Loading ...

Play interactive tourEdit tour

Windows Analysis Report PREVENTIVO RICHIESTO (2).exe

Overview

General Information

Sample Name:PREVENTIVO RICHIESTO (2).exe
Analysis ID:450786
MD5:72d9c62e4483519df1303fe0c46d16aa
SHA1:12093edc01bcf89eb7a9758d1392592fb273de35
SHA256:42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895
Tags:exe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • PREVENTIVO RICHIESTO (2).exe (PID: 5716 cmdline: 'C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exe' MD5: 72D9C62E4483519DF1303FE0C46D16AA)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://bamontarquitectura.com.mx/IRANSAT_kowbB4.bin"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
PREVENTIVO RICHIESTO (2).exeJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
      00000000.00000000.208215258.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.0.PREVENTIVO RICHIESTO (2).exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
          0.2.PREVENTIVO RICHIESTO (2).exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: PREVENTIVO RICHIESTO (2).exeMalware Configuration Extractor: GuLoader {"Payload URL": "https://bamontarquitectura.com.mx/IRANSAT_kowbB4.bin"}
            Multi AV Scanner detection for submitted fileShow sources
            Source: PREVENTIVO RICHIESTO (2).exeVirustotal: Detection: 30%Perma Link
            Source: PREVENTIVO RICHIESTO (2).exeReversingLabs: Detection: 13%
            Source: PREVENTIVO RICHIESTO (2).exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: https://bamontarquitectura.com.mx/IRANSAT_kowbB4.bin
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeProcess Stats: CPU usage > 98%
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDE510_2_022CDE51
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDF390_2_022CDF39
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDB350_2_022CDB35
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDB080_2_022CDB08
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CCF4D0_2_022CCF4D
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDBE90_2_022CDBE9
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDC190_2_022CDC19
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDC590_2_022CDC59
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDD550_2_022CDD55
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDDB70_2_022CDDB7
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CDDD50_2_022CDDD5
            Source: PREVENTIVO RICHIESTO (2).exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PREVENTIVO RICHIESTO (2).exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PREVENTIVO RICHIESTO (2).exe, 00000000.00000000.208248451.0000000000435000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSome4.exe vs PREVENTIVO RICHIESTO (2).exe
            Source: PREVENTIVO RICHIESTO (2).exeBinary or memory string: OriginalFilenameSome4.exe vs PREVENTIVO RICHIESTO (2).exe
            Source: PREVENTIVO RICHIESTO (2).exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: classification engineClassification label: mal80.troj.evad.winEXE@1/0@0/0
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeFile created: C:\Users\user\AppData\Local\Temp\~DF7595A64BA3F3C87B.TMPJump to behavior
            Source: PREVENTIVO RICHIESTO (2).exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: PREVENTIVO RICHIESTO (2).exeVirustotal: Detection: 30%
            Source: PREVENTIVO RICHIESTO (2).exeReversingLabs: Detection: 13%

            Data Obfuscation:

            barindex
            Yara detected GuLoaderShow sources
            Source: Yara matchFile source: PREVENTIVO RICHIESTO (2).exe, type: SAMPLE
            Source: Yara matchFile source: 0.0.PREVENTIVO RICHIESTO (2).exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.PREVENTIVO RICHIESTO (2).exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000000.208215258.0000000000401000.00000020.00020000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_00406632 push ebp; iretd 0_2_0040663C
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion:

            barindex
            Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CBF06 second address: 00000000022CBF06 instructions:
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CB646 second address: 00000000022CBA31 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ebx, eax 0x0000000c call 00007F394C8F551Dh 0x00000011 test ax, ax 0x00000014 test dh, 00000034h 0x00000017 xor edi, edi 0x00000019 pushad 0x0000001a mov bx, 94B2h 0x0000001e cmp bx, 94B2h 0x00000023 jne 00007F394C8F4448h 0x00000029 popad 0x0000002a test ch, ch 0x0000002c mov dword ptr [ebp+000000F8h], 00A95F60h 0x00000036 test ch, FFFFFFCAh 0x00000039 call 00007F394C8F5292h 0x0000003e call 00007F394C8F5265h 0x00000043 lfence 0x00000046 mov edx, C4D7E93Dh 0x0000004b xor edx, F24722A8h 0x00000051 xor edx, 65E80731h 0x00000057 xor edx, 2C86CCB0h 0x0000005d mov edx, dword ptr [edx] 0x0000005f lfence 0x00000062 jmp 00007F394C8F522Eh 0x00000064 cmp eax, BD9A57B8h 0x00000069 cmp cl, cl 0x0000006b cmp ch, ah 0x0000006d cmp ebx, ebx 0x0000006f test al, 1Ah 0x00000071 ret 0x00000072 mov esi, edx 0x00000074 pushad 0x00000075 rdtsc
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CB34C second address: 00000000022CB3B1 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp esi, A3B0EE80h 0x00000009 mov edx, dword ptr [esp+04h] 0x0000000d test ch, ch 0x0000000f mov ecx, dword ptr [esp+08h] 0x00000013 jmp 00007F394C398152h 0x00000015 test ax, bx 0x00000018 add edx, ecx 0x0000001a neg ecx 0x0000001c test dx, cx 0x0000001f mov ebx, dword ptr [esp+0Ch] 0x00000023 mov eax, dword ptr [esp+10h] 0x00000027 cmp ecx, eax 0x00000029 add eax, ebx 0x0000002b mov esi, eax 0x0000002d neg ebx 0x0000002f pushad 0x00000030 mov esi, 0000000Eh 0x00000035 rdtsc
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CBF06 second address: 00000000022CBF06 instructions:
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CB646 second address: 00000000022CBA31 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ebx, eax 0x0000000c call 00007F394C8F551Dh 0x00000011 test ax, ax 0x00000014 test dh, 00000034h 0x00000017 xor edi, edi 0x00000019 pushad 0x0000001a mov bx, 94B2h 0x0000001e cmp bx, 94B2h 0x00000023 jne 00007F394C8F4448h 0x00000029 popad 0x0000002a test ch, ch 0x0000002c mov dword ptr [ebp+000000F8h], 00A95F60h 0x00000036 test ch, FFFFFFCAh 0x00000039 call 00007F394C8F5292h 0x0000003e call 00007F394C8F5265h 0x00000043 lfence 0x00000046 mov edx, C4D7E93Dh 0x0000004b xor edx, F24722A8h 0x00000051 xor edx, 65E80731h 0x00000057 xor edx, 2C86CCB0h 0x0000005d mov edx, dword ptr [edx] 0x0000005f lfence 0x00000062 jmp 00007F394C8F522Eh 0x00000064 cmp eax, BD9A57B8h 0x00000069 cmp cl, cl 0x0000006b cmp ch, ah 0x0000006d cmp ebx, ebx 0x0000006f test al, 1Ah 0x00000071 ret 0x00000072 mov esi, edx 0x00000074 pushad 0x00000075 rdtsc
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeRDTSC instruction interceptor: First address: 00000000022CBB41 second address: 00000000022CB487 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 6D96B120h 0x00000013 add eax, 9E133F54h 0x00000018 xor eax, F9EAE90Fh 0x0000001d xor eax, F243197Ah 0x00000022 cpuid 0x00000024 test al, D2h 0x00000026 bt ecx, 1Fh 0x0000002a cmp ch, dh 0x0000002c jc 00007F394CDEDCA8h 0x00000032 cmp edx, eax 0x00000034 cmp al, cl 0x00000036 push D375BB0Ch 0x0000003b pushad 0x0000003c mov di, 6000h 0x00000040 cmp di, 6000h 0x00000045 jne 00007F394CDE1A53h 0x0000004b popad 0x0000004c call 00007F394CDEC40Ch 0x00000051 mov eax, dword ptr fs:[00000030h] 0x00000057 mov eax, dword ptr [eax+0Ch] 0x0000005a cmp bh, ah 0x0000005c mov eax, dword ptr [eax+14h] 0x0000005f test cx, dx 0x00000062 mov ecx, dword ptr [eax] 0x00000064 mov eax, ecx 0x00000066 jmp 00007F394CDED2DBh 0x00000068 mov ebx, dword ptr [eax+28h] 0x0000006b mov dword ptr [ebp+000001F5h], edi 0x00000071 mov edi, E1E7AEC2h 0x00000076 cmp dl, 0000004Dh 0x00000079 xor edi, 75204E2Fh 0x0000007f pushad 0x00000080 mov edx, 0000008Ch 0x00000085 rdtsc
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CE707 rdtsc 0_2_022CE707
            Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

            Anti Debugging:

            barindex
            Found potential dummy code loops (likely to delay analysis)Show sources
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeProcess Stats: CPU usage > 90% for more than 60s
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CE707 rdtsc 0_2_022CE707
            Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
            Source: C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exeCode function: 0_2_022CCF4D cpuid 0_2_022CCF4D

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionVirtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery31Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery211SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PREVENTIVO RICHIESTO (2).exe30%VirustotalBrowse
            PREVENTIVO RICHIESTO (2).exe13%ReversingLabs

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            No Antivirus matches

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://bamontarquitectura.com.mx/IRANSAT_kowbB4.bin0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://bamontarquitectura.com.mx/IRANSAT_kowbB4.bintrue
            • Avira URL Cloud: safe
            unknown

            Contacted IPs

            No contacted IP infos

            General Information

            Joe Sandbox Version:33.0.0 White Diamond
            Analysis ID:450786
            Start date:19.07.2021
            Start time:18:12:29
            Joe Sandbox Product:CloudBasic
            Overall analysis duration:0h 11m 54s
            Hypervisor based Inspection enabled:false
            Report type:full
            Sample file name:PREVENTIVO RICHIESTO (2).exe
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
            Run name:Suspected Instruction Hammering Hide Perf
            Number of analysed new started processes analysed:41
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • HDC enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:MAL
            Classification:mal80.troj.evad.winEXE@1/0@0/0
            EGA Information:Failed
            HDC Information:
            • Successful, ratio: 51.6% (good quality ratio 23%)
            • Quality average: 24.6%
            • Quality standard deviation: 33.1%
            HCA Information:Failed
            Cookbook Comments:
            • Adjust boot time
            • Enable AMSI
            • Found application associated with file extension: .exe
            Warnings:
            Show All
            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
            • Not all processes where analyzed, report is missing behavior information

            Simulations

            Behavior and APIs

            No simulations

            Joe Sandbox View / Context

            IPs

            No context

            Domains

            No context

            ASN

            No context

            JA3 Fingerprints

            No context

            Dropped Files

            No context

            Created / dropped Files

            No created / dropped files found

            Static File Info

            General

            File type:PE32 executable (GUI) Intel 80386, for MS Windows
            Entropy (8bit):6.24355762284074
            TrID:
            • Win32 Executable (generic) a (10002005/4) 99.15%
            • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
            • Generic Win/DOS Executable (2004/3) 0.02%
            • DOS Executable Generic (2002/1) 0.02%
            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
            File name:PREVENTIVO RICHIESTO (2).exe
            File size:241664
            MD5:72d9c62e4483519df1303fe0c46d16aa
            SHA1:12093edc01bcf89eb7a9758d1392592fb273de35
            SHA256:42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895
            SHA512:cf6d6c1a6072c022ab4d19f098715cba02f8dcc74f01ce7ad735d5cdb5c7505aeb9c98fb9ff3faac7932ffbdb7cdf581c583fa846cc76b71dee3f2a71b7b30a0
            SSDEEP:3072:c3BepJlZa/E5cv3MRwqmVqY+9uiwBDa1Gh7HJlZapGBR:eiUEUMyqmVrTjDc4HP
            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......W................. ...................0....@................

            File Icon

            Icon Hash:f8fcd4ccf4e4e8d0

            Static PE Info

            General

            Entrypoint:0x4019b0
            Entrypoint Section:.text
            Digitally signed:false
            Imagebase:0x400000
            Subsystem:windows gui
            Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            DLL Characteristics:
            Time Stamp:0x5783B9FD [Mon Jul 11 15:23:41 2016 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:4
            OS Version Minor:0
            File Version Major:4
            File Version Minor:0
            Subsystem Version Major:4
            Subsystem Version Minor:0
            Import Hash:e9f7dd0da1a2a1266893e1ae4ef42b67

            Entrypoint Preview

            Instruction
            push 00408ABCh
            call 00007F394C975B45h
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            xor byte ptr [eax], al
            add byte ptr [eax], al
            inc eax
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [12DC752Eh], ch
            or ch, byte ptr [eax]
            inc ebx
            movsd
            salc
            sbb ebp, dword ptr [ebp-24h]
            pop ds
            rcl dh, 00000000h
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [ecx], al
            add byte ptr [eax], al
            add byte ptr [edx+00h], al
            push es
            push eax
            add dword ptr [edx], 4Eh
            bound esi, dword ptr fs:[edx+79h]
            jnc 00007F394C975B8Ah
            add byte ptr [eax], al
            movsb
            sub edi, ebp
            add al, byte ptr [eax]
            add byte ptr [eax], al
            add bh, bh
            int3
            xor dword ptr [eax], eax
            xor dword ptr [ebp-4Fh], edx
            loop 00007F394C975BBDh
            dec edi
            rcl dword ptr [esi], 46h
            sahf
            pop ss
            xor al, C8h
            sub cl, 00000053h
            loope 00007F394C975B1Eh
            pop edi
            mov eax, dword ptr [09AE2179h]
            dec ebp
            xchg eax, edx
            in al, dx
            inc ebx
            cmp dh, byte ptr [ebp-52h]
            add edx, edx
            cmp cl, byte ptr [edi-53h]
            xor ebx, dword ptr [ecx-48EE309Ah]
            or al, 00h
            stosb
            add byte ptr [eax-2Dh], ah
            xchg eax, ebx
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            stc
            outsd
            add byte ptr [eax], al
            xchg eax, edi
            push 04000000h
            add byte ptr [edx+65h], dh
            jc 00005B53h
            or eax, 55000901h
            push 6C726564h
            imul esp, dword ptr [edi+37h], 00001900h

            Data Directories

            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0x326d40x28.text
            IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x6d0e.rsrc
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
            IMAGE_DIRECTORY_ENTRY_IAT0x10000x1a4.text
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

            Sections

            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
            .text0x10000x31d440x32000False0.390419921875data6.39904472476IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            .data0x330000x12900x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
            .rsrc0x350000x6d0e0x7000False0.48193359375data5.46083184817IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

            Resources

            NameRVASizeTypeLanguageCountry
            RT_ICON0x3ae660xea8data
            RT_ICON0x3a5be0x8a8data
            RT_ICON0x39ef60x6c8data
            RT_ICON0x3998e0x568GLS_BINARY_LSB_FIRST
            RT_ICON0x373e60x25a8dBase III DBT, version number 0, next free block index 40
            RT_ICON0x3633e0x10a8data
            RT_ICON0x359b60x988data
            RT_ICON0x3554e0x468GLS_BINARY_LSB_FIRST
            RT_GROUP_ICON0x354d80x76data
            RT_VERSION0x352400x298dataEnglishUnited States

            Imports

            DLLImport
            MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaCyStr, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaI2I4, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaFpCmpCy, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaInStrVar, __vbaDateVar, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

            Version Infos

            DescriptionData
            Translation0x0409 0x04b0
            LegalCopyrightSocialbakers
            InternalNameSome4
            FileVersion1.00
            CompanyNameSocialbakers
            LegalTrademarksSocialbakers
            ProductNameNedbrydes6
            ProductVersion1.00
            OriginalFilenameSome4.exe

            Possible Origin

            Language of compilation systemCountry where language is spokenMap
            EnglishUnited States

            Network Behavior

            No network behavior found

            Code Manipulations

            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            System Behavior

            General

            Start time:18:13:20
            Start date:19/07/2021
            Path:C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exe
            Wow64 process (32bit):true
            Commandline:'C:\Users\user\Desktop\PREVENTIVO RICHIESTO (2).exe'
            Imagebase:0x400000
            File size:241664 bytes
            MD5 hash:72D9C62E4483519DF1303FE0C46D16AA
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:Visual Basic
            Yara matches:
            • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
            • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000000.00000000.208215258.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
            Reputation:low

            Disassembly

            Code Analysis

            Reset < >

              Executed Functions

              APIs
              • #607.MSVBVM60(?,000000FF,?), ref: 004323A2
              • __vbaStrVarMove.MSVBVM60(?), ref: 004323AC
              • __vbaStrMove.MSVBVM60 ref: 004323BD
              • __vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 004323C9
              • __vbaLenBstr.MSVBVM60(?), ref: 004323D6
              • __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 004323E5
              • __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 004323F6
              • __vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00432402
              • __vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0043240D
              • __vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0043241B
              • __vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0043242B
              • #537.MSVBVM60(00000000,?,00000001), ref: 0043243B
              • __vbaStrMove.MSVBVM60 ref: 00432446
              • __vbaInStr.MSVBVM60(00000000,00000000), ref: 0043244A
              • __vbaFreeStr.MSVBVM60 ref: 0043245F
              • #537.MSVBVM60(00000000,?,00000001), ref: 00432472
              • __vbaStrMove.MSVBVM60 ref: 0043247D
              • __vbaInStr.MSVBVM60(00000000,00000000), ref: 00432481
              • #616.MSVBVM60(?,-00000001), ref: 00432495
              • __vbaStrMove.MSVBVM60 ref: 004324A0
              • __vbaFreeStr.MSVBVM60 ref: 004324A5
              • __vbaStrCat.MSVBVM60(00409E18), ref: 004324B9
              • __vbaStrMove.MSVBVM60 ref: 004324C0
              • __vbaStrCat.MSVBVM60(?,00000000), ref: 004324C7
              • __vbaStrMove.MSVBVM60 ref: 004324CE
              • __vbaFreeStr.MSVBVM60 ref: 004324D3
              • __vbaErrorOverflow.MSVBVM60 ref: 0043253B
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 004325B1
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 004325DC
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000110), ref: 0043260A
              • __vbaStrMove.MSVBVM60 ref: 00432619
              • __vbaFreeObj.MSVBVM60 ref: 00432622
              • #598.MSVBVM60 ref: 00432628
              • __vbaStrCopy.MSVBVM60 ref: 00432636
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Move$Free$#537AnsiCheckErrorHresultListUnicode$#598#607#616BstrCopyNew2OverflowSystem
              • String ID: USERNAME
              • API String ID: 840069314-1047370299
              • Opcode ID: 86e3c849bc7b7d2e13e1559e9cecbfbaa45b16de9e1f11d8b5d3e4b0c9a3192f
              • Instruction ID: ebc215d22c89e7af9329014ba01daa553ddb46c2625ad4dc8acf3aea7f3c7fe3
              • Opcode Fuzzy Hash: 86e3c849bc7b7d2e13e1559e9cecbfbaa45b16de9e1f11d8b5d3e4b0c9a3192f
              • Instruction Fuzzy Hash: E591ED75900209AFCB04DFA5DD89DEEBBB8FF48700F10812AF605A72A5DB785945CBA4
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 004325B1
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 004325DC
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000110), ref: 0043260A
              • __vbaStrMove.MSVBVM60 ref: 00432619
              • __vbaFreeObj.MSVBVM60 ref: 00432622
              • #598.MSVBVM60 ref: 00432628
              • __vbaStrCopy.MSVBVM60 ref: 00432636
              • __vbaHresultCheckObj.MSVBVM60(00000000,00401730,0040919C,0000074C), ref: 0043265D
              • __vbaFreeStrList.MSVBVM60(00000002,00000000,?), ref: 00432669
              • __vbaFreeStr.MSVBVM60(004326A7), ref: 004326A0
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresult$#598CopyListMoveNew2
              • String ID: USERNAME
              • API String ID: 3664798572-1047370299
              • Opcode ID: e5cceddbeae7d9841b3e7dc4f3b8726d4c444d9f39227bd5363eb6ad7962c10d
              • Instruction ID: 9574f6e7cecec4529aed58a4e37c28d3c361bb49991f94799156c20d68a473e8
              • Opcode Fuzzy Hash: e5cceddbeae7d9841b3e7dc4f3b8726d4c444d9f39227bd5363eb6ad7962c10d
              • Instruction Fuzzy Hash: BF310071900205ABCB04DF95CD89EEEBBB8FF4C704F10802AF515B7291D7789945CBA9
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: #100
              • String ID: VB5!6&*
              • API String ID: 1341478452-3593831657
              • Opcode ID: a84cce9caba23d35c7f2a0cfe1567c02bb268376c20c3e602bf9b1c0a60783ac
              • Instruction ID: 20110d0a8643dca51671e3088898501f3cf28494f575d1e0bcbe3caec579551c
              • Opcode Fuzzy Hash: a84cce9caba23d35c7f2a0cfe1567c02bb268376c20c3e602bf9b1c0a60783ac
              • Instruction Fuzzy Hash: EC61CB6254E3C1AFC7035B7498656867FB0AE57224B0B46EBC4C0DF4B3E2581D5ACB72
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • TerminateProcess.KERNELBASE ref: 022CC5CD
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID: ProcessTerminate
              • String ID: (Yp
              • API String ID: 560597551-2003197119
              • Opcode ID: ffbe6db35139a555dc16d9f4cbd51edf07defd153eaeec678ab35f4663c9b8c3
              • Instruction ID: c83501d7a5c392b50cdd6803cbd0254fbe72af35f5d94d9fd4f615fa7e7c3468
              • Opcode Fuzzy Hash: ffbe6db35139a555dc16d9f4cbd51edf07defd153eaeec678ab35f4663c9b8c3
              • Instruction Fuzzy Hash: AD3124759B5302B1EB14FEA8478607BBB28FA91704FB4669FC54CA721DD360C305D758
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID: MessageProcessTerminate
              • String ID:
              • API String ID: 638435245-0
              • Opcode ID: 695d0c6d96b9d641a3b6f2b1a6c2391d557c324a45715b9320bed5b060608b07
              • Instruction ID: ddb7f833a7e301bbaffd85c6bb08aad9c30dd682c959d74163ee5805a3ac746f
              • Opcode Fuzzy Hash: 695d0c6d96b9d641a3b6f2b1a6c2391d557c324a45715b9320bed5b060608b07
              • Instruction Fuzzy Hash: E3313634418385DBDB34EFB8C8A52FA7B60EF42310F5546AEC8CA57248C3304685D71A
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID: MessageProcessTerminate
              • String ID:
              • API String ID: 638435245-0
              • Opcode ID: 8e7cd6e29a072e616036ad623a5d997f9811852014c8847628602d8369b86b92
              • Instruction ID: 2baecbf33a38386f9819eb4fedb5f7eb4bde4c2fc56524e6cfe08615aa70991e
              • Opcode Fuzzy Hash: 8e7cd6e29a072e616036ad623a5d997f9811852014c8847628602d8369b86b92
              • Instruction Fuzzy Hash: 9D213631908310CBDB38AEB895B53EA7BA0EF5A360F56052ECCDB67244D3240DC5C606
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID: MessageProcessTerminate
              • String ID:
              • API String ID: 638435245-0
              • Opcode ID: e295b239d8f1b6933340499e43a27ad945404e0d0c4a04c4950ef8a99048d3ac
              • Instruction ID: 8fa73085943b5990bc2917df8d0c0501a36a101c37e9a1ed8da164cc2a949ae4
              • Opcode Fuzzy Hash: e295b239d8f1b6933340499e43a27ad945404e0d0c4a04c4950ef8a99048d3ac
              • Instruction Fuzzy Hash: DBE039310483519BDB24BEB4D9A63AABBA1AF51311F821C6DD8E2C2455D32914D5DA03
              Uniqueness

              Uniqueness Score: -1.00%

              Non-executed Functions

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 345b81c0b6f39a6409b4422096fbb7e602d781db5f2ea834cfa4021a8106de1a
              • Instruction ID: c38b859fbdd94e6db61d54af2421ebbb77c207a9ff9d1fb8eec7f1ea6926c592
              • Opcode Fuzzy Hash: 345b81c0b6f39a6409b4422096fbb7e602d781db5f2ea834cfa4021a8106de1a
              • Instruction Fuzzy Hash: 67916B7162474BDFCF349EB8C9A47EA37A2AF55390FA6432ECC4A9B25CD3708941C641
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 221ef3c2b95ca5f9b1f97102049f9c284061e68a77e0532821a061407bfaf034
              • Instruction ID: c59de1fd57b2bf12b7ffadaea22937d13d785f4fff5b619a0a677fa6046cb132
              • Opcode Fuzzy Hash: 221ef3c2b95ca5f9b1f97102049f9c284061e68a77e0532821a061407bfaf034
              • Instruction Fuzzy Hash: 9A915B7162474BCFCF359EB8C9A47EA37A2AF55390FA6432ECC4A9B25CD3708541C641
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 3696fd7ac6585423c30cfaa4b2ce8cab5570e72a2e827800067147133f71e030
              • Instruction ID: 95b6614badcd7cdb934f0ee4126a9c1a64b4b3c2eeb3765c54892b32aaa82773
              • Opcode Fuzzy Hash: 3696fd7ac6585423c30cfaa4b2ce8cab5570e72a2e827800067147133f71e030
              • Instruction Fuzzy Hash: 59815B7162474BCFCF359EB8CDA47EA37A2AF55390FA6432ECC4A9B258D3708941C641
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 42c63e49b7456047c01cebef06e162ceb33f2623747f914079e6eec86ff9e9e3
              • Instruction ID: a2dc01fb2a8be4f55a47fbf1b53d80c03717f71ad70bcba001be1ec3a27f0287
              • Opcode Fuzzy Hash: 42c63e49b7456047c01cebef06e162ceb33f2623747f914079e6eec86ff9e9e3
              • Instruction Fuzzy Hash: B9816B7162074BDFCF349EB8C9A47EA37A2AF55390FA6432ECC4A9B258D3708941C641
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 899afce85179d7f88bce10570e7e0a9e7778b3eb4c577aa8170b04a17b6c6105
              • Instruction ID: 8d49b9b77adf743f5804787a17b627a14994bb5c0c0ab649f59d430fca272c80
              • Opcode Fuzzy Hash: 899afce85179d7f88bce10570e7e0a9e7778b3eb4c577aa8170b04a17b6c6105
              • Instruction Fuzzy Hash: 39815C7162074BCFCF359EB8CDA47EA37A2AF55390FA6432ECC499B258C3708941C641
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 9f6df327cd0777bb2df920a96d4aa45d1f7219ace1df8180cec8f8c9f243b2c5
              • Instruction ID: 1914c73945f12ffd6ce51c08a3acd2c9486dc451c1dcb8089721c44dcd277074
              • Opcode Fuzzy Hash: 9f6df327cd0777bb2df920a96d4aa45d1f7219ace1df8180cec8f8c9f243b2c5
              • Instruction Fuzzy Hash: A0815A7161474BDFCF319EB8C9A47EA37B2AF55360FA6422DCC499B258C3708942CA41
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: c70b84deac7ab32a8d4baf76ec1424933d352ad93bf5328ea20743c6ecefa148
              • Instruction ID: 6d39a93c377c71d1cf3750ebb4262193d0e93c1240e6ce6f7dbd63f3f2a12bda
              • Opcode Fuzzy Hash: c70b84deac7ab32a8d4baf76ec1424933d352ad93bf5328ea20743c6ecefa148
              • Instruction Fuzzy Hash: B371377161074ADFCF359E78C9647EA37B2AF553A0FA6422DCC4D9B268D3309942CA41
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: f828a148ca02617ca48b2e5010f231df7900b90eef0376152f77229f97c4fc63
              • Instruction ID: 36b09034659576893a855af5592626a3c3fa652af455c5658de588fe3f64753f
              • Opcode Fuzzy Hash: f828a148ca02617ca48b2e5010f231df7900b90eef0376152f77229f97c4fc63
              • Instruction Fuzzy Hash: B271377161474BDFCF31DE78C9A47DA37B2AF553A0FA6432ACC899B258C3309942CA41
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: 390051fca2bd263ed6498defff93ee1f959612648ac388f5659841f823a69dbc
              • Instruction ID: cd7fb23c962ac1f17a47d7fce74bb24bee75165657336ee73234613e5bd0fa35
              • Opcode Fuzzy Hash: 390051fca2bd263ed6498defff93ee1f959612648ac388f5659841f823a69dbc
              • Instruction Fuzzy Hash: B9614B7161074BDFCF319E78CD647EA37B2AF553A0FA6431ACC499B268D3709942CA41
              Uniqueness

              Uniqueness Score: -1.00%

              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID: ~<
              • API String ID: 0-2948312017
              • Opcode ID: e094a2bff6c8f130a87a02334b30f7dcc8423ea096543e31c6bee441449f065d
              • Instruction ID: ff18396f98099b0bc7135d20ef021aebdfb38d26f1672f4554ada9878cd4af43
              • Opcode Fuzzy Hash: e094a2bff6c8f130a87a02334b30f7dcc8423ea096543e31c6bee441449f065d
              • Instruction Fuzzy Hash: 16510A7271074BCFDF319E78CD647DA37A2AF553A0FA64219CC499B25CD3309981CA41
              Uniqueness

              Uniqueness Score: -1.00%

              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b6148f491b4db4d274ef5e2139c46cf176a2414b275174d089b5ade8662cc106
              • Instruction ID: 02e032921c07952aeeddb3070bddf91eb32b5894785dfcdeac8f0bad6ca6bdc6
              • Opcode Fuzzy Hash: b6148f491b4db4d274ef5e2139c46cf176a2414b275174d089b5ade8662cc106
              • Instruction Fuzzy Hash: 575148755583CA8EDF348E688DA53EB7762AF51324F54822ECC998B24DC3B0C542C712
              Uniqueness

              Uniqueness Score: -1.00%

              Memory Dump Source
              • Source File: 00000000.00000002.1237097535.00000000022CC000.00000040.00000001.sdmp, Offset: 022CC000, based on PE: false
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6c43b137a77d751c975bc7cc0abba6f872207bbd053f3bca932edd993b52036a
              • Instruction ID: 3cfac9a430b7ce59dd3cfa49db84e94aee9188472ca757842765b86a489e90c4
              • Opcode Fuzzy Hash: 6c43b137a77d751c975bc7cc0abba6f872207bbd053f3bca932edd993b52036a
              • Instruction Fuzzy Hash: 9BD0238F35038105AE43859C47643C342D13F06570EE9093E1D83D3103C74EC04CC012
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • #527.MSVBVM60(00409D88), ref: 0042D504
              • __vbaStrMove.MSVBVM60 ref: 0042D50F
              • __vbaStrCmp.MSVBVM60(00409D90,00000000), ref: 0042D51B
              • __vbaFreeStr.MSVBVM60 ref: 0042D52E
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042D54F
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042D57A
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,000000B8), ref: 0042D5A8
              • __vbaFreeObj.MSVBVM60 ref: 0042D5AD
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042D5C5
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042D5EA
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000110), ref: 0042D610
              • __vbaStrMove.MSVBVM60 ref: 0042D61B
              • __vbaFreeObj.MSVBVM60 ref: 0042D624
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042D63D
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042D65C
              • __vbaFreeStr.MSVBVM60(0042D853), ref: 0042D84C
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresult$New2$Move$#527
              • String ID:
              • API String ID: 487870899-0
              • Opcode ID: 2287b94ec9815f1e2240b2c0687a67a7f5369f4fff305453af04ce509782e51a
              • Instruction ID: b70f136352f6256517b93dc36a729fcfc51fa9d2b3a6ea041e8c1a3ee3696689
              • Opcode Fuzzy Hash: 2287b94ec9815f1e2240b2c0687a67a7f5369f4fff305453af04ce509782e51a
              • Instruction Fuzzy Hash: AEB18D75A00218ABCB14DFA5DD49FEEB7B8FF48700F10802AF545B72A1DA789945CF68
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042E21B
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042E234
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409984,00000150), ref: 0042E261
              • __vbaStrToAnsi.MSVBVM60(?,?,008039A4), ref: 0042E278
              • __vbaSetSystemError.MSVBVM60(003989DE,00000000), ref: 0042E28C
              • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0042E2AE
              • __vbaFreeObj.MSVBVM60 ref: 0042E2BA
              • #702.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 0042E2E3
              • __vbaStrMove.MSVBVM60 ref: 0042E2EE
              • __vbaFreeVar.MSVBVM60 ref: 0042E2FD
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042E312
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042E337
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000118), ref: 0042E35D
              • __vbaI2I4.MSVBVM60 ref: 0042E362
              • __vbaFreeObj.MSVBVM60 ref: 0042E36B
              • __vbaVarDup.MSVBVM60 ref: 0042E385
              • #666.MSVBVM60(?,00000002), ref: 0042E393
              • __vbaVarMove.MSVBVM60 ref: 0042E39F
              • __vbaFreeVar.MSVBVM60 ref: 0042E3A8
              • __vbaFreeVar.MSVBVM60(0042E3FB), ref: 0042E3EB
              • __vbaFreeStr.MSVBVM60 ref: 0042E3F4
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckHresult$MoveNew2$#666#702AnsiErrorListSystem
              • String ID: HENRIVENDE$zS
              • API String ID: 309366762-2729703279
              • Opcode ID: ba2f69f8620c4359b4933189e6f036535425df57d2744a09684c4259574552ea
              • Instruction ID: a97f9156ce6c0953e46de7319b008cd1f15c1375e0875ab3981f7ed0b7e5a156
              • Opcode Fuzzy Hash: ba2f69f8620c4359b4933189e6f036535425df57d2744a09684c4259574552ea
              • Instruction Fuzzy Hash: 59516671900209EBCB04DFA5ED88EDEBBB8FF48705F10412AF506BB2A0DB745945CB68
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaCyStr.MSVBVM60(00409AF0,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DA78
              • __vbaFpCmpCy.MSVBVM60(00000000), ref: 0042DA86
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042DAA6
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042DAD1
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000130), ref: 0042DAFF
              • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DB10
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DB15
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042DB2E
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042DB53
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,000000D0), ref: 0042DB79
              • __vbaStrMove.MSVBVM60 ref: 0042DB88
              • __vbaFreeObj.MSVBVM60 ref: 0042DB8D
              • #531.MSVBVM60(kantatens), ref: 0042DB98
              • __vbaFreeStr.MSVBVM60(0042DBCA), ref: 0042DBC2
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DBC7
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresult$MoveNew2$#531
              • String ID: kantatens
              • API String ID: 1829431787-1394988495
              • Opcode ID: be82c1f0fe5a79b9be2cbbe473c879800f12aa41ecbd55686e2a875e5df3b62e
              • Instruction ID: 8665c3aaf7e83cc93011807374752658e8e20ada04e76f085b122752cf19196f
              • Opcode Fuzzy Hash: be82c1f0fe5a79b9be2cbbe473c879800f12aa41ecbd55686e2a875e5df3b62e
              • Instruction Fuzzy Hash: 42414371A00219AFCB04DF95DD89EDEBBB8FF48704F10406AE541B72A1D778A905CFA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60 ref: 00425999
              • #515.MSVBVM60(?,?,00000002), ref: 004259B6
              • __vbaVarTstNe.MSVBVM60(?,?), ref: 004259D2
              • __vbaFreeVar.MSVBVM60 ref: 004259DE
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 00425A0F
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 00425A28
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A78,000000C0), ref: 00425A52
              • __vbaLateMemCall.MSVBVM60(?,bJwKrGImpGgg9mRQCArwzZIt8,00000003), ref: 00425AC1
              • __vbaFreeObj.MSVBVM60 ref: 00425ACD
              • __vbaFreeObj.MSVBVM60(00425B11), ref: 00425B01
              • __vbaFreeStr.MSVBVM60 ref: 00425B0A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$#515CallCheckCopyHresultLateNew2
              • String ID: Kricketbold2$bJwKrGImpGgg9mRQCArwzZIt8$var
              • API String ID: 3144308283-2350849782
              • Opcode ID: 5d8cb237fd154bf4cc80eadff6353e4f3b5934b6ddc994b465a34e04fc0b88b0
              • Instruction ID: caebe747f5d69f9783f799c3d0c1b28c38fbbef71f115ca0d3550450653cc758
              • Opcode Fuzzy Hash: 5d8cb237fd154bf4cc80eadff6353e4f3b5934b6ddc994b465a34e04fc0b88b0
              • Instruction Fuzzy Hash: FC5149B0E10218DFCB04DF98DA89A9DFBB8FF48700F20816AE549B7290D7785A45CF94
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60 ref: 0042DF2B
              • __vbaLenBstrB.MSVBVM60(00409DC0), ref: 0042DF36
              • #680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,?,?,?), ref: 0042DF7F
              • __vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0042DF95
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 0042DFB1
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 0042DFD6
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,000000C8), ref: 0042E003
              • __vbaFreeObj.MSVBVM60 ref: 0042E00C
              • __vbaVarDup.MSVBVM60 ref: 0042E038
              • #595.MSVBVM60(?,00000000,?,?,?), ref: 0042E050
              • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0042E068
              • __vbaFreeStr.MSVBVM60(0042E0A8), ref: 0042E0A1
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckHresultList$#595#680BstrCopyNew2
              • String ID: hjrekant
              • API String ID: 4058102471-1475739938
              • Opcode ID: 63fcbbef4787f4957b2d862eb5d77aaa4666a1a025dab400cfe13cf3c948e24b
              • Instruction ID: 88f0e152ddb67a95253a9182da62153bcde1542bd5ccfded3c67bbf548ad6b52
              • Opcode Fuzzy Hash: 63fcbbef4787f4957b2d862eb5d77aaa4666a1a025dab400cfe13cf3c948e24b
              • Instruction Fuzzy Hash: 7151E2B1D00259AFDB10DF94D889ADEBFB8BF48700F10412AF605B72A5D7B45985CFA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DD75
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DD7D
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042DD92
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042DDB1
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409B40,000001C8), ref: 0042DDD0
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042DDD9
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042DDF2
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042DE0B
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409DAC,00000100), ref: 0042DE2E
              • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042DE3E
              • __vbaI4Var.MSVBVM60(00000000), ref: 0042DE48
              • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042DE5B
              • __vbaFreeVar.MSVBVM60 ref: 0042DE67
              • __vbaFreeStr.MSVBVM60(0042DEA2), ref: 0042DE9A
              • __vbaFreeStr.MSVBVM60 ref: 0042DE9F
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckCopyHresultNew2$CallLateList
              • String ID:
              • API String ID: 244069345-0
              • Opcode ID: e3134a473a52e8d282be3d6ec6a5b6adfdee9244e42f667e2b75e4a0a57369d4
              • Instruction ID: d2ee9e445a7faa284d2001f062296118d945a3631bb6139810a44beb337e669d
              • Opcode Fuzzy Hash: e3134a473a52e8d282be3d6ec6a5b6adfdee9244e42f667e2b75e4a0a57369d4
              • Instruction Fuzzy Hash: B8412CB5D00218ABCB04DF95DD88EDEBBB8FF48304F10442AF555B72A4D678A945CBA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425B95
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425B9D
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 00425BB1
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,00000014), ref: 00425BDC
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409ADC,00000118), ref: 00425C0A
              • __vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425C0F
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425C18
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 00425C31
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 00425C4A
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A78,000000C8), ref: 00425C71
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425C7C
              • __vbaFreeStr.MSVBVM60(00425CA4), ref: 00425C9C
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425CA1
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckHresult$CopyNew2
              • String ID:
              • API String ID: 336985134-0
              • Opcode ID: a5ff64d6c112d5eeb060a87b67284e8a34d3853c1b4e501724cc2545ebed7483
              • Instruction ID: 67b18adf13cb15b2452e65631f96ca40d1d9560dc45d5f94284da738582c065c
              • Opcode Fuzzy Hash: a5ff64d6c112d5eeb060a87b67284e8a34d3853c1b4e501724cc2545ebed7483
              • Instruction Fuzzy Hash: BD416074A40618AFCB04DF95DD84EEEBBB8FF58700F148026E541B72A1D7785942CFA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042D8BD
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042D8DC
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042D8F8
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042D911
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,00000130), ref: 0042D934
              • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042D963
              • __vbaStrVarMove.MSVBVM60(00000000), ref: 0042D96D
              • __vbaStrMove.MSVBVM60 ref: 0042D978
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409994,000001EC), ref: 0042D998
              • __vbaFreeStr.MSVBVM60 ref: 0042D9A1
              • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0042D9B5
              • __vbaFreeVar.MSVBVM60 ref: 0042D9C1
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckHresultMoveNew2$CallLateList
              • String ID:
              • API String ID: 3081447974-0
              • Opcode ID: d90643c6b64413e85864829c5b7059e58a29826a9464d175e3df935d919a0ee4
              • Instruction ID: 184346817f90dc1aa783af84a4fb4751eedb792ca1a8e51a1d351796a9ae0428
              • Opcode Fuzzy Hash: d90643c6b64413e85864829c5b7059e58a29826a9464d175e3df935d919a0ee4
              • Instruction Fuzzy Hash: 49414DB4A00204AFCB04DFA4DD49F9EBBB8FB48701F10442AF545F7261D6389945CBA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60 ref: 00424E19
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 00424E32
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 00424E51
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 00424E6D
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 00424E86
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409984,000000F0), ref: 00424EA9
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409994,000001EC), ref: 00424EE9
              • __vbaFreeStr.MSVBVM60 ref: 00424EF2
              • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00424F02
              • __vbaFreeStr.MSVBVM60(00424F39), ref: 00424F32
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckHresultNew2$CopyList
              • String ID:
              • API String ID: 4130517723-0
              • Opcode ID: 7feb56211145dc0fab29db871f38511685f331c0b441f3ddb3954319901e2a50
              • Instruction ID: 1665c86f357b3f370fc1bca7ed413c867275989ad1582a10e63b716d100598f2
              • Opcode Fuzzy Hash: 7feb56211145dc0fab29db871f38511685f331c0b441f3ddb3954319901e2a50
              • Instruction Fuzzy Hash: 98418FB4A40215AFCB04DFA8DD49FAEBBB8FB48701F10416AF945E7261D7389901CBA4
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 00425D10
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 00425D18
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 00425D20
              • __vbaCyStr.MSVBVM60(00409AF0,?,?,?,?,?,?,?,00401746), ref: 00425D27
              • __vbaFpCmpCy.MSVBVM60(00000000,?,?,?,?,?,?,?,?,00401746), ref: 00425D35
              • #569.MSVBVM60(0000002F,?,?,?,?,?,?,?,?,00401746), ref: 00425D41
              • __vbaFreeStr.MSVBVM60(00425D63,?,?,?,?,?,?,?,?,00401746), ref: 00425D56
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 00425D5B
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 00425D60
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CopyFree$#569
              • String ID:
              • API String ID: 3911904416-0
              • Opcode ID: ad06561aee23201cf6310f575b0ece5380b94c2240c2c35038a899b6f13531f6
              • Instruction ID: 3c13d910c3ffe39c7d59cd1a8aa6ec8fb81f044349fc3943c2f16df14bc087ef
              • Opcode Fuzzy Hash: ad06561aee23201cf6310f575b0ece5380b94c2240c2c35038a899b6f13531f6
              • Instruction Fuzzy Hash: E5111E70D0015E9BCB00DFA4EE45AEE7BB8EF08700F10416AA505B31A4DB746945CFE5
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 004250C4
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 004250DD
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004099A4,000001CC), ref: 00425164
              • __vbaFreeObj.MSVBVM60 ref: 00425173
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 00425188
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 004251A1
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409984,000001C8), ref: 004251C8
              • __vbaFreeObj.MSVBVM60 ref: 004251D7
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: e0db388dac5e8fd11bbd53a932c19867cf07b195ec918a74a506b09465b95957
              • Instruction ID: 163d4b5963631fd3215d3d6db28e284f675702b35bdf4860a4857f577e45bb34
              • Opcode Fuzzy Hash: e0db388dac5e8fd11bbd53a932c19867cf07b195ec918a74a506b09465b95957
              • Instruction Fuzzy Hash: 08415FB4A003049FCB08DF69D989AAABBF4FF49705F10806AE445E7355D7389901CFA5
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • #672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 00425741
              • __vbaFpR8.MSVBVM60 ref: 00425747
              • __vbaNew2.MSVBVM60(00409A14,004333CC), ref: 00425770
              • __vbaHresultCheckObj.MSVBVM60(00000000,02BEE9C4,00409A04,0000001C), ref: 00425795
              • __vbaHresultCheckObj.MSVBVM60(00000000,?,00409A24,0000005C), ref: 004257D9
              • __vbaStrMove.MSVBVM60 ref: 004257EC
              • __vbaFreeObj.MSVBVM60 ref: 004257F5
              • __vbaFreeStr.MSVBVM60(0042582E), ref: 00425827
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresult$#672MoveNew2
              • String ID:
              • API String ID: 2213023555-0
              • Opcode ID: 2bb5f2c5839e5cde10571343db81c17c86d2f658537631b5c70528ef619da9d1
              • Instruction ID: 05f2c87717b4c39f968279371bace2ae7d3f757873af83c11c3a56efa4ac0853
              • Opcode Fuzzy Hash: 2bb5f2c5839e5cde10571343db81c17c86d2f658537631b5c70528ef619da9d1
              • Instruction Fuzzy Hash: CE313D70900609ABCB10DF95DD88B9ABBB8FF88700F20805AE505B7264C7785941CFA9
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00432234
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00432253
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004099A4,000001C8), ref: 00432292
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 004322A1
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 004322B6
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 004322CF
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,00000088), ref: 004322F2
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00432301
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: b964178a0cbc75926fdcfbe2108af5c0de1943c931629483d915cf4f9c9d8a4e
              • Instruction ID: 320f80b9065a363946b154963b28c159daad41450237e010ee88971d90f81cca
              • Opcode Fuzzy Hash: b964178a0cbc75926fdcfbe2108af5c0de1943c931629483d915cf4f9c9d8a4e
              • Instruction Fuzzy Hash: 1C31B074A402009BCB04DFA8CD89F9ABBB8BF4C701F108429F945E7394D7789901CBA9
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00424FAC
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00424FB4
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00424FC9
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00424FE2
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409984,00000220), ref: 00425025
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042502E
              • __vbaFreeStr.MSVBVM60(00425056,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042504E
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425053
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$Copy$CheckHresultNew2
              • String ID:
              • API String ID: 1874231197-0
              • Opcode ID: 8aa6fb051ac3deeb4471ac49eb64d4824b2026395b9254491b2a5485138e5ee9
              • Instruction ID: ee5910929e8a72c3a4d8df3c8322de09606e6d1a90d7f8469d7d47eca2514670
              • Opcode Fuzzy Hash: 8aa6fb051ac3deeb4471ac49eb64d4824b2026395b9254491b2a5485138e5ee9
              • Instruction Fuzzy Hash: 08213C75E002199BCB04DFA9D989A9EBBB8FF4C300F10816AE515A72A5C778A941CF94
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 20%
              			E004253D0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
              				char _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				char _v28;
              				char _v32;
              				intOrPtr _v36;
              				intOrPtr _v44;
              				intOrPtr* _t19;
              				intOrPtr* _t21;
              				intOrPtr* _t23;
              				void* _t26;
              				intOrPtr* _t28;
              				intOrPtr* _t38;
              				void* _t39;
              				void* _t41;
              				intOrPtr _t42;
              				intOrPtr _t43;
              
              				_t42 = _t41 - 0xc;
              				 *[fs:0x0] = _t42;
              				_t43 = _t42 - 0x28;
              				_v16 = _t43;
              				_v12 = 0x401208;
              				_v8 = 0;
              				_t19 = _a4;
              				 *((intOrPtr*)( *_t19 + 4))(_t19, __edi, __esi, __ebx,  *[fs:0x0], 0x401746, _t39);
              				_t21 =  *0x433010; // 0x68fc70
              				_v28 = 0;
              				_v32 = 0;
              				if(_t21 == 0) {
              					__imp____vbaNew2(0x40a178, 0x433010);
              					_t21 =  *0x433010; // 0x68fc70
              				}
              				_t23 =  &_v32;
              				__imp____vbaObjSet(_t23,  *((intOrPtr*)( *_t21 + 0x354))(_t21));
              				_t28 = _t43 - 0x10;
              				 *_t28 = 0xa;
              				_t38 = _t23;
              				 *((intOrPtr*)(_t28 + 4)) = _v44;
              				 *((intOrPtr*)(_t28 + 8)) = 0x80020004;
              				 *((intOrPtr*)(_t28 + 0xc)) = _v36;
              				_t26 =  *((intOrPtr*)( *_t38 + 0x1ec))(_t38, L"PHACOCELE");
              				asm("fclex");
              				if(_t26 < 0) {
              					__imp____vbaHresultCheckObj(_t26, _t38, 0x409994, 0x1ec);
              				}
              				__imp____vbaFreeObj();
              				_v28 = 0x2be5;
              				_push(0x4254a9);
              				return _t26;
              			}




















              0x004253d3
              0x004253e2
              0x004253e9
              0x004253ef
              0x004253f2
              0x004253fb
              0x004253fe
              0x00425404
              0x00425407
              0x0042540e
              0x00425411
              0x00425414
              0x00425420
              0x00425426
              0x00425426
              0x00425435
              0x00425439
              0x00425442
              0x00425449
              0x0042544e
              0x00425452
              0x0042545a
              0x00425466
              0x00425469
              0x0042546f
              0x00425473
              0x00425481
              0x00425481
              0x0042548a
              0x00425490
              0x00425497
              0x00000000

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425420
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425439
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409994,000001EC), ref: 00425481
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042548A
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID: PHACOCELE$+
              • API String ID: 1645334062-1228347243
              • Opcode ID: bacf727132210b86d267deec97d47d0ce1457f6926a6e2c72bf09bb9e1db03ad
              • Instruction ID: ed88025c7b9863245b3367b1e83b3b3d07ffbc139f84c479b4a87d6114e001a1
              • Opcode Fuzzy Hash: bacf727132210b86d267deec97d47d0ce1457f6926a6e2c72bf09bb9e1db03ad
              • Instruction Fuzzy Hash: 3A2192B4A40304AFCB04EFA9D989B9AFBB8FF48301F10856AF545E7391C77899418F94
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaVarDup.MSVBVM60 ref: 00425EC7
              • #687.MSVBVM60(?,?), ref: 00425ED5
              • __vbaDateVar.MSVBVM60(?), ref: 00425EDF
              • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00425EF1
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$#687DateFreeList
              • String ID: 7-7-7$Lu
              • API String ID: 3303533072-1249225327
              • Opcode ID: cf1f3c1b15222886f15c5bd99d917861787c078ab2bff3474560e610cbc03f57
              • Instruction ID: 7c57cf713bc15a26dce48abefd7b320d5e8c3b25c190be296021f407b988377c
              • Opcode Fuzzy Hash: cf1f3c1b15222886f15c5bd99d917861787c078ab2bff3474560e610cbc03f57
              • Instruction Fuzzy Hash: 2911C5B5C10228EBCB00DFD4DE89ADEBBB8FB48B04F04811AF501A7654D7B85509CFA5
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • #669.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 0042566A
              • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 00425675
              • __vbaStrCmp.MSVBVM60(Distriktsbladet6,00000000,?,?,?,?,?,?,?,00401746), ref: 00425681
              • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 00425693
              • #568.MSVBVM60(0000003C,?,?,?,?,?,?,?,00401746), ref: 004256A0
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$#568#669FreeMove
              • String ID: Distriktsbladet6
              • API String ID: 2447501155-846783287
              • Opcode ID: d4e5fb24a8a425b73afa77351ddabe386124b18832dcd2b2ceadeca9efc00849
              • Instruction ID: 4147a8f4da182566bb490998b0269ab07986a21b58ec4f23167f4e43d2536cd3
              • Opcode Fuzzy Hash: d4e5fb24a8a425b73afa77351ddabe386124b18832dcd2b2ceadeca9efc00849
              • Instruction Fuzzy Hash: B701A275D00214AFC7009F64DE49BAEBBB8EB44B00F908126F946F36A0C7384945CB99
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60 ref: 00425523
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042553C
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 00425555
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004099A4,000001CC), ref: 004255DC
              • __vbaFreeObj.MSVBVM60 ref: 004255E5
              • __vbaFreeStr.MSVBVM60(00425607), ref: 00425600
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckCopyHresultNew2
              • String ID:
              • API String ID: 4138333463-0
              • Opcode ID: b7c09383e0d8253b1789573cf49db9c8ecb1007afa6e24abc53c08e5ef456ed3
              • Instruction ID: 2536a638a38a28810221d267553e10ac58989e530bca11a6fea40108b7968b6a
              • Opcode Fuzzy Hash: b7c09383e0d8253b1789573cf49db9c8ecb1007afa6e24abc53c08e5ef456ed3
              • Instruction Fuzzy Hash: BF310AB4A002149FCB04DFA9D989A9ABBF5FF49700F10C06AE509AB355D7389942CF95
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425303
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042531C
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425335
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004099A4,000001C8), ref: 00425378
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425381
              • __vbaFreeStr.MSVBVM60(004253A2,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042539B
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckCopyHresultNew2
              • String ID:
              • API String ID: 4138333463-0
              • Opcode ID: dcefac73a287cdf1c4e3d5c6dadc0a725f5ff0147ae04c2ba9f75563207088d8
              • Instruction ID: a11d9bc83e971335981f969be5167e3dda438acdf71070e4ef551ab3d3cf7628
              • Opcode Fuzzy Hash: dcefac73a287cdf1c4e3d5c6dadc0a725f5ff0147ae04c2ba9f75563207088d8
              • Instruction Fuzzy Hash: 5C216074A40204DFCB04DFA9D989EAABBB8FF48301F10806AF555E72A5C7789941CF95
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 00426073
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,00401746), ref: 0042608C
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401746), ref: 004260A5
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,000001AC,?,?,?,?,?,?,?,?,00401746), ref: 004260C8
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 004260D1
              • __vbaFreeStr.MSVBVM60(004260F2,?,?,?,?,?,?,?,?,00401746), ref: 004260EB
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$CheckCopyHresultNew2
              • String ID:
              • API String ID: 4138333463-0
              • Opcode ID: 647e10283a0baa9a4b89a0c03d0f2927e6cbd94ebd1d0945b8af16e6097feecd
              • Instruction ID: fa751d31b6ff9698b4d3e0bb8d9a5a8e7f078bbf65eee781add6da8381b5d5ec
              • Opcode Fuzzy Hash: 647e10283a0baa9a4b89a0c03d0f2927e6cbd94ebd1d0945b8af16e6097feecd
              • Instruction Fuzzy Hash: C0118E74A40204EFCB04DFA5DA89EAEBBB8FF49701F108426F555E72A0C7785942CF99
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 19%
              			E00425D80(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
              				char _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				char _v28;
              				intOrPtr _v32;
              				intOrPtr _v40;
              				intOrPtr* _t17;
              				intOrPtr* _t19;
              				intOrPtr* _t21;
              				void* _t24;
              				intOrPtr* _t26;
              				intOrPtr* _t36;
              				void* _t37;
              				void* _t39;
              				intOrPtr _t40;
              				intOrPtr _t41;
              
              				_t40 = _t39 - 0xc;
              				 *[fs:0x0] = _t40;
              				_t41 = _t40 - 0x24;
              				_v16 = _t41;
              				_v12 = 0x401290;
              				_v8 = 0;
              				_t17 = _a4;
              				 *((intOrPtr*)( *_t17 + 4))(_t17, __edi, __esi, __ebx,  *[fs:0x0], 0x401746, _t37);
              				_t19 =  *0x433010; // 0x68fc70
              				_v28 = 0;
              				if(_t19 == 0) {
              					__imp____vbaNew2(0x40a178, 0x433010);
              					_t19 =  *0x433010; // 0x68fc70
              				}
              				_t21 =  &_v28;
              				__imp____vbaObjSet(_t21,  *((intOrPtr*)( *_t19 + 0x358))(_t19));
              				_t26 = _t41 - 0x10;
              				 *_t26 = 0xa;
              				_t36 = _t21;
              				 *((intOrPtr*)(_t26 + 4)) = _v40;
              				 *((intOrPtr*)(_t26 + 8)) = 0x80020004;
              				 *((intOrPtr*)(_t26 + 0xc)) = _v32;
              				_t24 =  *((intOrPtr*)( *_t36 + 0x1ec))(_t36, L"Rubedity");
              				asm("fclex");
              				if(_t24 < 0) {
              					__imp____vbaHresultCheckObj(_t24, _t36, 0x409b0c, 0x1ec);
              				}
              				__imp____vbaFreeObj();
              				_push(0x425e4f);
              				return _t24;
              			}



















              0x00425d83
              0x00425d92
              0x00425d99
              0x00425d9f
              0x00425da2
              0x00425dab
              0x00425dae
              0x00425db4
              0x00425db7
              0x00425dbe
              0x00425dc1
              0x00425dcd
              0x00425dd3
              0x00425dd3
              0x00425de2
              0x00425de6
              0x00425def
              0x00425df6
              0x00425dfb
              0x00425dff
              0x00425e07
              0x00425e13
              0x00425e16
              0x00425e1c
              0x00425e20
              0x00425e2e
              0x00425e2e
              0x00425e37
              0x00425e3d
              0x00000000

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425DCD
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425DE6
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409B0C,000001EC), ref: 00425E2E
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425E37
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID: Rubedity
              • API String ID: 1645334062-1230464931
              • Opcode ID: 108fee868a0e7a3c85c7ca9dbb921d812beef59a8b9d287fcd00f0420a5e3aa5
              • Instruction ID: f21a8955d00e44ff5cf524dc50f67edc03337bee1de7943603bb2f978fa8f8b4
              • Opcode Fuzzy Hash: 108fee868a0e7a3c85c7ca9dbb921d812beef59a8b9d287fcd00f0420a5e3aa5
              • Instruction Fuzzy Hash: 58219074A40204ABCB04DFA9D989B9ABFF8FF49700F108066F545E7291C7789941CB99
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • #660.MSVBVM60(?,?,?,00000001,00000001), ref: 00424D41
              • __vbaVarTstNe.MSVBVM60(?,?), ref: 00424D59
              • __vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?), ref: 00424D6F
              • #532.MSVBVM60(RESTARTED), ref: 00424D82
              Strings
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$#532#660FreeList
              • String ID: RESTARTED
              • API String ID: 675845651-3446605417
              • Opcode ID: 9b5abb4a2ec04031efe9e1ab9bbeaa58d68da875f4836bd6b34413bc2bb4fb9a
              • Instruction ID: 8855c30fbd47e34e639c0e8b1a3fb647514f418416d71a989e522a24bee03e24
              • Opcode Fuzzy Hash: 9b5abb4a2ec04031efe9e1ab9bbeaa58d68da875f4836bd6b34413bc2bb4fb9a
              • Instruction Fuzzy Hash: 98113AB1C50228EBDB00DF94DD89FEEFBB8FB58B00F50421AF501B2290D7B815098B65
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaOnError.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,00401746), ref: 004261E4
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,?,?,00401746), ref: 004261FD
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00426216
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,00000140,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042623D
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042624C
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckErrorFreeHresultNew2
              • String ID:
              • API String ID: 3750743295-0
              • Opcode ID: 64fdd77acd979c1acb287bffbbfc6dd53ca1422355a7f9448e51a61ff624e4ed
              • Instruction ID: 2e1ed72699f167615f0d8473bf26fe8b28f2e2a87216776b9535069d80946615
              • Opcode Fuzzy Hash: 64fdd77acd979c1acb287bffbbfc6dd53ca1422355a7f9448e51a61ff624e4ed
              • Instruction Fuzzy Hash: BC215C74A40204EBCB00DF96DA88E9EBBB8FF88700F10446AF451F7260C77869018FA8
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 0042524A
              • #546.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425254
              • __vbaVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401746), ref: 00425260
              • __vbaFreeVar.MSVBVM60(00425298), ref: 00425288
              • __vbaFreeStr.MSVBVM60 ref: 00425291
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$Free$#546CopyMove
              • String ID:
              • API String ID: 2278598164-0
              • Opcode ID: ad22045c332839f8216ca25eec60fff97104a3f04d2e6402e1e64145d0fe0a76
              • Instruction ID: e5f37618b45afdddd3c2e9de1b10513624182ea6505abc4ec1a83e7badf68ea2
              • Opcode Fuzzy Hash: ad22045c332839f8216ca25eec60fff97104a3f04d2e6402e1e64145d0fe0a76
              • Instruction Fuzzy Hash: 8D01C871D00209EFCF04DFA4E949ADEBBB8FB08705F508526E515B62A4EB386545CF68
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 19%
              			E0042DBF0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
              				char _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				char _v28;
              				intOrPtr _v32;
              				intOrPtr _v36;
              				intOrPtr _v40;
              				intOrPtr _v44;
              				intOrPtr _v48;
              				intOrPtr _v56;
              				intOrPtr _v64;
              				intOrPtr _v72;
              				intOrPtr* _t31;
              				intOrPtr* _t33;
              				intOrPtr* _t35;
              				intOrPtr* _t40;
              				void* _t41;
              				intOrPtr* _t43;
              				intOrPtr* _t47;
              				intOrPtr* _t60;
              				void* _t61;
              				void* _t63;
              				intOrPtr _t64;
              				intOrPtr _t65;
              				intOrPtr* _t66;
              				intOrPtr* _t67;
              
              				_t64 = _t63 - 0xc;
              				 *[fs:0x0] = _t64;
              				_t65 = _t64 - 0x44;
              				_v16 = _t65;
              				_v12 = 0x4016a8;
              				_v8 = 0;
              				_t31 = _a4;
              				 *((intOrPtr*)( *_t31 + 4))(_t31, __edi, __esi, __ebx,  *[fs:0x0], 0x401746, _t61);
              				_t33 =  *0x433010; // 0x68fc70
              				_v28 = 0;
              				if(_t33 == 0) {
              					__imp____vbaNew2(0x40a178, 0x433010);
              					_t33 =  *0x433010; // 0x68fc70
              				}
              				_t35 =  &_v28;
              				__imp____vbaObjSet(_t35,  *((intOrPtr*)( *_t33 + 0x3b4))(_t33));
              				_t66 = _t65 - 0x10;
              				_t60 = _t35;
              				_t43 = _t66;
              				 *_t43 = 0xa;
              				_v44 = 0xa;
              				 *((intOrPtr*)(_t43 + 4)) = _v72;
              				 *((intOrPtr*)(_t43 + 8)) = 0x80020004;
              				 *((intOrPtr*)(_t43 + 0xc)) = _v64;
              				_t67 = _t66 - 0x10;
              				_t47 = _t67;
              				 *_t47 = 0xa;
              				 *((intOrPtr*)(_t47 + 4)) = _v56;
              				 *((intOrPtr*)(_t47 + 8)) = 0x80020004;
              				_v36 = 0x80020004;
              				 *((intOrPtr*)(_t47 + 0xc)) = _v48;
              				_t40 = _t67 - 0x10;
              				 *_t40 = _v44;
              				 *((intOrPtr*)(_t40 + 4)) = _v40;
              				 *((intOrPtr*)(_t40 + 8)) = _v36;
              				 *((intOrPtr*)(_t40 + 0xc)) = _v32;
              				_t41 =  *((intOrPtr*)( *_t60 + 0x1d0))(_t60, 0x46e36000);
              				asm("fclex");
              				if(_t41 < 0) {
              					__imp____vbaHresultCheckObj(_t41, _t60, 0x409b40, 0x1d0);
              				}
              				__imp____vbaFreeObj();
              				asm("wait");
              				_push(0x42dcff);
              				return _t41;
              			}





























              0x0042dbf3
              0x0042dc02
              0x0042dc09
              0x0042dc0f
              0x0042dc12
              0x0042dc1b
              0x0042dc1e
              0x0042dc24
              0x0042dc27
              0x0042dc2e
              0x0042dc31
              0x0042dc3d
              0x0042dc43
              0x0042dc43
              0x0042dc52
              0x0042dc56
              0x0042dc5c
              0x0042dc5f
              0x0042dc61
              0x0042dc6a
              0x0042dc6c
              0x0042dc72
              0x0042dc7c
              0x0042dc82
              0x0042dc85
              0x0042dc88
              0x0042dc8f
              0x0042dc94
              0x0042dc97
              0x0042dc9a
              0x0042dca0
              0x0042dcac
              0x0042dcae
              0x0042dcb3
              0x0042dcbe
              0x0042dcc2
              0x0042dcc5
              0x0042dccb
              0x0042dccf
              0x0042dcdd
              0x0042dcdd
              0x0042dce6
              0x0042dcec
              0x0042dced
              0x00000000

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010), ref: 0042DC3D
              • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042DC56
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409B40,000001D0), ref: 0042DCDD
              • __vbaFreeObj.MSVBVM60 ref: 0042DCE6
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: 3a591387f54b6ee8d6322d201d01cc7cfd4e9a218ef8b489b9c9127909a1ad17
              • Instruction ID: d0e6b5840a7c2fae15436880abf33da320b64a52898f77e3dcc90a4989f25303
              • Opcode Fuzzy Hash: 3a591387f54b6ee8d6322d201d01cc7cfd4e9a218ef8b489b9c9127909a1ad17
              • Instruction Fuzzy Hash: 09311CB4E002049FCB04DF69D985A9ABBF4FF48700F14C06AE509AB355D7789801CF94
              Uniqueness

              Uniqueness Score: -1.00%

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,00401746), ref: 0042E120
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401746), ref: 0042E139
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,000001A8,?,?,?,?,?,?,?,?,00401746), ref: 0042E15C
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 0042E165
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: 1e1cc3d4be9c7072c77edd2027dd2c22c8f2fff906ed240f9a3b9531e9b1d81e
              • Instruction ID: f9f3f49ae1d4b2cc90e7f044761678976b4db213b9062e39f2a66a049da872c0
              • Opcode Fuzzy Hash: 1e1cc3d4be9c7072c77edd2027dd2c22c8f2fff906ed240f9a3b9531e9b1d81e
              • Instruction Fuzzy Hash: 29118F74A40204ABC700DFA6DD49F9EBBB8FF59701F204426F451E72A0C77859428A99
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 18%
              			E00425F50(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
              				char _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				char _v28;
              				char _v32;
              				intOrPtr* _t14;
              				intOrPtr* _t16;
              				intOrPtr* _t18;
              				void* _t19;
              				intOrPtr* _t28;
              				void* _t29;
              				void* _t31;
              				intOrPtr _t32;
              
              				_t32 = _t31 - 0xc;
              				 *[fs:0x0] = _t32;
              				_v16 = _t32 - 0x18;
              				_v12 = 0x4012b0;
              				_v8 = 0;
              				_t14 = _a4;
              				 *((intOrPtr*)( *_t14 + 4))(_t14, __edi, __esi, __ebx,  *[fs:0x0], 0x401746, _t29);
              				_t16 =  *0x433010; // 0x68fc70
              				_v28 = 0;
              				_v32 = 0;
              				if(_t16 == 0) {
              					__imp____vbaNew2(0x40a178, 0x433010);
              					_t16 =  *0x433010; // 0x68fc70
              				}
              				_t18 =  &_v32;
              				__imp____vbaObjSet(_t18,  *((intOrPtr*)( *_t16 + 0x378))(_t16));
              				_t28 = _t18;
              				_t19 =  *((intOrPtr*)( *_t28 + 0x21c))(_t28);
              				asm("fclex");
              				if(_t19 < 0) {
              					__imp____vbaHresultCheckObj(_t19, _t28, 0x409984, 0x21c);
              				}
              				__imp____vbaFreeObj();
              				_v28 = 0x4c22e;
              				_push(0x426004);
              				return _t19;
              			}
















              0x00425f53
              0x00425f62
              0x00425f6f
              0x00425f72
              0x00425f7b
              0x00425f7e
              0x00425f84
              0x00425f87
              0x00425f8e
              0x00425f91
              0x00425f94
              0x00425fa0
              0x00425fa6
              0x00425fa6
              0x00425fb5
              0x00425fb9
              0x00425fbf
              0x00425fc4
              0x00425fca
              0x00425fce
              0x00425fdc
              0x00425fdc
              0x00425fe5
              0x00425feb
              0x00425ff2
              0x00000000

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,?,00401746), ref: 00425FA0
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401746), ref: 00425FB9
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409984,0000021C,?,?,?,?,?,?,?,?,00401746), ref: 00425FDC
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401746), ref: 00425FE5
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: 15b1d4be4e0142a3cdb66f0f3d83e79bf0ddad6c2e7c502be204c14ee4b010a7
              • Instruction ID: bd5f345c8a123ea32bcd9b3d0730262c191a4712ec2c7c81b039f9ad9002f5ac
              • Opcode Fuzzy Hash: 15b1d4be4e0142a3cdb66f0f3d83e79bf0ddad6c2e7c502be204c14ee4b010a7
              • Instruction Fuzzy Hash: 741191B8940204ABC700DFA5DE49F9AFBB8FF58701F204466F551E72A1C7785941CB98
              Uniqueness

              Uniqueness Score: -1.00%

              C-Code - Quality: 17%
              			E00425860(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
              				char _v8;
              				intOrPtr _v12;
              				intOrPtr _v16;
              				char _v28;
              				intOrPtr* _t12;
              				intOrPtr* _t14;
              				intOrPtr* _t16;
              				void* _t17;
              				intOrPtr* _t26;
              				void* _t27;
              				void* _t29;
              				intOrPtr _t30;
              
              				_t30 = _t29 - 0xc;
              				 *[fs:0x0] = _t30;
              				_v16 = _t30 - 0x14;
              				_v12 = 0x401250;
              				_v8 = 0;
              				_t12 = _a4;
              				 *((intOrPtr*)( *_t12 + 4))(_t12, __edi, __esi, __ebx,  *[fs:0x0], 0x401746, _t27);
              				_t14 =  *0x433010; // 0x68fc70
              				_v28 = 0;
              				if(_t14 == 0) {
              					__imp____vbaNew2(0x40a178, 0x433010);
              					_t14 =  *0x433010; // 0x68fc70
              				}
              				_t16 =  &_v28;
              				__imp____vbaObjSet(_t16,  *((intOrPtr*)( *_t14 + 0x338))(_t14));
              				_t26 = _t16;
              				_t17 =  *((intOrPtr*)( *_t26 + 0x1ac))(_t26);
              				asm("fclex");
              				if(_t17 < 0) {
              					__imp____vbaHresultCheckObj(_t17, _t26, 0x409a34, 0x1ac);
              				}
              				__imp____vbaFreeObj();
              				_push(0x42590a);
              				return _t17;
              			}















              0x00425863
              0x00425872
              0x0042587f
              0x00425882
              0x0042588b
              0x0042588e
              0x00425894
              0x00425897
              0x0042589e
              0x004258a1
              0x004258ad
              0x004258b3
              0x004258b3
              0x004258c2
              0x004258c6
              0x004258cc
              0x004258d1
              0x004258d7
              0x004258db
              0x004258e9
              0x004258e9
              0x004258f2
              0x004258f8
              0x00000000

              APIs
              • __vbaNew2.MSVBVM60(0040A178,00433010,?,?,?,?,?,?,?,00401746), ref: 004258AD
              • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00401746), ref: 004258C6
              • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A34,000001AC,?,?,?,?,?,?,?,00401746), ref: 004258E9
              • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00401746), ref: 004258F2
              Memory Dump Source
              • Source File: 00000000.00000002.1236460953.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
              • Associated: 00000000.00000002.1236426388.0000000000400000.00000002.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236509555.0000000000433000.00000004.00020000.sdmp Download File
              • Associated: 00000000.00000002.1236531368.0000000000435000.00000002.00020000.sdmp Download File
              Yara matches
              Similarity
              • API ID: __vba$CheckFreeHresultNew2
              • String ID:
              • API String ID: 1645334062-0
              • Opcode ID: 10756e3b4cd7bea39558d305b97eaa99d9a0e0e46a1f7567908395fc9694790d
              • Instruction ID: dae04395d1d4a5376a70293f4078e5a0bf22bb7e327ff71e265d8c016131fe37
              • Opcode Fuzzy Hash: 10756e3b4cd7bea39558d305b97eaa99d9a0e0e46a1f7567908395fc9694790d
              • Instruction Fuzzy Hash: 1011ACB4A40204EFC700EFA5CD89F9ABBBCFB49701F104426F546E32A0C7785941CBA8
              Uniqueness

              Uniqueness Score: -1.00%