kenya
Swahili	Mozambiq

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: sVNHE4jjOw.exe PID: 2412 Parent PID: 5704

General

Start time:	11:49:31
Start date:	16/07/2021
Path:	C:\Users\user\Desktop\sVNHE4jjOw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\sVNHE4jjOw.exe'
Imagebase:	0x400000
File size:	267408 bytes
MD5 hash:	72FE87CB4FD41CF172A9CAECBDC6887F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: sVNHE4jjOw.exe PID: 2412 Parent PID: 5704 sVNHE4jjOw.exeCOMMON

Executed Functions

Function 00401470, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 558COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6%*), ref: 00401475

Strings

VB5!6%*, xrefs: 00401470

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6%*
API String ID: 1341478452-4246263594
Opcode ID: c58653350585d6d98adc73b0093502f6cdad12910b50824b152bc7e5a367362e
Instruction ID: e4185a9a695d556fc2b0c62350280a669328ec9fed1297f78330eef47098c6c1
Opcode Fuzzy Hash: c58653350585d6d98adc73b0093502f6cdad12910b50824b152bc7e5a367362e
Instruction Fuzzy Hash: 8522179660E7C04FD7234B649AA56593F71DF2B248F0A04DBC681CF2E7E5181D0AD7A3

Uniqueness

Uniqueness Score: -1.00%

Function 02495608, Relevance: 1.7, APIs: 1, Instructions: 195memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(44FC89A7), ref: 024957C2

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8d8255ab72de63bd934cfbd15b2248345e7063b48fd561580dff2e2bacd556a3
Instruction ID: 5820c7225478e994db8fbc5928bc5d7776c290d32ddc0a6d0ae9c253528f5a1e
Opcode Fuzzy Hash: 8d8255ab72de63bd934cfbd15b2248345e7063b48fd561580dff2e2bacd556a3
Instruction Fuzzy Hash: 0861367521434A8FDF349F39DCA17EA3BA6EF45390F94412EDC8A8B242C7319586CB06

Uniqueness

Uniqueness Score: -1.00%

Function 0249561F, Relevance: 1.7, APIs: 1, Instructions: 193memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(44FC89A7), ref: 024957C2

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fc8f18467f4568b828f977419cbdeb7c00f09a9034be4b13168db6d943ed9f15
Instruction ID: e0aacd5626b8a8baee329cf80ecbe31e697bc050ebc5af4756df85e6593ae723
Opcode Fuzzy Hash: fc8f18467f4568b828f977419cbdeb7c00f09a9034be4b13168db6d943ed9f15
Instruction Fuzzy Hash: 7F51363520434A8FDF249F79DCA07EA7BA6EF45354F84412EDC8ADB241C7309986CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02495761, Relevance: 1.6, APIs: 1, Instructions: 126memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(44FC89A7), ref: 024957C2

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 144e46f01a765c84403434fe4e4dc10e6f49be08d517596cf802daa6b8b1acce
Instruction ID: 5b8eabd15a9c1c605ec5068e3c0e9794fd970811a1977c15f3a7f4aa53563529
Opcode Fuzzy Hash: 144e46f01a765c84403434fe4e4dc10e6f49be08d517596cf802daa6b8b1acce
Instruction Fuzzy Hash: 2131233111538ADFCF258F7898A07EA3FA5EF4A354FA4516ACC898B212C3329547CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00433864, Relevance: 214.7, APIs: 116, Strings: 6, Instructions: 1225COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004339B0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004339CB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F68,00000138), ref: 004339ED
__vbaFreeObj.MSVBVM60(00000000,00000000,00432F68,00000138), ref: 004339F8
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433A10
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433A2B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00432F78,000001C8), ref: 00433A79
__vbaFreeObj.MSVBVM60(00000000,?,00432F78,000001C8), ref: 00433A84
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433A9C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433AB7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F88,00000098), ref: 00433AE1
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433B00
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433B1B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F88,00000130), ref: 00433B40
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00433B56
__vbaStrVarMove.MSVBVM60(00000000), ref: 00433B5F
__vbaStrMove.MSVBVM60(00000000), ref: 00433B6C
__vbaFreeStr.MSVBVM60 ref: 00433B9F
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00433BBB
__vbaFreeVar.MSVBVM60 ref: 00433BC9
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433BE1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433BFC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F88,00000130), ref: 00433C21
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00433C37
__vbaStrVarMove.MSVBVM60(?), ref: 00433C46
__vbaStrMove.MSVBVM60(?), ref: 00433C53
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 00433C8B
__vbaFreeStr.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 00433C9D
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00433CB2
__vbaFreeVar.MSVBVM60(00401198,00432A0C,00000710), ref: 00433CC0
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000708), ref: 00433CE1
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000714), ref: 00433D29
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000718), ref: 00433D43
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433D5B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433D76
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F68,000000A8), ref: 00433D9F
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 00433DF7
__vbaFreeObj.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 00433E02
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,0000070C), ref: 00433E23
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,000006FC), ref: 00433E44
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 00433E9A
__vbaStrCopy.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 00433EAA
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 00433EDD
__vbaFreeStr.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 00433EE8
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,0000071C), ref: 00433F1F
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433F37
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433F52
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FE0,00000058), ref: 00433F75
__vbaFreeObj.MSVBVM60 ref: 00433FA7
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00433FBF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00433FDA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001D0), ref: 00434003
__vbaFreeObj.MSVBVM60 ref: 0043402E
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000708), ref: 0043404F
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000700), ref: 00434069
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,000006F8), ref: 00434098
__vbaStrCopy.MSVBVM60(00000000,00401198,00432A0C,000006F8), ref: 004340A8
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 004340DB
__vbaFreeStr.MSVBVM60(00000000,00401198,00432A0C,00000710), ref: 004340E6
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004340FE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434119
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F68,000000F0), ref: 00434142
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 0043415A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434175
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001D0), ref: 0043419E
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000714), ref: 004341E9
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004341FE
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00434268
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434283
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000110), ref: 004342AC
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,0000071C), ref: 004342E4
__vbaFreeObj.MSVBVM60(00000000,00401198,00432A0C,0000071C), ref: 004342EF
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00434307
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434322
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000130), ref: 0043434B
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00434363
__vbaObjSet.MSVBVM60(?,00000000), ref: 0043437E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000130), ref: 004343A7
__vbaStrMove.MSVBVM60(00000000,00000000,00432F78,00000130), ref: 004343BF
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004343FB
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000002,?,?), ref: 00434410
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000708), ref: 00434434
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 0043444C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434467
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,00000198), ref: 00434490
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004344A8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004344C3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000190), ref: 004344EC
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00434504
__vbaObjSet.MSVBVM60(?,00000000), ref: 0043451F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000198), ref: 00434548
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000714), ref: 00434595
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 004345B1
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000700), ref: 004345CE
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004345E6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434601
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000190), ref: 0043462A
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 00434682
__vbaFreeObj.MSVBVM60(00000000,00401198,00432A0C,00000704), ref: 0043468D
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000700), ref: 004346A7
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004346BF
__vbaObjSet.MSVBVM60(?,00000000), ref: 004346DA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,00000218), ref: 00434703
__vbaStrMove.MSVBVM60(00000000,00000000,00432FF0,00000218), ref: 0043471B
__vbaFreeStr.MSVBVM60 ref: 0043474C
__vbaFreeObj.MSVBVM60 ref: 00434757
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,0000071C), ref: 0043478E
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,00000718), ref: 004347A8
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004347C0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004347DB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F88,00000180), ref: 00434804
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 0043481C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00434837
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000000E0), ref: 00434860
__vbaHresultCheckObj.MSVBVM60(00000000,00401198,00432A0C,0000071C), ref: 00434899
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004348AE

Strings

pKbU, xrefs: 00433E5E, 00433E64
D, xrefs: 00434736
enteromesenteric, xrefs: 0043409D
Fejlstatistik8, xrefs: 00433B7E
HETEROINTOXICATION, xrefs: 00434729
untransplanted, xrefs: 00433E9F

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$List$Move$CallCopyLate
String ID: Fejlstatistik8$HETEROINTOXICATION$enteromesenteric$pKbU$untransplanted$D
API String ID: 4096466292-1851894414
Opcode ID: a239745b342ede122dd1d60b379abfa45515bdd6e32997a8a929edc85935cdb1
Instruction ID: b07bd04ad431df16e05008aaf64c7b7b6cde514a794b4b75967a9fc9f5e11353
Opcode Fuzzy Hash: a239745b342ede122dd1d60b379abfa45515bdd6e32997a8a929edc85935cdb1
Instruction Fuzzy Hash: 22A262B0940219ABDB25DF65CC99FEA77BCAF08744F0014EAF149E71A1DB786B448F24

Uniqueness

Uniqueness Score: -1.00%

Function 021B1774, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1292851016.00000000021B0000.00000020.00000001.sdmp, Offset: 021B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14872ad2f014097387461cb21cd14898ae5db81e1647690076b7f84f82f41499
Instruction ID: 4c83abdcc03877154a12db9d1994558158ff25058f948318647a9324eb0c1780
Opcode Fuzzy Hash: 14872ad2f014097387461cb21cd14898ae5db81e1647690076b7f84f82f41499
Instruction Fuzzy Hash: CDD05EB2308100FFD208CB18CC46EDA73E8EB85720F0049B9F108CB240E731ED418762

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 024980B4, Relevance: 9.2, Strings: 6, Instructions: 1686COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
)TN*, xrefs: 02498A3A
NJ$3, xrefs: 02494C8C
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: #Tj1$)TN*$NJ$3$\*aO$cxX%$mSNg
API String ID: 0-2614204796
Opcode ID: 452dad6b672f08d4e1c9a04f0aabb011a13687391b1ad7649ebb311ccdfb2f86
Instruction ID: 61934ba64021476ffd258961a8643f201ade912a5803bdf402cb02f46d7dadb3
Opcode Fuzzy Hash: 452dad6b672f08d4e1c9a04f0aabb011a13687391b1ad7649ebb311ccdfb2f86
Instruction Fuzzy Hash: 07E257716043899FDF349F38CD957DA7BA2EF56350F45822EDC8A8B255D3308A85CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02495A62, Relevance: 8.5, Strings: 6, Instructions: 1033COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
NJ$3, xrefs: 02494C8C
O]9{, xrefs: 02495DCC
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: #Tj1$NJ$3$O]9{$\*aO$cxX%$mSNg
API String ID: 2167126740-4196490922
Opcode ID: 13c2093180f6d04d6a270e77b22f53772c752d4ef9896d279b433a18cdbabc92
Instruction ID: 9cdd4ec3f5e862e6ff165abb8bd4cc5c16ea6dacfad2f146eafb0ed0b0fe8413
Opcode Fuzzy Hash: 13c2093180f6d04d6a270e77b22f53772c752d4ef9896d279b433a18cdbabc92
Instruction Fuzzy Hash: 55921D7160434A9FDF349E78CD957EA7BA2FF55350F95422EDC8A8B254D3308A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02493506, Relevance: 8.5, Strings: 6, Instructions: 1008COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
ktP, xrefs: 024905FA
NJ$3, xrefs: 02494C8C
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: #Tj1$NJ$3$\*aO$cxX%$ktP$mSNg
API String ID: 0-2826044771
Opcode ID: b121bd90a5d0f97b10d6f652805510a193e792c7df99c2d0ce3bd891c5f21fd1
Instruction ID: 05c0c79e7ec67c85488f152af3744c2653beed7cbe11f1e0af935eeec0fd7b01
Opcode Fuzzy Hash: b121bd90a5d0f97b10d6f652805510a193e792c7df99c2d0ce3bd891c5f21fd1
Instruction Fuzzy Hash: 57922E716043499FDF789F38C9957EA7BA2FF55350F95862EDC8A8B254D3308A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02495985, Relevance: 7.1, Strings: 5, Instructions: 844COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
NJ$3, xrefs: 02494C8C
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: #Tj1$NJ$3$\*aO$cxX%$mSNg
API String ID: 2167126740-1921171324
Opcode ID: e4eb92923a14142aaa7d8bc3b07675b31c724a5e962cbcb0d754f3d29b50105d
Instruction ID: d2c20668641eac9d347d0894307ab77aa7508833b5de7e89f88467b659ec2617
Opcode Fuzzy Hash: e4eb92923a14142aaa7d8bc3b07675b31c724a5e962cbcb0d754f3d29b50105d
Instruction Fuzzy Hash: 23720C716043899FDF349F78C8957EA7BA2FF56340F95422EDC8A8B254D7308A85CB06

Uniqueness

Uniqueness Score: -1.00%

Function 024934F9, Relevance: 7.0, Strings: 5, Instructions: 795COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
NJ$3, xrefs: 02494C8C
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: #Tj1$NJ$3$\*aO$cxX%$mSNg
API String ID: 0-1921171324
Opcode ID: 4feb0a6c464de9be8a8bf1815b48b5cefb0e39493b526bbfc37bc3db500104be
Instruction ID: c9307b37eca3fc91513e5c264fab2016798b8b55beec54d24ca0e62dab1dc477
Opcode Fuzzy Hash: 4feb0a6c464de9be8a8bf1815b48b5cefb0e39493b526bbfc37bc3db500104be
Instruction Fuzzy Hash: 00621D716043499FDF389E78CD957EA7BA2FF56340F95422EDC8A8B254D3308A85CB06

Uniqueness

Uniqueness Score: -1.00%

Function 024941FC, Relevance: 6.9, Strings: 5, Instructions: 665COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
#Tj1, xrefs: 024943D2
NJ$3, xrefs: 02494C8C
\*aO, xrefs: 024944BC
cxX%, xrefs: 02494487

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: #Tj1$NJ$3$\*aO$cxX%$mSNg
API String ID: 0-1921171324
Opcode ID: 06eae3d1b4e0d0a7774400c973b172410bb9d8a5bded69ebca620dad27954bed
Instruction ID: 379ef9a749ad15f4224fc69dc29cd6e7eee3abf809ce59eadd6c77c9a891f5d6
Opcode Fuzzy Hash: 06eae3d1b4e0d0a7774400c973b172410bb9d8a5bded69ebca620dad27954bed
Instruction Fuzzy Hash: C942EE71604389AFCF349E78CD957DA7BA2FF56340F85422EDC8A8B254D3318A85CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02494511, Relevance: 3.0, Strings: 2, Instructions: 508COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: 4ee7a0f458cc768f0f0373bfe4bf5a17db305e6e69d40c28821d6c446466e9e4
Instruction ID: 347b11ba2c021600856095e0af5e38f46c9ddbbccd91cf57b3823e86bb1723e6
Opcode Fuzzy Hash: 4ee7a0f458cc768f0f0373bfe4bf5a17db305e6e69d40c28821d6c446466e9e4
Instruction Fuzzy Hash: 49120071604388AFCF349E74DD947EA3BA2EF9A350F85412EDD8D8B254D3314A86CB16

Uniqueness

Uniqueness Score: -1.00%

Function 024945CF, Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: d51ea45222006512c36eddbdfe106ed58afd2a851a893381d5b81b122e2212db
Instruction ID: 7962c414d754bf4fb10007abe15a5a795e0811810326b4235d623888d567ef38
Opcode Fuzzy Hash: d51ea45222006512c36eddbdfe106ed58afd2a851a893381d5b81b122e2212db
Instruction Fuzzy Hash: 9E020E716043889FCF349E68DD947EA3BA2FF99340F85412EDD8E8B254D7318A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02494653, Relevance: 2.9, Strings: 2, Instructions: 434COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: 1cc46bb4434a3dc63ff9e9ec1f65191fab666380a1b71b9f1473724bc0f5cb10
Instruction ID: c7c983f8f4ed05bcead131db5181b7a33862382d2fea0579020b8cdcd00d645c
Opcode Fuzzy Hash: 1cc46bb4434a3dc63ff9e9ec1f65191fab666380a1b71b9f1473724bc0f5cb10
Instruction Fuzzy Hash: 5F020C722043889FCF349E64DD947EA3BA2EF5A340F85412EDD8E8B254D3314A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02494668, Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: fbc716c486ab89a84ef39c9bce4c3f0b89cb8f6db4459c46cb7f3b0386843a95
Instruction ID: 058f04c917a4f0301e5a191da7ced7fc084a8ac5a8eb03078f1e806353db9420
Opcode Fuzzy Hash: fbc716c486ab89a84ef39c9bce4c3f0b89cb8f6db4459c46cb7f3b0386843a95
Instruction Fuzzy Hash: A7020E726043889FCF349E64DD957EA3BA2FF5A340F85412EDD8E8B254D3314A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 0249470F, Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: 4e974f230e342dd0d0f0d37fd991cb115b4498914d148e2f93bdee4b8df8afaa
Instruction ID: fc8406688ce90fa8457ec1dfed4548f70f20a585a9229c49fc3adaa4153befa1
Opcode Fuzzy Hash: 4e974f230e342dd0d0f0d37fd991cb115b4498914d148e2f93bdee4b8df8afaa
Instruction Fuzzy Hash: 3EF10D726043889FCF349E64DD957DA3BA2FF5A340F85422EDD8E8B254D3318A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02494787, Relevance: 2.9, Strings: 2, Instructions: 395COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: b03ceceaa3419a20ac834ce8ad500a60cf2599bfa308246d64c1e1ca5c3358c1
Instruction ID: 62b653990244ab9eb810ec76a7606266e0f588b9299b3f13d29dacbce3275390
Opcode Fuzzy Hash: b03ceceaa3419a20ac834ce8ad500a60cf2599bfa308246d64c1e1ca5c3358c1
Instruction Fuzzy Hash: DDF1FD726003889FCF349E74DD987DA3BA2FF5A340F85412EDD8A8B254D7314A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02493B61, Relevance: 2.8, Strings: 2, Instructions: 296COMMON

Download Yara Rule

Strings

ktP, xrefs: 024905FA
V_y`, xrefs: 02493BBE

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: V_y`$ktP
API String ID: 0-3587567387
Opcode ID: ca4950afe7d185c8da2b9e512c2a793289ea36787febd7da536d1f5811c1990c
Instruction ID: 871bbcacb8c34ef0c58f18e1bf9ff736a524d8f523078ed8982d9c304942636e
Opcode Fuzzy Hash: ca4950afe7d185c8da2b9e512c2a793289ea36787febd7da536d1f5811c1990c
Instruction Fuzzy Hash: C5B18D716043859FDF309E74C9943DA7FA2EF42360F45426EDCDA8B292E3358986C741

Uniqueness

Uniqueness Score: -1.00%

Function 024949A8, Relevance: 2.8, Strings: 2, Instructions: 291COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: 694a380b43f2b1b37fd086c7dd3fc4012df5f13a1e27a66cfa871f463c25b07a
Instruction ID: 100486eb30a0b05293c066329674752c9c2f6c0cb0a9267aad3209bc0f062885
Opcode Fuzzy Hash: 694a380b43f2b1b37fd086c7dd3fc4012df5f13a1e27a66cfa871f463c25b07a
Instruction Fuzzy Hash: FCC1EDB1640388AFDF359E75CC947DA3BA2FF5A350F94412EDE898B214D3318A85CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02496CE4, Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

FE6?, xrefs: 02496D09
+px, xrefs: 02496D0E

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: FE6?$+px
API String ID: 0-3367617166
Opcode ID: bdb9e8e06dd478b18dfb2ecedde0ee991127d120f420b028b084fd11eb0674cf
Instruction ID: 13e831f4acdc6afb5680892a9cf66abe82a67292630940541b77bc832f6f96e5
Opcode Fuzzy Hash: bdb9e8e06dd478b18dfb2ecedde0ee991127d120f420b028b084fd11eb0674cf
Instruction Fuzzy Hash: 57917C756153899FCF249E38C9513EA3BA7EF56360F92012EDCCAD7251E3318986CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02494C1D, Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

mSNg, xrefs: 02494DA2
NJ$3, xrefs: 02494C8C

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: NJ$3$mSNg
API String ID: 0-3754154513
Opcode ID: d4131c275a6f66dde879d605c7a8e58e8690801b74ca2bfee327da0670c6b5b6
Instruction ID: 13ef1e48382579e863187a585907fe3b437d4d2c64399e8aaddda94c244f4eac
Opcode Fuzzy Hash: d4131c275a6f66dde879d605c7a8e58e8690801b74ca2bfee327da0670c6b5b6
Instruction Fuzzy Hash: FC61DCB16402889FDF758F28DC907DA3BA2FF9A310F54412EDD8A8B224D7718A95CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02492662, Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

ktP, xrefs: 024905FA

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ktP
API String ID: 0-1620966732
Opcode ID: 3f4142cf80757a67a346f36a23f21b650270d9c8bf2d92e0c98c8908d824a58d
Instruction ID: 3b83c3f9f6402990127268e848c225020525ecdff8fdf9c20c2db9b8b1f79f81
Opcode Fuzzy Hash: 3f4142cf80757a67a346f36a23f21b650270d9c8bf2d92e0c98c8908d824a58d
Instruction Fuzzy Hash: 69E146716043499FDF609E39C9553EABBE6EF82760F56852EDCC9D7214E3308986CB02

Uniqueness

Uniqueness Score: -1.00%

Function 024904C2, Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

ktP, xrefs: 024905FA

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ktP
API String ID: 0-1620966732
Opcode ID: b7c5a06d4a2c5c56dad1fbc4430d2d0371a25ce45b1596a84cd2b2df701bf30d
Instruction ID: 30f9eb3ebd7724b0038d7aa5afb24bcd37c4ad783cee0aedba5f13ae6cae0662
Opcode Fuzzy Hash: b7c5a06d4a2c5c56dad1fbc4430d2d0371a25ce45b1596a84cd2b2df701bf30d
Instruction Fuzzy Hash: EAC15BB56143899FDF349E34C9653EE3BA7EF923A0F51412EDC8A9B240E7358946CB01

Uniqueness

Uniqueness Score: -1.00%

Function 024979AB, Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

ktP, xrefs: 024905FA

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ktP
API String ID: 0-1620966732
Opcode ID: aff0a00bb69bce9f0c7046f527df40bffeae2ade1ae1578e407888244199b7da
Instruction ID: 54b606377e9ef481f81daeb26c2b7551340fa306f4d38dc4344e80db827f32d8
Opcode Fuzzy Hash: aff0a00bb69bce9f0c7046f527df40bffeae2ade1ae1578e407888244199b7da
Instruction Fuzzy Hash: ECB14772A043469FDF309E798D903DA7BA2EF95360F95412FCC8997744E7309A81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02491282, Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

, xrefs: 024912B7

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 10dfba4eab96a2c74ab1a28ada1a75e458028ee53ab6f55487b1f959c3988d36
Instruction ID: ac7fb68bfa1752a166e2915e0323aa9099ff4600704de4f073d3f1250514d6e5
Opcode Fuzzy Hash: 10dfba4eab96a2c74ab1a28ada1a75e458028ee53ab6f55487b1f959c3988d36
Instruction Fuzzy Hash: 22B18F715083899FCF219E7888653EE7FA2AF43360F86426FDCD99B691D3354986C702

Uniqueness

Uniqueness Score: -1.00%

Function 02498F74, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

ZR, xrefs: 02499297

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ZR
API String ID: 0-3287778290
Opcode ID: 89c4f94048b023e12673dd731ac396ce218496b25d523383cf3e6556d079cdd3
Instruction ID: 0bdc539f9309d915a7643d3d77e8b10294941b9d42c4dd9cb94ad8b947fd439a
Opcode Fuzzy Hash: 89c4f94048b023e12673dd731ac396ce218496b25d523383cf3e6556d079cdd3
Instruction Fuzzy Hash: D7B1FFB1604389DFDF38DE75C9A87DA3BA2AF55310F95812ECC4A8B254D3718A85CB05

Uniqueness

Uniqueness Score: -1.00%

Function 02495AB8, Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

O]9{, xrefs: 02495DCC

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O]9{
API String ID: 0-1325666202
Opcode ID: 65c6a2ed58b9b482bc0c03f38ef3b31f661fb1af8bc186c73d1333d1503aabf1
Instruction ID: 51b3b08d0516679a652810f36a5e5af03283ae2289575854d5427e8c3f21666a
Opcode Fuzzy Hash: 65c6a2ed58b9b482bc0c03f38ef3b31f661fb1af8bc186c73d1333d1503aabf1
Instruction Fuzzy Hash: 5791157164434A9FDF349E358D547EA7BE2FF45350F9A442EDCCA9B214E33049869B02

Uniqueness

Uniqueness Score: -1.00%

Function 02495AE6, Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

O]9{, xrefs: 02495DCC

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O]9{
API String ID: 0-1325666202
Opcode ID: 3929c351d7e78ca5f90b58f33665673f6c6faf509a24855662b46d73d48a0694
Instruction ID: ed64e6154e312aa6b953026e2a5f1c16a3b36da4bc0d971ea422d94f7d9a8d34
Opcode Fuzzy Hash: 3929c351d7e78ca5f90b58f33665673f6c6faf509a24855662b46d73d48a0694
Instruction Fuzzy Hash: 0A81E43164434A9FDF349E398D547EA77E2FF45350F96842EDCCA9B114E33089859B02

Uniqueness

Uniqueness Score: -1.00%

Function 024922A2, Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

Uox, xrefs: 02492453

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: Uox
API String ID: 2167126740-744209107
Opcode ID: ba9abf2d2bec9c23a334c6985b3e4e81bed22dae0a010e1d77ab743a0ba5a4f5
Instruction ID: 985bcdf1cedeeed76f38b96d98d4bd4ed192d81450f002b713129ca5ec20b672
Opcode Fuzzy Hash: ba9abf2d2bec9c23a334c6985b3e4e81bed22dae0a010e1d77ab743a0ba5a4f5
Instruction Fuzzy Hash: E6710471A043499BDF34AF25C8A47DF7BA7BF86750F95802EDC4D9B204E7318A868B01

Uniqueness

Uniqueness Score: -1.00%

Function 02498FAD, Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

ZR, xrefs: 02499297

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ZR
API String ID: 0-3287778290
Opcode ID: ecc1098ad2ebfc9a8f7f3fddb19c24d202811c9d20f3786842bca42a68ce7c30
Instruction ID: c1c48aba07cbcca5857ac456a9015ea3d98adcd902b2bb9dd3b29bff35aff393
Opcode Fuzzy Hash: ecc1098ad2ebfc9a8f7f3fddb19c24d202811c9d20f3786842bca42a68ce7c30
Instruction Fuzzy Hash: F671E071600349EFDF38DE75C9A97DA3BA3AF59300F85812ECC4A8B264D3718A85CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02492EE8, Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

LJ`, xrefs: 02492F14

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: LJ`
API String ID: 0-2279371442
Opcode ID: 3d3e08c05ce0da0ca100457696626ef6a9e64bef038917515428c83bd715da86
Instruction ID: 43f14649798f5a879bbd6ccf4edb880a1b9392050e75685b04dcd724cfd9fa95
Opcode Fuzzy Hash: 3d3e08c05ce0da0ca100457696626ef6a9e64bef038917515428c83bd715da86
Instruction Fuzzy Hash: 7B61E271A0035AEFDF24CF68C9957DABBA2BF4A300F55412ADC899B301D374AD52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 024901CD, Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

-/!u, xrefs: 02490399

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: -/!u
API String ID: 2167126740-3976018290
Opcode ID: e0e2a4ff9efe6df3473254c698858748326484ecd1eb83ff54cd719b723b2abb
Instruction ID: cbe9c7c95467a011465847850f770b5a26fa6ffc737cfeedd68ec8a871cd0b83
Opcode Fuzzy Hash: e0e2a4ff9efe6df3473254c698858748326484ecd1eb83ff54cd719b723b2abb
Instruction Fuzzy Hash: C151CEB2541346AFDF206E358D607DE6BA39FD7360F86021EDCC957244E735898B8702

Uniqueness

Uniqueness Score: -1.00%

Function 02493860, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

ktP, xrefs: 024905FA

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ktP
API String ID: 0-1620966732
Opcode ID: f1221427fdf04c0055e01f7738668ae6997fd5a1ad15bf46eefa3403079a505a
Instruction ID: 04cd7dd65285939210d475f54dc269eb1c9f56d65e2c16c6b845efbcd98e9dff
Opcode Fuzzy Hash: f1221427fdf04c0055e01f7738668ae6997fd5a1ad15bf46eefa3403079a505a
Instruction Fuzzy Hash: D73135B82453468FDF749E3884947EA7BA2AF44300F90441EEC8AC6285D73289C58A03

Uniqueness

Uniqueness Score: -1.00%

Function 02492A1E, Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37239c1b4813397764a569749116b02a6d5aea54135ec7282711c852a3354c4
Instruction ID: 0504794869f5c183930341d5d205293d05555616f9d5986d65b914c02c67b279
Opcode Fuzzy Hash: b37239c1b4813397764a569749116b02a6d5aea54135ec7282711c852a3354c4
Instruction Fuzzy Hash: 7552CE71A0475A9FDF34DF28C8947DABBA6BF59350F45412EDC899B300D730AA82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02492A7D, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b852fa6bd15ec316164e1ba4d154a4b410e6474b563e17e0727a478556529ed3
Instruction ID: cc3e4d0257c4cf20d948de75525429b36cef64854db6745f39cf32c5cbc4853a
Opcode Fuzzy Hash: b852fa6bd15ec316164e1ba4d154a4b410e6474b563e17e0727a478556529ed3
Instruction Fuzzy Hash: BCF1EE71B0475A9FDB24CF28C894BDABBA6BF59350F85822EDC8D97300D770A941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02492B26, Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bc9482650e4d3f43fcd3f550d90739a8e04c03cd8c94916b6c66bd17df023b
Instruction ID: a89cd5460d2291549d8be0817ed08bb1acd59c3a948b0e47829d5a345c79645c
Opcode Fuzzy Hash: 26bc9482650e4d3f43fcd3f550d90739a8e04c03cd8c94916b6c66bd17df023b
Instruction Fuzzy Hash: FFF1FF71B0474AAFDF24CE28C890BDABBA2BF59350F85412EDC8D97301D770A942CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02492BDA, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a09f17e8b65b49e998e4a63a1d379c0779b00be83fa65c3da3c8e3f96841d08
Instruction ID: 7fe55997f96fd7b07fd1821534a91a1a24b885cb019651603d44b1a4c8bdeaa0
Opcode Fuzzy Hash: 0a09f17e8b65b49e998e4a63a1d379c0779b00be83fa65c3da3c8e3f96841d08
Instruction Fuzzy Hash: 3FD1E071A0475A9FDF34CE28CC947EABBA6BF59350F95812ADC8D97300D7709D428B81

Uniqueness

Uniqueness Score: -1.00%

Function 02493CC0, Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62abe7bfdddcb6c6abefc03b25981bcab91efbb8711481e7d90e79a0b8c3c453
Instruction ID: ae9d0c927f3389bf1cfb93c848ba724f67fa1be838c4efb8cfa3dd9493efba8d
Opcode Fuzzy Hash: 62abe7bfdddcb6c6abefc03b25981bcab91efbb8711481e7d90e79a0b8c3c453
Instruction Fuzzy Hash: 84D157726143499FDF349E35C9603EB7BA2EF56760F56012EDC8A9B740E3319942CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02491C99, Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7954f0a6da79a00d6d238fd62e46f930e09d6a6c1a6600199cd57ffddbecacde
Instruction ID: e9c7e51ecd213615452ab32b0524030a082c49867eca08f59f19438e6509efec
Opcode Fuzzy Hash: 7954f0a6da79a00d6d238fd62e46f930e09d6a6c1a6600199cd57ffddbecacde
Instruction Fuzzy Hash: 14C13571A043499FCF209E64CD553EE7BA7EF96360F56852EDCC99B214E3358982CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02490000, Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784a2b7b4ad9134685b49a61a947950d53473ee318c2a6fe14cb66833da0baae
Instruction ID: 2328c608422abfe5bd86b89d1eee7eb202233498e38dc732ddfc5ed5c4bea1c3
Opcode Fuzzy Hash: 784a2b7b4ad9134685b49a61a947950d53473ee318c2a6fe14cb66833da0baae
Instruction Fuzzy Hash: 54B127B16153499BDF306E3489553EE7FA6EF42360F86412EDC8A9B241E3318986CB46

Uniqueness

Uniqueness Score: -1.00%

Function 024924DC, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 02e6fc23ea6db0bcb775088f23ba1475a9f5e938247a4531f4beddf81dc43424
Instruction ID: 96f5bda8268fb788c9cf5186ab05ef1eff2727c035bd21f9150267f97b995f9f
Opcode Fuzzy Hash: 02e6fc23ea6db0bcb775088f23ba1475a9f5e938247a4531f4beddf81dc43424
Instruction Fuzzy Hash: 16A158716143489FDF209F7489553EA7BA7EF46360F92412EECCA9B211E3348D82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02496B29, Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0a01a3ec3306bb0755fd75e51725c072d3f81b55a4416e00740569c7d0b180
Instruction ID: fc5a9fe3c7257a74c2b1775f5b8035fc6c034582089a6f8a0b47be2376e85682
Opcode Fuzzy Hash: 2c0a01a3ec3306bb0755fd75e51725c072d3f81b55a4416e00740569c7d0b180
Instruction Fuzzy Hash: FDA146756043899FDF24AE34C8513EA3BA6EF56760F82452EDCCADB311E7318942CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0249830C, Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9a61000c9588a8e46ca3f0b0970c7f190eda2736fecfb67fed80defedc8af1
Instruction ID: 020102d59c6d811344d5ffec0fe79b5ef70c146749a8fc848a5e6e7390acbc0f
Opcode Fuzzy Hash: 2d9a61000c9588a8e46ca3f0b0970c7f190eda2736fecfb67fed80defedc8af1
Instruction Fuzzy Hash: 2FA139311443858EDF358E3889A57EA3FE29F47360F5481AECC9A8F28AE3354546C712

Uniqueness

Uniqueness Score: -1.00%

Function 02498299, Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217652a9af6f93bd469288e98987d2790a5694587ea1b023fec6f38f36c27eb7
Instruction ID: b52a38b449fb6da132b363f6169cb0236afe9e572374390eef14e8b37fef495d
Opcode Fuzzy Hash: 217652a9af6f93bd469288e98987d2790a5694587ea1b023fec6f38f36c27eb7
Instruction Fuzzy Hash: 4D9128305443858EDF358E3C89A57EA7FE2AF17360F4982AECC9A8F28AD3354545C712

Uniqueness

Uniqueness Score: -1.00%

Function 024982F3, Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bbfeb47adfd71340287df1b0f70457ce5bec883d66143dbcfb4d7e22d03208
Instruction ID: 9153840865c610dae106c11244d608afe432b50948066a6ef465418a72f0b6e5
Opcode Fuzzy Hash: 01bbfeb47adfd71340287df1b0f70457ce5bec883d66143dbcfb4d7e22d03208
Instruction Fuzzy Hash: 5B9105316443858FDF358E3889A57EA3FE2AF17360F4581AECC9A8F28AE3354545C712

Uniqueness

Uniqueness Score: -1.00%

Function 0249214C, Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 37ee9d7095ae174776d767dc13b3de117870f967e61786922508bffa3561d1fc
Instruction ID: 665e33797c67457f411624e4fd002b8fe12f7004c6c304be833776b32a7649d9
Opcode Fuzzy Hash: 37ee9d7095ae174776d767dc13b3de117870f967e61786922508bffa3561d1fc
Instruction Fuzzy Hash: 038156716143899FDF206E34C9613EA7BA6EF42760F82052EDCC69B201E3348D82CB06

Uniqueness

Uniqueness Score: -1.00%

Function 024977D5, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5adc257e33f99a99afaba8517116acc1ee6a1f32f019acca2bf634afbff74b
Instruction ID: 6cc0d9dad9ce2af60d0b8fda7b6e9fa6499ab3c3c9a440a0d81126c9fbd67ec9
Opcode Fuzzy Hash: 1f5adc257e33f99a99afaba8517116acc1ee6a1f32f019acca2bf634afbff74b
Instruction Fuzzy Hash: 407179716153499FDF209E7489553EA7FA7EF82360F43462EDCDA9B240E7358886CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02490644, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a725213d352b38351f4ef2f1b91d3d6214e5010bab090a5ca68e0f565173df2
Instruction ID: 9e9f0519e75c2195a4364bd29f85899d193578919d5b8f54ecf9185885941c20
Opcode Fuzzy Hash: 3a725213d352b38351f4ef2f1b91d3d6214e5010bab090a5ca68e0f565173df2
Instruction Fuzzy Hash: FB6179756153899FDF206E74C9513EA3FA6EF42360F83062EDCD697251E3358886CB06

Uniqueness

Uniqueness Score: -1.00%

Function 0249065D, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6cf60cbe3ed711dc2eaacb8d7fc69fbe5d18f63accf6bb560ae918116cae5d
Instruction ID: bbe6302164002b0d78957933ef0be9aae21f890bbb6e310a0e340cdff6d7afb5
Opcode Fuzzy Hash: 4c6cf60cbe3ed711dc2eaacb8d7fc69fbe5d18f63accf6bb560ae918116cae5d
Instruction Fuzzy Hash: 4B6189716153899FDF206F3489613EA3FA6EF423A0F46066EDCD69B251E3358846CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0249351C, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f82be54d11ccad5dd9cada009d932fd563c947a9b7edf33d63bf80abb8f22bd
Instruction ID: b54a2048735218205492ac77b1f071493c6e8f5cc017af0c2cd921fbbc76fea4
Opcode Fuzzy Hash: 6f82be54d11ccad5dd9cada009d932fd563c947a9b7edf33d63bf80abb8f22bd
Instruction Fuzzy Hash: 517176716043409FDF799F34C945BEA7FA2EF45360F46846EDC864B5A5D3748A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 024926F6, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3eaa690f2f1645d8f67c041b6b954989a689872a64268f02e9c73d66331a13
Instruction ID: 3e698a27fbf4fcbb83600d8bfa4f84b4c5bd0925e4e27d905832f0dabe3bdbbc
Opcode Fuzzy Hash: 3b3eaa690f2f1645d8f67c041b6b954989a689872a64268f02e9c73d66331a13
Instruction Fuzzy Hash: 08610071904345AFDB709F29CD857DBBBE6FF85760F16842ECC899B254D3309A828B42

Uniqueness

Uniqueness Score: -1.00%

Function 024979F8, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1677734025441c2e87fef7010328b752a821a065ad0778085e8b82f13ba855
Instruction ID: f53dfb60c6f67eba1e08b7def707228311dd47f8c45367325628884f6228e859
Opcode Fuzzy Hash: 6f1677734025441c2e87fef7010328b752a821a065ad0778085e8b82f13ba855
Instruction Fuzzy Hash: 19513872944389AFDB308E788D913DA7BB1EF96364F95012ACD8D97705D3305A81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02491CAE, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6098201ff48d523c5cf47a3200e5d47e0c1df6327ace035cbe97ab7e90b2ce5
Instruction ID: 8a22ac3318938afb580d3245e83731575154b2e555f207bb424de82de10e3fae
Opcode Fuzzy Hash: f6098201ff48d523c5cf47a3200e5d47e0c1df6327ace035cbe97ab7e90b2ce5
Instruction Fuzzy Hash: E561E372600388AFCF209E64CD547DA7FA2EF8A350F65956EDCCD8B215D3314A82DB01

Uniqueness

Uniqueness Score: -1.00%

Function 0249320F, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ed29caf5afd037ad798288fd40f3b6680b71a91ad8e5e0ad8f7ed7772bc8d2
Instruction ID: 693743140e3e177b1349d15d74ea9c17315f0102932d66d3cc2756de302da391
Opcode Fuzzy Hash: 07ed29caf5afd037ad798288fd40f3b6680b71a91ad8e5e0ad8f7ed7772bc8d2
Instruction Fuzzy Hash: 6751BE32A006468FCB349F28CC647EA7BE2FF963A0F45416EDC899B340D7319946CB84

Uniqueness

Uniqueness Score: -1.00%

Function 024927BE, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab43e24fcdd3a742eacbc3b9632b8cdf2ecf493d6a94f28ce61e4af5d2c15b3
Instruction ID: 6985d741a01ba242dc425966db14b4c8b8dd56c3bfee1c0f08f323cb3a9d4337
Opcode Fuzzy Hash: 2ab43e24fcdd3a742eacbc3b9632b8cdf2ecf493d6a94f28ce61e4af5d2c15b3
Instruction Fuzzy Hash: CF51E372604388AFDB749E2ACD457DBBBA6FFC6750F15842ECC889B215D33149828B02

Uniqueness

Uniqueness Score: -1.00%

Function 0249399F, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be437a24696fb0cea29871effa05a54cf8b50b7f16104c3cde88a4368e394c03
Instruction ID: e1b27c5683980e45b6dea69f2c224c136924e9a24c197c0062d3c6b0b9a03c37
Opcode Fuzzy Hash: be437a24696fb0cea29871effa05a54cf8b50b7f16104c3cde88a4368e394c03
Instruction Fuzzy Hash: 395138B06413459FEB64DF35C898BDA7BA1FF09360F81826ED8898B261D734D981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0249363C, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241d8ffc9182f9dbaf4c8168ffae4839992e4361bc87b8e29bedac56a87669c4
Instruction ID: 4e7e4d25ecca8c53dfb1c964a12f45dfe17318a7a63dea66b18fe71ae304f658
Opcode Fuzzy Hash: 241d8ffc9182f9dbaf4c8168ffae4839992e4361bc87b8e29bedac56a87669c4
Instruction Fuzzy Hash: 7E516671604385AFDF789F708A407EA7FA3AF86760F55446EEC8A4B649D3354982CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02491F7E, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: ca40c9f7ef7b04fc3bcddb29785739e84fae7399c8401dd2574b983558ba8a6c
Instruction ID: f7958b8d824bbaea7140c5889c216a61b7ae0ae29231c1a5f23906ff48b1ee68
Opcode Fuzzy Hash: ca40c9f7ef7b04fc3bcddb29785739e84fae7399c8401dd2574b983558ba8a6c
Instruction Fuzzy Hash: 485134316483859FDB25AF358C647EE7BE2AF42340F5A412ECCCAD7241D3348986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02491F82, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 95198a3f4d10af2f055f912a04aaffd0c34d3227156d986f971ca22dd099f60b
Instruction ID: 2cca684fba6a13cf1a038af4a0657a3e573169c32b2cebb634599391b17e98ef
Opcode Fuzzy Hash: 95198a3f4d10af2f055f912a04aaffd0c34d3227156d986f971ca22dd099f60b
Instruction Fuzzy Hash: EE4123316083859FDB24AF358C647EA7BE2EF86340F56412ECCC9D7241D33489868F42

Uniqueness

Uniqueness Score: -1.00%

Function 024986DD, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bcfc3d927c7c2e2ff10a2ed25f35e48815b96b24d47650c95e11d2cf6a398a
Instruction ID: 767785c2442fcd6d5f813b7dbefa74ca657c7b04907e6ad6986e64efcbbde528
Opcode Fuzzy Hash: 18bcfc3d927c7c2e2ff10a2ed25f35e48815b96b24d47650c95e11d2cf6a398a
Instruction Fuzzy Hash: EE414976A083459FDF349E388A983DF7EA2AF56394F45406ECC89DB246D330CA45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0249385C, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d47ecb0123517c2ffee41367d937ce2ce4bc1e602d0c872ea7fc5eb146ec9fe
Instruction ID: ce2bbab0f3903f3a2071b6dc38dd32107139f1338dd0e9fc6e12866ba425dea5
Opcode Fuzzy Hash: 9d47ecb0123517c2ffee41367d937ce2ce4bc1e602d0c872ea7fc5eb146ec9fe
Instruction Fuzzy Hash: 752167B824434A9FEF745E388895BEE7BA6EF44300F90441EECCA87285D7364DC58A03

Uniqueness

Uniqueness Score: -1.00%

Function 0249738E, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd214f1ed8237e948bfae73a8e558d4849c03cce00940db4060da022a57ba4b
Instruction ID: 16bb12479b4fa1800edea8ae215800d29b734474e51413a9fffbad864c6cde29
Opcode Fuzzy Hash: 6dd214f1ed8237e948bfae73a8e558d4849c03cce00940db4060da022a57ba4b
Instruction Fuzzy Hash: 1121213174438B8FDF30AE7488807E677E2EF5A750F898219CC898B356E7704442D702

Uniqueness

Uniqueness Score: -1.00%

Function 02493A60, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157e1250fd3d640bc507913dae4e52f255faf9525d20e0417626d09b29178cd4
Instruction ID: 53c97a37d6668812f621df4df7c35b0c9639c2b8e0b981f59eab8a2cab840b28
Opcode Fuzzy Hash: 157e1250fd3d640bc507913dae4e52f255faf9525d20e0417626d09b29178cd4
Instruction Fuzzy Hash: 202102B1642388AFEB248FB589487EA7FA2EFCA350F10509CD8C54B655D3344981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02493E65, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f720f01de717c8a7812e16dd950ee8248b20a55eca1580b39a71308215025fe
Instruction ID: 043b4756e300042b2338a9dedf81dd87a935ab057127ce85a104fc05b3ca6ad1
Opcode Fuzzy Hash: 6f720f01de717c8a7812e16dd950ee8248b20a55eca1580b39a71308215025fe
Instruction Fuzzy Hash: 6E11367211574A9FDF748D3949203E77AE2EF96390F56062FCC478B704D37155428613

Uniqueness

Uniqueness Score: -1.00%

Function 024974A3, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2139f074e8ab99042bb1ef435b076415dfc7ebe856eda6ce3412f0ad0937e8
Instruction ID: b9883bf4cde97d4fba99327590980a034681f352f33cb90c37b97b475aff677d
Opcode Fuzzy Hash: ea2139f074e8ab99042bb1ef435b076415dfc7ebe856eda6ce3412f0ad0937e8
Instruction Fuzzy Hash: 1B1135B46143899FCF34CE18C984AEAB7A2EFA9320F80416ADD498B755D334AA41CB14

Uniqueness

Uniqueness Score: -1.00%

Function 02496F30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afab344c9bc11521552a4e4faffe94cc60c6466edd4067beea56d100289e70a0
Instruction ID: 56aa34291ad5490450a25feb3bf6d9f4839442233fce1c05af8ce1bf69ce4307
Opcode Fuzzy Hash: afab344c9bc11521552a4e4faffe94cc60c6466edd4067beea56d100289e70a0
Instruction Fuzzy Hash: FEC04C39B51750CFD746CE5AC684BC073A0BB15A50FD508E4A8119B753D35CED009A00

Uniqueness

Uniqueness Score: -1.00%

Function 02495283, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1293352201.0000000002490000.00000040.00000001.sdmp, Offset: 02490000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bc41c8ade66293dec81afd432a4d9c5e4c2731d1b135c2cc4815c53bd4dbda
Instruction ID: a585c341d26cce38f740b49c37c3585d13ef8b5c272393d23e4941cb0e74accf
Opcode Fuzzy Hash: 13bc41c8ade66293dec81afd432a4d9c5e4c2731d1b135c2cc4815c53bd4dbda
Instruction Fuzzy Hash: D5C092FA302AC18FFB45DF0DC981B00B3B4FF40A88F0844E4E402DB622D724E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0043568F, Relevance: 28.6, APIs: 19, Instructions: 140COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(00433194,0043318C,?,000000FF,00000000), ref: 004356EB
__vbaStrMove.MSVBVM60(00433194,0043318C,?,000000FF,00000000), ref: 004356F5
#711.MSVBVM60(?,00000000,00433194,0043318C,?,000000FF,00000000), ref: 004356FF
__vbaAryVar.MSVBVM60(00002008,?,?,00000000,00433194,0043318C,?,000000FF,00000000), ref: 0043570D
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00000000,00433194,0043318C,?,000000FF,00000000), ref: 0043571D
__vbaFreeStr.MSVBVM60(?,?,00002008,?,?,00000000,00433194,0043318C,?,000000FF,00000000), ref: 00435725
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00000000,00433194,0043318C,?,000000FF,00000000), ref: 00435734
__vbaStrCmp.MSVBVM60(0043318C,?), ref: 0043574D
__vbaNew2.MSVBVM60(00431C24,00437010,0043318C,?), ref: 00435769
__vbaObjSet.MSVBVM60(?,00000000), ref: 00435781
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,00000048), ref: 004357A1
#531.MSVBVM60(?), ref: 004357A9
__vbaFreeStr.MSVBVM60(?), ref: 004357B1
__vbaFreeObj.MSVBVM60(?), ref: 004357B9
__vbaNew2.MSVBVM60(00431C24,00437010,0043318C,?), ref: 004357D1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004357E9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001A0), ref: 0043580F
__vbaFreeObj.MSVBVM60(00000000,00000000,00432FF0,000001A0), ref: 0043581D
__vbaAryDestruct.MSVBVM60(00000000,?,00435858), ref: 00435852

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#531#711CopyDestructListMove
String ID:
API String ID: 1202614378-0
Opcode ID: 6d4ee972678a61cc01895cbefd215d88c39464dca7460562e7b4d90468fada1f
Instruction ID: f7dac62c94e08aa78d36ead32f3abe99409fdb5454d1b1890c2925d5d35a7b8c
Opcode Fuzzy Hash: 6d4ee972678a61cc01895cbefd215d88c39464dca7460562e7b4d90468fada1f
Instruction Fuzzy Hash: AB414DB1940208ABDB14EB96CC86EEEB7BCBF48304F50052BF511F71A1DB7C99058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00436383, Relevance: 22.6, APIs: 15, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(00433238,00433230,00000001,?), ref: 004363E6
__vbaStrMove.MSVBVM60(00433238,00433230,00000001,?), ref: 004363F0
__vbaStrCat.MSVBVM60(00433244,00000000,00433238,00433230,00000001,?), ref: 004363FB
__vbaStrMove.MSVBVM60(00433244,00000000,00433238,00433230,00000001,?), ref: 00436405
#628.MSVBVM60(00000000,00433244,00000000,00433238,00433230,00000001,?), ref: 0043640B
__vbaStrMove.MSVBVM60(00000000,00433244,00000000,00433238,00433230,00000001,?), ref: 00436415
__vbaStrCmp.MSVBVM60(00433230,00000000,00000000,00433244,00000000,00433238,00433230,00000001,?), ref: 0043641C
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,00433230,00000000,00000000,00433244,00000000,00433238,00433230,00000001,?), ref: 00436439
__vbaFreeVar.MSVBVM60(?), ref: 00436444
__vbaNew2.MSVBVM60(00431C24,00437010,?), ref: 00436465
__vbaObjSet.MSVBVM60(?,00000000), ref: 0043647D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F68,00000100), ref: 004364A3
__vbaFpI4.MSVBVM60(?,?,?,00000000,00000000,00432F68,00000100), ref: 004364D4
__vbaHresultCheckObj.MSVBVM60(00000000,004012B0,004329DC,000002C0,?,?,?,00000000), ref: 00436513
__vbaFreeObj.MSVBVM60(?,?,?,00000000), ref: 0043651B

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$FreeMove$CheckHresult$#628ListNew2
String ID:
API String ID: 2062027099-0
Opcode ID: 8ea6bd03793b0cd7877c46ddd1dcd1bce42c694eb6b25204928ababac1361c69
Instruction ID: 65d17a42b40308c94f943232d66aa1480430f8ad313fb9853db275cfea4ef536
Opcode Fuzzy Hash: 8ea6bd03793b0cd7877c46ddd1dcd1bce42c694eb6b25204928ababac1361c69
Instruction Fuzzy Hash: 1F418FB1941204ABCB10EBA6DD45EAEBBBCAF18704F10456BF481F71A1D77859008B69

Uniqueness

Uniqueness Score: -1.00%

Function 00436265, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

#589.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004362AA
__vbaNew2.MSVBVM60(004330CC,0043746C,00000001), ref: 004362C8
__vbaHresultCheckObj.MSVBVM60(00000000,02E0E8B4,004330BC,0000004C), ref: 004362EC
__vbaHresultCheckObj.MSVBVM60(00000000,?,004330DC,00000024), ref: 00436319
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 00436327
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 0043632F
__vbaFreeStr.MSVBVM60(0043635C,00000001), ref: 00436356

Strings

Gennemlyste, xrefs: 004362FF
Trespassory7, xrefs: 004362FA
3+, xrefs: 00436334

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#589MoveNew2
String ID: 3+$Gennemlyste$Trespassory7
API String ID: 1767156754-2597507220
Opcode ID: f3fa20612280f9dd8dd467ab4b07332bd906c6e2eb3bcd48d41c6b8b6ce84fc5
Instruction ID: 9479bfb80c0b5d016d2c82e49f4063419fddc8fda3916af59eac4d8dc7df2546
Opcode Fuzzy Hash: f3fa20612280f9dd8dd467ab4b07332bd906c6e2eb3bcd48d41c6b8b6ce84fc5
Instruction Fuzzy Hash: 39215370940205ABCB10EF96C846EAEBBF8EF58704F20905BF500B72A1D77C6905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00435AF3, Relevance: 15.1, APIs: 10, Instructions: 97COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004330CC,0043746C), ref: 00435B3B
__vbaHresultCheckObj.MSVBVM60(00000000,02E0E8B4,004330BC,00000014), ref: 00435B5F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00433198,00000058), ref: 00435B82
__vbaStrMove.MSVBVM60 ref: 00435B90
__vbaFreeObj.MSVBVM60 ref: 00435B98
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00435BB0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00435BC8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0043307C,00000058), ref: 00435BE8
__vbaFreeObj.MSVBVM60 ref: 00435BF6
__vbaFreeStr.MSVBVM60(00435C1D), ref: 00435C17

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$New2$Move
String ID:
API String ID: 2227187868-0
Opcode ID: 5aeca0e5cae3b9576908e918e5abcc3fdcbd88e15badc8f7d1c84b569cbb3f44
Instruction ID: 31de7c2387061f1f3ba53c5379dc1487b8b4fba2d6f67467f26b87f0ac11bb2d
Opcode Fuzzy Hash: 5aeca0e5cae3b9576908e918e5abcc3fdcbd88e15badc8f7d1c84b569cbb3f44
Instruction Fuzzy Hash: 7C318270940608ABCB14EF96CC45EEEBBB8EF5C704F20541AF001B72A1D67CA905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0043656D, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004330CC,0043746C), ref: 004365BC
__vbaHresultCheckObj.MSVBVM60(00000000,02E0E8B4,004330BC,00000014), ref: 004365E0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00433198,00000050), ref: 00436603
__vbaStrCmp.MSVBVM60(00000000,?), ref: 0043660C
__vbaFreeStr.MSVBVM60(00000000,?), ref: 0043661D
__vbaFreeObj.MSVBVM60(00000000,?), ref: 00436625
__vbaFileOpen.MSVBVM60(00000020,000000FF,000000CC,gladeligt,00000000,?), ref: 0043663D

Strings

gladeligt, xrefs: 0043662F

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$FileNew2Open
String ID: gladeligt
API String ID: 1550884760-4246425414
Opcode ID: 9049f8e29801350512b86484853b2a030858235602e7f08d168064574545b56b
Instruction ID: 7bda6aae60033b2489757eb64935a3564af75cc60e73bd287da992f0d2be90c7
Opcode Fuzzy Hash: 9049f8e29801350512b86484853b2a030858235602e7f08d168064574545b56b
Instruction Fuzzy Hash: 6221C270940205BBDB10EF55CC47EAFBBB8EF58B08F20915BF501B72E1C67C69058A99

Uniqueness

Uniqueness Score: -1.00%

Function 00435875, Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 004358C8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004358E0
__vbaNew2.MSVBVM60(00431C24,00437010,?,00000000), ref: 00435908
__vbaObjSet.MSVBVM60(?,00000000), ref: 00435920
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000000A8), ref: 00435946
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001EC), ref: 00435975
__vbaFreeStr.MSVBVM60 ref: 0043597D
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0043598C

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2$List
String ID:
API String ID: 2509323985-0
Opcode ID: 93d6a5530ab2d7473611fee3573ac0a96f839664d98f24fcae66029713ff2ce2
Instruction ID: 429f00b2bdf67678c4ac73345b944a71e5aab7511b63a52155dadad3dd9f30a9
Opcode Fuzzy Hash: 93d6a5530ab2d7473611fee3573ac0a96f839664d98f24fcae66029713ff2ce2
Instruction Fuzzy Hash: B83194B0940608AFCB10EF96CD45FAEBBBCFF19704F10442AF451E72A1D77855058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00435DC6, Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__vbaR8Str.MSVBVM60(004331C0,?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E0B
__vbaFPFix.MSVBVM60(004331C0,?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E10
__vbaNew2.MSVBVM60(00431C24,00437010,004331C0,?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E33
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E4B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F88,00000120,?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E71
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,004012D6), ref: 00435E7F

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 278b3b3b0a730a393c26f6c68a68aed03ab184ca722b16e33b7ab0f3f619730d
Instruction ID: e79c5fa09ad77a21b4ba630f18cba9caaa7a5d7e8dd27f0fb46aafc0cc02b961
Opcode Fuzzy Hash: 278b3b3b0a730a393c26f6c68a68aed03ab184ca722b16e33b7ab0f3f619730d
Instruction Fuzzy Hash: C6117FB0940608ABCB10EFA6C94AE9EBBB8FF5C744F10446BF441F72A1C77C55018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00435FF4, Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0043602A
__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00436042
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0043605A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FE0,0000022C), ref: 0043607C
__vbaFreeObj.MSVBVM60 ref: 00436084
__vbaFreeStr.MSVBVM60(004360A2), ref: 0043609C

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckCopyHresultNew2
String ID:
API String ID: 4138333463-0
Opcode ID: 36613312ab492e9358695ba11fbccf6cda8efdc2db30f2856c308a0b9ba205db
Instruction ID: e48029ab23fb007ea36e5496160f2c505108519730d10295afc22bd63cc1df0e
Opcode Fuzzy Hash: 36613312ab492e9358695ba11fbccf6cda8efdc2db30f2856c308a0b9ba205db
Instruction Fuzzy Hash: F8113370500205ABCB14EBA5CD47FAB77B8EF08744F20446EF041B71A2D778590586A9

Uniqueness

Uniqueness Score: -1.00%

Function 00435CFD, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00435D3C
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00435D54
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001EC), ref: 00435D95
__vbaFreeObj.MSVBVM60 ref: 00435D9D

Strings

BNHRER, xrefs: 00435D76

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: BNHRER
API String ID: 1645334062-761458040
Opcode ID: 84bfe97d4967023a21041f9cb7f9f0f2377187cc6a46cc68d357031bdd371966
Instruction ID: 2b03c716da4483d1b36c3bd561785eaf27d35925c8e4916a896ed6fced1d618f
Opcode Fuzzy Hash: 84bfe97d4967023a21041f9cb7f9f0f2377187cc6a46cc68d357031bdd371966
Instruction Fuzzy Hash: B911C6B1540704ABDB10EF95CE4AFAF76BCFB09744F10446AF401B7191D7B85A0086A9

Uniqueness

Uniqueness Score: -1.00%

Function 00435EBB, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00435EFA
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00435F12
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432FF0,000001EC), ref: 00435F53
__vbaFreeObj.MSVBVM60 ref: 00435F5B

Strings

Polyodontidae9, xrefs: 00435F34

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: Polyodontidae9
API String ID: 1645334062-980055670
Opcode ID: ed3529d86243c056590d57a9d1f872870e2af1d65d24c285b897593e4e82eeeb
Instruction ID: 653945141c1330fca278a6de20c868fb1ae5cffa07f40b31d0b2ebba51152a11
Opcode Fuzzy Hash: ed3529d86243c056590d57a9d1f872870e2af1d65d24c285b897593e4e82eeeb
Instruction Fuzzy Hash: B21186B0540704ABDB00EF95CD46FAF77BCEB09745F10146AF500B7191D7B85A058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0043618B, Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaLenBstrB.MSVBVM60(004331EC,?,?,?,?,?,?,?,?,?,004012D6), ref: 004361CD
__vbaNew2.MSVBVM60(004330CC,0043746C,004331EC,?,?,?,?,?,?,?,?,?,004012D6), ref: 004361E9
__vbaObjSetAddref.MSVBVM60(?,00401260,004331EC,?,?,?,?,?,?,?,?,?,004012D6), ref: 004361FE
__vbaHresultCheckObj.MSVBVM60(00000000,02E0E8B4,004330BC,00000010,?,?,?,?,?,?,?,?,?,004012D6), ref: 0043621A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,004012D6), ref: 00436222

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$AddrefBstrCheckFreeHresultNew2
String ID:
API String ID: 2151688750-0
Opcode ID: 0c8ba21fe08009671950e0b20dfadcc2272213018114137e1847778260a8baf2
Instruction ID: 57d63ecabe4d970145b6cc49c9cc02efb27be6de824f819af2760c9b94f02266
Opcode Fuzzy Hash: 0c8ba21fe08009671950e0b20dfadcc2272213018114137e1847778260a8baf2
Instruction Fuzzy Hash: 5D113070900205BBC710BF95D886A9FBBB8BB08B04F61946BB504A3292D77895458A59

Uniqueness

Uniqueness Score: -1.00%

Function 004359D4, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00435A24
__vbaObjSet.MSVBVM60(?,00000000), ref: 00435A3C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,000001CC), ref: 00435AA6
__vbaFreeObj.MSVBVM60 ref: 00435AAE

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 5a9a5be15538af17d9a9108e2be54a032cb04bfe2f04b5c213519136d661dda5
Instruction ID: c6c656c1c3fbc29a26f3201755892c1265b2855b3b24bb4f794fd794d35dc295
Opcode Fuzzy Hash: 5a9a5be15538af17d9a9108e2be54a032cb04bfe2f04b5c213519136d661dda5
Instruction Fuzzy Hash: 582180B1D40708AFCB00EFA9C985ADEBBB9EF09700F10846AF911FB291C77959058B95

Uniqueness

Uniqueness Score: -1.00%

Function 004360B5, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010,?,?,?,?,?,?,?,?,004012D6), ref: 00436105
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,004012D6), ref: 0043611D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,000001C0,?,?,?,?,?,?,?,?,004012D6), ref: 0043613F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,004012D6), ref: 00436147

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 96ddea5afa9e402999fadd9ff3512618f724d1f4e988d0dfea299e69c1a23a39
Instruction ID: 7fa54fc630de8b60cb5177469e001ad92d41683cb358e0a48d5e832f616c6b50
Opcode Fuzzy Hash: 96ddea5afa9e402999fadd9ff3512618f724d1f4e988d0dfea299e69c1a23a39
Instruction Fuzzy Hash: 6E11C674940204BBCB10EF96C945F9ABBBCEF48704F20546BF455E72A1C77C59018B98

Uniqueness

Uniqueness Score: -1.00%

Function 00435C38, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431C24,00437010), ref: 00435C88
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00435CA0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00432F78,000001D4), ref: 00435CC2
__vbaFreeObj.MSVBVM60 ref: 00435CCA

Memory Dump Source

Source File: 00000000.00000002.1291332140.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1291305282.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1291504150.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1291530490.0000000000438000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 4c55c2f3e0074b6de72a186779b13cf0089bbd6132b6fdf18027f3b6dd960965
Instruction ID: 5bac763c3475b96e08677be56cc6229423b2c5d30bbe17820171010b033d250c
Opcode Fuzzy Hash: 4c55c2f3e0074b6de72a186779b13cf0089bbd6132b6fdf18027f3b6dd960965
Instruction Fuzzy Hash: B61184B4540708ABC710EFA5C94AF9B7BBCBF08748F10546AF445F72A1D77C98058B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report sVNHE4jjOw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: sVNHE4jjOw.exe PID: 2412 Parent PID: 5704

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: sVNHE4jjOw.exe PID: 2412 Parent PID: 5704 sVNHE4jjOw.exeCOMMON

Executed Functions