Play interactive tour

Edit tour

Windows Analysis Report PO#578946.exe

Overview

General Information

Sample Name:	PO#578946.exe
Analysis ID:	457760
MD5:	691bde1d30c382256ff1072b8f305841
SHA1:	1ce839f49da7750ab19f0e709747a36dce1933fc
SHA256:	9d1bfddea6c5c0a596af58ed64e6c38d2a274e507ca8d92d8fc801e3d8878cca
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PO#578946.exe (PID: 4828 cmdline: 'C:\Users\user\Desktop\PO#578946.exe' MD5: 691BDE1D30C382256FF1072B8F305841)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1_XiRU-Ribfen&"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: PO#578946.exe

Avira: detected

Found malware configuration

Show sources

Source: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1_XiRU-Ribfen&"}

Multi AV Scanner detection for submitted file

Show sources

Source: PO#578946.exe	Virustotal: Detection: 56%			Perma Link
Source: PO#578946.exe	ReversingLabs: Detection: 34%

Source: PO#578946.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1_XiRU-Ribfen&

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PO#578946.exe

Source: C:\Users\user\Desktop\PO#578946.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\PO#578946.exe

Code function: 0_2_024268DE NtAllocateVirtualMemory,

0_2_024268DE

Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024268DE	0_2_024268DE
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424A49	0_2_02424A49
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242A250	0_2_0242A250
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424625	0_2_02424625
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424633	0_2_02424633
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02426236	0_2_02426236
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02425234	0_2_02425234
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02423E3A	0_2_02423E3A
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024232CA	0_2_024232CA
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422ED7	0_2_02422ED7
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424AF4	0_2_02424AF4
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02429E9A	0_2_02429E9A
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424EB4	0_2_02424EB4
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02428764	0_2_02428764
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02429F6E	0_2_02429F6E
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422F7C	0_2_02422F7C
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424F17	0_2_02424F17
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424723	0_2_02424723
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424F28	0_2_02424F28
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024217CC	0_2_024217CC
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424FE4	0_2_02424FE4
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024233FF	0_2_024233FF
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422B82	0_2_02422B82
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02421785	0_2_02421785
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242538A	0_2_0242538A
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424B8B	0_2_02424B8B
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424790	0_2_02424790
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422BB8	0_2_02422BB8
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422C53	0_2_02422C53
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242A060	0_2_0242A060
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02428400	0_2_02428400
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024248CE	0_2_024248CE
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424C8D	0_2_02424C8D
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242A499	0_2_0242A499
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422CB1	0_2_02422CB1
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242414E	0_2_0242414E
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424D60	0_2_02424D60
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242316F	0_2_0242316F
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02429D6D	0_2_02429D6D
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02425118	0_2_02425118
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02423534	0_2_02423534
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02423DC1	0_2_02423DC1
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242A1E2	0_2_0242A1E2
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02422DE0	0_2_02422DE0
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_024245FC	0_2_024245FC
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242318A	0_2_0242318A
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02424190	0_2_02424190
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02429DA0	0_2_02429DA0

Source: PO#578946.exe, 00000000.00000000.335853401.0000000000418000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUnderno3.exe vs PO#578946.exe
Source: PO#578946.exe, 00000000.00000002.868019534.00000000022D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PO#578946.exe
Source: PO#578946.exe	Binary or memory string: OriginalFilenameUnderno3.exe vs PO#578946.exe

Source: PO#578946.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal96.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\PO#578946.exe

File created: C:\Users\user\AppData\Local\Temp\~DF5AAF62D8F409C8D0.TMP

Jump to behavior

Source: PO#578946.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO#578946.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO#578946.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO#578946.exe	Virustotal: Detection: 56%
Source: PO#578946.exe	ReversingLabs: Detection: 34%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_00408EF8 pushad ; ret	0_2_00408EF9
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0040953E push eax; iretd	0_2_00409547
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02426E62 pushad ; retf	0_2_02427882
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02420AF1 push esp; retf	0_2_02420AF2
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02420B18 push esp; retf	0_2_02420B19
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02426F1E pushad ; retf	0_2_02427882
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02427BF7 push esp; ret	0_2_02427BFF
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242784E pushad ; retf	0_2_02427882
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02427866 pushad ; retf	0_2_02427882
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02426DC4 pushad ; retf	0_2_02427882

Source: C:\Users\user\Desktop\PO#578946.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe

Code function: 0_2_0242316F

0_2_0242316F

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe

RDTSC instruction interceptor: First address: 000000000242034B second address: 000000000242034B instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 000000000242034B second address: 000000000242034B instructions:
Source: C:\Users\user\Desktop\PO#578946.exe	RDTSC instruction interceptor: First address: 0000000002426191 second address: 0000000002426191 instructions: 0x00000000 rdtsc 0x00000002 mov eax, CFC9D9CCh 0x00000007 xor eax, E7B8D616h 0x0000000c xor eax, B003C39Fh 0x00000011 xor eax, 9872CC44h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FEE848CB84Ah 0x0000001e lfence 0x00000021 mov edx, 324626BAh 0x00000026 xor edx, 8E47B5F1h 0x0000002c xor edx, CD58843Fh 0x00000032 xor edx, 0EA71760h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 cmp cx, dx 0x00000045 add edi, edx 0x00000047 dec ecx 0x00000048 mov dword ptr [ebp+000001B1h], ecx 0x0000004e mov ecx, 1C5A7D24h 0x00000053 xor ecx, 8E853080h 0x00000059 cmp cx, cx 0x0000005c xor ecx, 6F6EDF25h 0x00000062 test ax, dx 0x00000065 sub ecx, FDB19281h 0x0000006b cmp dword ptr [ebp+000001B1h], ecx 0x00000071 mov ecx, dword ptr [ebp+000001B1h] 0x00000077 jne 00007FEE848CB7F4h 0x00000079 cmp edx, eax 0x0000007b mov dword ptr [ebp+00000221h], eax 0x00000081 mov eax, ecx 0x00000083 push eax 0x00000084 mov eax, dword ptr [ebp+00000221h] 0x0000008a call 00007FEE848CB910h 0x0000008f call 00007FEE848CB86Bh 0x00000094 lfence 0x00000097 mov edx, 324626BAh 0x0000009c xor edx, 8E47B5F1h 0x000000a2 xor edx, CD58843Fh 0x000000a8 xor edx, 0EA71760h 0x000000ae mov edx, dword ptr [edx] 0x000000b0 lfence 0x000000b3 ret 0x000000b4 mov esi, edx 0x000000b6 pushad 0x000000b7 rdtsc

Source: C:\Users\user\Desktop\PO#578946.exe

Code function: 0_2_02424A49 rdtsc

0_2_02424A49

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\PO#578946.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\PO#578946.exe

Code function: 0_2_02424A49 rdtsc

0_2_02424A49

Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02425FBD mov eax, dword ptr fs:[00000030h]	0_2_02425FBD
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02428C43 mov eax, dword ptr fs:[00000030h]	0_2_02428C43
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242914F mov eax, dword ptr fs:[00000030h]	0_2_0242914F
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_0242316F mov eax, dword ptr fs:[00000030h]	0_2_0242316F
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02429D6D mov eax, dword ptr fs:[00000030h]	0_2_02429D6D
Source: C:\Users\user\Desktop\PO#578946.exe	Code function: 0_2_02423DC1 mov eax, dword ptr fs:[00000030h]	0_2_02423DC1

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: PO#578946.exe, 00000000.00000002.867875316.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PO#578946.exe, 00000000.00000002.867875316.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PO#578946.exe, 00000000.00000002.867875316.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: PO#578946.exe, 00000000.00000002.867875316.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO#578946.exe

Code function: 0_2_02425B4B cpuid

0_2_02425B4B

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery311	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO#578946.exe	57%	Virustotal		Browse
PO#578946.exe	35%	ReversingLabs	Win32.Trojan.Fragtor
PO#578946.exe	100%	Avira	HEUR/AGEN.1130122

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457760
Start date:	02.08.2021
Start time:	09:26:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO#578946.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.1% (good quality ratio 0.2%) Quality average: 17.4% Quality standard deviation: 34.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.304822927566701
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO#578946.exe
File size:	98304
MD5:	691bde1d30c382256ff1072b8f305841
SHA1:	1ce839f49da7750ab19f0e709747a36dce1933fc
SHA256:	9d1bfddea6c5c0a596af58ed64e6c38d2a274e507ca8d92d8fc801e3d8878cca
SHA512:	b8eba412543f38959d50279654d72be9f208e45d7fca1023aa07baf75c328d7bf7aba2cbd8a1a9761f6ae1942fcea0f6e593ea1ec2c74d7f941ac734a046ee3c
SSDEEP:	1536:9xnKKKKKKKKKKKKKKKKKKKKKKKKKKKKCKKKKKKKKKKKKKKKKKKKKKKKKKKKKKDKs:oauQiP2d+a
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...[..Z.................P...0...............`....@................

File Icon


Icon Hash:	c4e8c8cccce0e8e8

Static PE Info

General
Entrypoint:	0x4012bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5A01D35B [Tue Nov 7 15:38:03 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6859d1daf1cf351f8ea3b0beb22606a9

Entrypoint Preview

Instruction
push 00401CB0h
call 00007FEE84943933h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-72h], ch
sub eax, BF76FBCFh
inc eax
mov al, byte ptr [82068D03h]
jmp 00007FEE849439AAh
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, ah
or dword ptr [ebx+eax], 44h
outsd
outsb
popad
je 00007FEE849439B1h
jc 00007FEE849439A7h
outsb
je 00007FEE849439A3h
outsb
bound esi, dword ptr [ecx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add byte ptr [esi+37h], ah
jle 00007FEE849438D9h
push ds
rcl cl, cl
inc esp
mov eax, 4447D896h
mov cl, 7Eh
jmp 00007FEE84943970h
push 0000007Ch
not byte ptr [eax+64h]
or al, 48h
lea eax, dword ptr [ecx+11h]
xor ah, byte ptr [ecx+4Ch]
cmc
cmp cl, byte ptr [bx-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc ecx, dword ptr [ecx]
add byte ptr [eax], al
push cs
or dword ptr [eax], eax
add byte ptr [eax], al
add eax, 62794800h
insb
aaa
add byte ptr [4D000901h], cl
jns 00007FEE849439B1h
jo 00007FEE849439A3h
je 00007FEE849439AAh
jns 00007FEE84943977h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x157d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0xc08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14bfc	0x15000	False	0.442638578869	data	6.71966680684	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x11b0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0xc08	0x1000	False	0.311279296875	data	3.24284778332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x18360	0x8a8	data
RT_GROUP_ICON	0x1834c	0x14	data
RT_VERSION	0x180f0	0x25c	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaUI1Str, __vbaCastObj, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	Underno3
FileVersion	1.00
CompanyName	Collapse Magical
Comments	Collapse Magical
ProductName	dece
ProductVersion	1.00
OriginalFilename	Underno3.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PO#578946.exe PID: 4828 Parent PID: 5976

General

Start time:	09:26:56
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\PO#578946.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO#578946.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	691BDE1D30C382256FF1072B8F305841
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO#578946.exe PID: 4828 Parent PID: 5976 PO#578946.exeCOMMON

Executed Functions

Function 024268DE, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02426A93

Strings

5q`s, xrefs: 02426957
Z8z<, xrefs: 02426C62

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: 5q`s$Z8z<
API String ID: 2167126740-2757954662
Opcode ID: 5587b63c56611798cbf69a23caab6852f4306e0a49fb03d07b926023fbc99433
Instruction ID: c54198855c552797e5253d2582a951656a67333755bc259077c143b6fa047d92
Opcode Fuzzy Hash: 5587b63c56611798cbf69a23caab6852f4306e0a49fb03d07b926023fbc99433
Instruction Fuzzy Hash: 2681773650A7808FCB259E7E88C43C9BB66FF06328F51019FD9856B246E276974DCB81

Uniqueness

Uniqueness Score: -1.00%

Function 004012BC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 87%

			_entry_() {
				signed char _t27;
				intOrPtr* _t28;
				signed int _t31;
				signed char _t32;
				intOrPtr* _t33;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr* _t38;
				void* _t39;
				void* _t40;
				signed int _t44;
				void* _t46;
				intOrPtr _t47;

				_push("VB5!6&*"); // executed
				L004012B4(); // executed
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 ^ _t27;
				 *_t27 =  *_t27 + _t27;
				_t28 = _t27 + 1;
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 + _t28;
				 *((intOrPtr*)(_t28 - 0x72)) =  *((intOrPtr*)(_t28 - 0x72)) + _t38;
				_t31 =  *0x82068d03;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				asm("adc ecx, [ecx]");
				 *_t31 =  *_t31 + _t31;
				_push(cs);
				 *_t31 =  *_t31 | _t31;
				 *_t31 =  *_t31 + _t31;
				_t32 = _t31 + 0x62794800;
				asm("insb");
				asm("aaa");
				 *0x4d000901 =  *0x4d000901 + _t38;
				_t47 =  *0x4d000901;
				if(_t47 >= 0) {
					L11:
					_t34 = _t33 -  *_t44;
					 *((intOrPtr*)(_t34 + 0x1c)) =  *((intOrPtr*)(_t34 + 0x1c)) + _t32;
					_t35 = _t34 + 1;
					 *((intOrPtr*)(_t35 + _t32 * 2)) =  *((intOrPtr*)(_t35 + _t32 * 2)) + _t35;
					_t36 = _t35 + 1;
					 *((intOrPtr*)(_t36 + 0x43)) =  *((intOrPtr*)(_t36 + 0x43)) + _t32;
					 *((intOrPtr*)(_t40 + 0x48)) =  *((intOrPtr*)(_t40 + 0x48)) + _t32;
					_t25 = _t39 - 0x36ffc400;
					 *_t25 =  *((intOrPtr*)(_t39 - 0x36ffc400)) + _t36 + 1;
					if ( *_t25 != 0) goto L12;
					asm("insb");
					goto [far dword [eax+eax-0x1];
				}
				if(_t47 < 0) {
					L9:
					asm("sbb al, 0x43");
					asm("sbb al, 0x0");
					_t40 = _t40 + 2;
					_push(ds);
					 *_t44 =  *_t44 + _t33;
					L10:
					_push(ds);
					_t40 = _t40 + 1;
					 *_t33 =  *_t33 + _t38;
					goto L11;
				}
				if(_t47 == 0) {
					goto L10;
				}
				if(_t47 >= 0) {
					L8:
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 | _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *((char*)(_t32 + _t32)) =  *((char*)(_t32 + _t32));
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t38 =  *_t38 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					_t40 = _t40 + 1;
					_t33 = _t33 -  *_t44;
					 *((intOrPtr*)(_t33 + 0x1c)) =  *((intOrPtr*)(_t33 + 0x1c)) + _t32;
					 *_t32 =  *_t32 - _t32;
					goto L9;
				}
				 *_t38 =  *_t38 + _t33;
				 *_t32 =  *_t32 + _t32;
				_t39 = _t39 + 1;
				 *_t33 =  *_t33 + _t32;
				asm("invalid");
				 *_t32 =  *_t32 + _t32;
				 *((intOrPtr*)(_t46 + _t44 * 2)) =  *((intOrPtr*)(_t46 + _t44 * 2)) + _t38;
				 *((intOrPtr*)(_t44 + 8)) =  *((intOrPtr*)(_t44 + 8)) + _t33;
				 *_t38 =  *_t38 + _t32;
				 *_t38 =  *_t38 + _t32;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 & _t32;
				 *_t38 =  *_t38 + _t32;
				 *_t32 =  *_t32 + _t38;
				 *((intOrPtr*)(_t32 + 0x16000008)) =  *((intOrPtr*)(_t32 + 0x16000008)) + _t38;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 + _t38;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 + _t32;
				 *_t32 =  *_t32 + _t32;
				goto L8;
			}

0x004012bc
0x004012c1
0x004012c6
0x004012c8
0x004012ca
0x004012cc
0x004012ce
0x004012d0
0x004012d1
0x004012d3
0x004012d5
0x004012d7
0x004012e0
0x0040134f
0x00401351
0x00401353
0x00401355
0x00401357
0x00401359
0x0040135b
0x0040135d
0x0040135f
0x00401361
0x00401363
0x00401365
0x00401367
0x00401369
0x0040136a
0x0040136c
0x0040136e
0x00401373
0x00401374
0x00401375
0x00401375
0x0040137b
0x004013ec
0x004013ec
0x004013ef
0x004013f2
0x004013f3
0x004013f6
0x004013f7
0x004013fb
0x004013ff
0x004013ff
0x00401406
0x00401408
0x00401409
0x00401409
0x0040137d
0x004013e0
0x004013e0
0x004013e2
0x004013e5
0x004013e6
0x004013e7
0x004013e9
0x004013e9
0x004013ea
0x004013eb
0x00000000
0x004013eb
0x0040137f
0x00000000
0x00000000
0x00401381
0x004013b8
0x004013b8
0x004013ba
0x004013bc
0x004013be
0x004013c0
0x004013c4
0x004013c6
0x004013c8
0x004013ca
0x004013cc
0x004013ce
0x004013d0
0x004013d2
0x004013d4
0x004013d6
0x004013d8
0x004013d9
0x004013db
0x004013de
0x00000000
0x004013de
0x00401383
0x00401385
0x00401387
0x00401388
0x0040138a
0x0040138c
0x0040138d
0x00401391
0x00401397
0x00401399
0x0040139b
0x0040139d
0x0040139f
0x004013a1
0x004013a3
0x004013a9
0x004013ab
0x004013ad
0x004013af
0x004013b1
0x004013b3
0x004013b6
0x00000000

APIs

#100.MSVBVM60(VB5!6&*), ref: 004012C1

Strings

VB5!6&*, xrefs: 004012BC

Memory Dump Source

Source File: 00000000.00000002.867518023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.867503992.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.867527360.0000000000404000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.867552378.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.867561331.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 2a06c9c19c412edb237d56ff7f66935bfa553897a0a4d6bdfe8746052a24eb76
Instruction ID: ca81fdae2271b9c1bbc064ab73ca3044d8b61752e02b106be5274c8c69d7b32b
Opcode Fuzzy Hash: 2a06c9c19c412edb237d56ff7f66935bfa553897a0a4d6bdfe8746052a24eb76
Instruction Fuzzy Hash: 6C21BC6048E3D15FD7134B7589B5A913FB09E6325831A02EBC8C1CE8F3D12D284ADB23

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02428400, Relevance: 3.3, Strings: 2, Instructions: 781COMMON

Download Yara Rule

Strings

U, xrefs: 0242583B
O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: U$O@
API String ID: 0-3358456371
Opcode ID: 6aa099e8d59db9a224df5ae0c0b259ad149844245373310196cc27e67b5e25a3
Instruction ID: aff1e6a45411235a0893609f41ea2c2c1dd0043a5aa4dc97228ae8506bed24e3
Opcode Fuzzy Hash: 6aa099e8d59db9a224df5ae0c0b259ad149844245373310196cc27e67b5e25a3
Instruction Fuzzy Hash: 4D621FB26043599FDB748F3ACD847DABBB2FF95310F95412ADC899B210D3305A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02424723, Relevance: 3.2, Strings: 2, Instructions: 660COMMON

Download Yara Rule

Strings

?, xrefs: 02424723
O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?$O@
API String ID: 0-2085895230
Opcode ID: f6762a36e5d8f58b335fa0552f31c705b347f27823be8629d53dc35590af6f34
Instruction ID: 66fdc94f9a052f7d8cdda7e81b694ba2483e0c1164789ef9dfd95dc020867fcc
Opcode Fuzzy Hash: f6762a36e5d8f58b335fa0552f31c705b347f27823be8629d53dc35590af6f34
Instruction Fuzzy Hash: A7521FB26043599FDB748F3ACD457DABBB2FF95310F95412ADC899B210D3305A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0242316F, Relevance: 3.2, Strings: 2, Instructions: 651COMMON

Download Yara Rule

Strings

5>h*, xrefs: 02428D1B
=M, xrefs: 02428D93

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =M$5>h*
API String ID: 0-199600
Opcode ID: 6c2238ace0749ecffbb39387e6b4ab4e520553cfc7280ef7f6c965da0dfb41fc
Instruction ID: e0e7539b2c05146c6d02c989271373ac70086dff0ce9602012a78626fa530993
Opcode Fuzzy Hash: 6c2238ace0749ecffbb39387e6b4ab4e520553cfc7280ef7f6c965da0dfb41fc
Instruction Fuzzy Hash: B042BD716006599FDB28DF29CC94BDAB7A2FF49310F55822EEC4D9B340DB34AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02426236, Relevance: 2.6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

Strings

`, xrefs: 02426354
M"S, xrefs: 0242636A

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: M"S$`
API String ID: 0-669112169
Opcode ID: f32b9fafd6d15291dd5583f697e1a3c510d3d255234ff510920fc0b28944e7b0
Instruction ID: 532618ab1fa2a0d91b24165fe5e785d9ae5d87c3c6666e980b4243e0428b17f6
Opcode Fuzzy Hash: f32b9fafd6d15291dd5583f697e1a3c510d3d255234ff510920fc0b28944e7b0
Instruction Fuzzy Hash: 083178726003458BDF399E2F8D953D972A3AFD4310FA6813FC80E8B605CB74070A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 02424633, Relevance: 2.0, Strings: 1, Instructions: 704COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 7948077b14a1f4ce77ba0a9e40c605d0a44ddc948b51074c343595a58ef46ce8
Instruction ID: 4cc3880b22e11d86cc118b1c0cd0c022337cfcea686950d2c5dd73a7d1c4dd76
Opcode Fuzzy Hash: 7948077b14a1f4ce77ba0a9e40c605d0a44ddc948b51074c343595a58ef46ce8
Instruction Fuzzy Hash: 68522F726043899FDB749F3ACC857DABBB2FF55310F95412ADC899B210D3705A86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02428764, Relevance: 2.0, Strings: 1, Instructions: 702COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 01869a03c10544e618b69f1bea6746d03b81810c64abeff88f6bd39e655ec574
Instruction ID: bcaf2756b55bed823479bb4e48a8376a1ed62f6d6e6f3e3089cd5f95d71610c5
Opcode Fuzzy Hash: 01869a03c10544e618b69f1bea6746d03b81810c64abeff88f6bd39e655ec574
Instruction Fuzzy Hash: 50521FB26043599FDB749F3ACD457DABBB2FF94310F95812ADC899B210D3305A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 024245FC, Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: a4ac8955a72f68582688745d06660ee10a5e711d97555693a6e30d9273d57685
Instruction ID: 177aa81bcbecb6538a8471fdbd634037d31eb7014c9c57096a180bfb4a1729cc
Opcode Fuzzy Hash: a4ac8955a72f68582688745d06660ee10a5e711d97555693a6e30d9273d57685
Instruction Fuzzy Hash: EB522EB26043999FDB749F3ACD457DABBB2FF94310F95412ADC899B210D3305A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02424790, Relevance: 1.9, Strings: 1, Instructions: 663COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 19e327b8a15e363944e2c3eb8899fd10711fc197ebbacdb0ed9ef9910656bff7
Instruction ID: 365b7ad293477d1dd5940ff34d3940c09a9eb9dd2a07ffda21105bb2193ac54d
Opcode Fuzzy Hash: 19e327b8a15e363944e2c3eb8899fd10711fc197ebbacdb0ed9ef9910656bff7
Instruction Fuzzy Hash: 15522FB26043899FDB749F3ACC847DABBB2FF55310F95412ADC899B210D3705A86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 024248CE, Relevance: 1.9, Strings: 1, Instructions: 619COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 1ef1e2e6b0c5e9e89c42d73807f70a2628afb3ba5c803899691c1f766a827740
Instruction ID: 7dfc3e1fc22ce1860317b9ff91d15b0bc2b8b36643104a9fc2f732a3b81eac30
Opcode Fuzzy Hash: 1ef1e2e6b0c5e9e89c42d73807f70a2628afb3ba5c803899691c1f766a827740
Instruction Fuzzy Hash: 064230726043899FDB749F3ACC847DABBB2FF95310F95412ADC899B214D3705A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02424A49, Relevance: 1.8, Strings: 1, Instructions: 530COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 3c3d0abf33962ac8a3c4d629d036bf19e1c3bfa976e368e2a15114e195dbae19
Instruction ID: 7a3ae8db69dc61dbc14382b0424dba76e34d7d4d00e326ca0211308e83fb230d
Opcode Fuzzy Hash: 3c3d0abf33962ac8a3c4d629d036bf19e1c3bfa976e368e2a15114e195dbae19
Instruction Fuzzy Hash: D5220EB26043599FDB749F3ACC447DABBB2FF94310F95812ADC899B210D3709A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02424AF4, Relevance: 1.8, Strings: 1, Instructions: 519COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: e12349435e8076bcb0722a3b6445a78305d47fc13f29ef09ea32fbcdf9cc0cd2
Instruction ID: d452fd7ba9acb2ed6d209db0f9acecdd634752d92864b3be4b5eb9071230a39c
Opcode Fuzzy Hash: e12349435e8076bcb0722a3b6445a78305d47fc13f29ef09ea32fbcdf9cc0cd2
Instruction Fuzzy Hash: 382220726003999FDB749F3ACC847CABBB2FF54310F91412ADC899B214D3749A86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02424B8B, Relevance: 1.8, Strings: 1, Instructions: 503COMMON

Download Yara Rule

Strings

O@, xrefs: 02424BBB

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O@
API String ID: 0-3842803398
Opcode ID: 8a177f94b73abcdf6045bc818400e4367499bf944c5aa9cb0ad7129682ab90e2
Instruction ID: c246a679e2ce636384bc8b7b2389f59769d7a29c2ef1a42e4ce7e5703f1f6c11
Opcode Fuzzy Hash: 8a177f94b73abcdf6045bc818400e4367499bf944c5aa9cb0ad7129682ab90e2
Instruction Fuzzy Hash: 2B2210726007599FDB749F3ACC447DABBB2FF94310F95412ADC899B210D3709A86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02429D6D, Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: b79c2e7ac7d3b4aa961494bd5de920025b39d0b9d394de2986ab35d642621967
Instruction ID: 2588ba26a0dbcb19ea5dd653f8cdfbb67784d72ad152e7861be3b9240daa73db
Opcode Fuzzy Hash: b79c2e7ac7d3b4aa961494bd5de920025b39d0b9d394de2986ab35d642621967
Instruction Fuzzy Hash: DF12E6715083D58FDB35CF39C8987DABBE1AF16310F49829ACC998F296D3748649CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02429DA0, Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: c8e202357bb6f213d10cf63879e91c2ba0ea697a4d3584306e97dea4b1a3df15
Instruction ID: f70a4cfe968e1ca25f6c196ba0abc6edace7df6d5dcfd1c242d27ab0718c4601
Opcode Fuzzy Hash: c8e202357bb6f213d10cf63879e91c2ba0ea697a4d3584306e97dea4b1a3df15
Instruction Fuzzy Hash: 06C1E6315083D58EDB26CF38C8987D67FE1AF12320F59829AC8998F2E7D3758649C712

Uniqueness

Uniqueness Score: -1.00%

Function 02429E9A, Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: 7c5894e043635fbd251a9e83940671d15d25aba4b88b2a7a1c1f25ee48790ba3
Instruction ID: f1382172f9355042f519a266b86e9472b04e7e86c8657d22cafd96f70bfdc601
Opcode Fuzzy Hash: 7c5894e043635fbd251a9e83940671d15d25aba4b88b2a7a1c1f25ee48790ba3
Instruction Fuzzy Hash: 11B1E4315087D48EDB26CF3888987D6BFD1AF13324F59829AC89A8F2D7E3754649C712

Uniqueness

Uniqueness Score: -1.00%

Function 02429F6E, Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: c60765d557645d7464f25c5c76d3d014efd2678c1072bdd37178bd662a007318
Instruction ID: ddd69cef19a1dad9f185c2f9529075f7d12fa95ee094bc2723ab04417e916356
Opcode Fuzzy Hash: c60765d557645d7464f25c5c76d3d014efd2678c1072bdd37178bd662a007318
Instruction Fuzzy Hash: D29129315093D48ECB35CF388CD87DABBA1AF16324F5482ABC84A8F297E3754649C752

Uniqueness

Uniqueness Score: -1.00%

Function 02422B82, Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

czL, xrefs: 02422DB9, 02422DDD, 02422ED3

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: czL
API String ID: 0-3070960401
Opcode ID: a17d8cab68a00ec1ad84c03ee72b5647be6fafe4e461aee3479a4995b8f7e4cb
Instruction ID: 11d639c3b2494e9dcac2768dad5514fdcb9036299279b85f288316e888bd5c0d
Opcode Fuzzy Hash: a17d8cab68a00ec1ad84c03ee72b5647be6fafe4e461aee3479a4995b8f7e4cb
Instruction Fuzzy Hash: F58103756083498FDB348F26CC947EBBBA2BF95350F96401EDC899B210D7705A86CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02422BB8, Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

czL, xrefs: 02422DB9, 02422DDD, 02422ED3

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: czL
API String ID: 0-3070960401
Opcode ID: 572cb3a50ce8cf7239735731e91df35ea34bb7b877f253ff0fd9049ca53f5b9b
Instruction ID: 5204c2103915827d1fdc2cbfa480ea42bc50745510cc057b9e478b1f3347971e
Opcode Fuzzy Hash: 572cb3a50ce8cf7239735731e91df35ea34bb7b877f253ff0fd9049ca53f5b9b
Instruction Fuzzy Hash: 188102716483898FCB34CF2ACC987EA7BB2BF95350F95401EDC898B265D7704A46CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02422C53, Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

czL, xrefs: 02422DB9, 02422DDD, 02422ED3

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: czL
API String ID: 0-3070960401
Opcode ID: 49e53cadb7e4feb2e626be1abc60237ac703a2e4aaa5e8a1a28eddc1a2e0f3ac
Instruction ID: c18d690ca3235b61f7e19e4f1de823203c5416558adfb9bb066f23c308b0ab64
Opcode Fuzzy Hash: 49e53cadb7e4feb2e626be1abc60237ac703a2e4aaa5e8a1a28eddc1a2e0f3ac
Instruction Fuzzy Hash: 227143726053898FCB348F3A8C847EABBA2BF95310F55411EDC899B355D3705A4ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 02422CB1, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

czL, xrefs: 02422DB9, 02422DDD, 02422ED3

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: czL
API String ID: 0-3070960401
Opcode ID: 519325a4d5d5743dec93638b558658eb5271b4416ea8cba5daf409f934f8425a
Instruction ID: 740ebca2ec881cc251498f1c69126154f8d8650e082d7341eec46a0dddd80e5f
Opcode Fuzzy Hash: 519325a4d5d5743dec93638b558658eb5271b4416ea8cba5daf409f934f8425a
Instruction Fuzzy Hash: E27143726053898FCB348F3A8C847DABBA6BF95320F65411FDC495B355E3705A4ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 0242A060, Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: 704acd4b9f461ea3cff170814fa13b5d8994faf01a915615b9ff1e76ee2cef9d
Instruction ID: f638a389c60be28755f0ab8c6092e88052bd1f027b34760124823b1d637f622b
Opcode Fuzzy Hash: 704acd4b9f461ea3cff170814fa13b5d8994faf01a915615b9ff1e76ee2cef9d
Instruction Fuzzy Hash: 586119325093D48BCB269F3D8CD47D6BBA2AF16324F5441AFC94A8F38BE2750649C752

Uniqueness

Uniqueness Score: -1.00%

Function 02421785, Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

_p, xrefs: 024219AE

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _p
API String ID: 0-2300027963
Opcode ID: 783e3807889bda94f089ed5ecfad62a31dc7f76acc7a7ea6eadfb75a846b4e6d
Instruction ID: f7f31b3710281341135e0cf0a2ef5f49569b798bbe827ed8e7e745383ccad97b
Opcode Fuzzy Hash: 783e3807889bda94f089ed5ecfad62a31dc7f76acc7a7ea6eadfb75a846b4e6d
Instruction Fuzzy Hash: 9E5102715183699BCF38AE7A89A57EE37F2AF44340F91441FDC8E97251DB344A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02423E3A, Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Z@, xrefs: 02423FD1

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Z@
API String ID: 0-3002548393
Opcode ID: 4522a1dfe3051e1e607a88e4cf64158f2af05cace9820a797be7eeb086a6ed18
Instruction ID: e6056ee80cd08d2899cefc495a6cfa32bd811f3b87918f35ecd3abf397183725
Opcode Fuzzy Hash: 4522a1dfe3051e1e607a88e4cf64158f2af05cace9820a797be7eeb086a6ed18
Instruction Fuzzy Hash: 8F5189326023808FD7149F7A9CC87CAB7B2FF55724F21415ECC85A7206E3715B898B82

Uniqueness

Uniqueness Score: -1.00%

Function 02422DE0, Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

czL, xrefs: 02422ED3

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: czL
API String ID: 0-3070960401
Opcode ID: 8453c96ab5d4090f89c91e106f543c5b75e16a0a9e78067397d97f47913cddc6
Instruction ID: 2c9cd76ac16a06b258248d354ba52da44bfd5e8b5b559987698ba45fe85def49
Opcode Fuzzy Hash: 8453c96ab5d4090f89c91e106f543c5b75e16a0a9e78067397d97f47913cddc6
Instruction Fuzzy Hash: DD514A362063858FC7258E3E8C807DABBA6BF96220F65011BDC495B316E3B1574ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 02423DC1, Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

Z@, xrefs: 02423FD1

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Z@
API String ID: 0-3002548393
Opcode ID: 8cead4732014a4ab675181d6e4561dc4286f9a93d14990b8ae69033443da257e
Instruction ID: bcc5c8ab0727c7f34425f6acc0a9f9465e19a43880c2d296446e01eaa2ab8bf9
Opcode Fuzzy Hash: 8cead4732014a4ab675181d6e4561dc4286f9a93d14990b8ae69033443da257e
Instruction Fuzzy Hash: FE510F71604384CFEB249F29D998BDAB7B2FF55350F56851EDC8A8B215E3309A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 024217CC, Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

_p, xrefs: 024219AE

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _p
API String ID: 0-2300027963
Opcode ID: 7adfc8f79059c8d4fe05a2c7e58946faf1576ec177ab60b51b174428c05540d6
Instruction ID: 7880a17fd288ac67cfde75f2510c220ed8bf79bf34ae95d3c7bc21d21bbbfbf4
Opcode Fuzzy Hash: 7adfc8f79059c8d4fe05a2c7e58946faf1576ec177ab60b51b174428c05540d6
Instruction Fuzzy Hash: 3041583250A3958FCB34AF7A88853EDB7B2EF05320F50405FD88AA7256E675178CCB42

Uniqueness

Uniqueness Score: -1.00%

Function 0242A250, Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: 527682dd6a5ac4878753b2d259ef1fa99f16e7e3b9fa0b38ae9c92c2816cfe49
Instruction ID: 697d5607e216f3f5e9081e536625ec268bd397a5eacae9bd5b6c83b76ef8f96e
Opcode Fuzzy Hash: 527682dd6a5ac4878753b2d259ef1fa99f16e7e3b9fa0b38ae9c92c2816cfe49
Instruction Fuzzy Hash: E6316E3240A3C48BCB29AF3D48D43D5BB92EF12624F64516FCD065B287E6B51749C782

Uniqueness

Uniqueness Score: -1.00%

Function 0242A1E2, Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

Ve, xrefs: 0242A31C

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Ve
API String ID: 0-3164504178
Opcode ID: 99274c5773a643f52bb92b1cc4fde2c4be6f034d21795b7a970a5a133d3767df
Instruction ID: 6945316952278d2147f9ab9b049a0f509c05f3da95381790de3ceae54dff94ed
Opcode Fuzzy Hash: 99274c5773a643f52bb92b1cc4fde2c4be6f034d21795b7a970a5a133d3767df
Instruction Fuzzy Hash: 7531EF729483A88BDF399F289DA43E63AE2AB15310F45812FDC0ECF296E77546858711

Uniqueness

Uniqueness Score: -1.00%

Function 02424C8D, Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d495a2a3fd8e68c34a08847be75a9f35767214342db8ff83a13539f73164e149
Instruction ID: 8ba370c648d99ec4d6d8b242c66fb02c99e847a499591d2ff4e45817251f8aaf
Opcode Fuzzy Hash: d495a2a3fd8e68c34a08847be75a9f35767214342db8ff83a13539f73164e149
Instruction Fuzzy Hash: B01200726043999FDB749F3ACD447DA7BB2FF98310F85412ADC889B214D3709A86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02424D60, Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13587d45daacd0d86f5cac160983f806e3873c98df170593fe57b36b83d6fc6f
Instruction ID: 73013c0a022194c636e60c69d1f575dec95c9a916943ae5f0afbffb3d6991b3a
Opcode Fuzzy Hash: 13587d45daacd0d86f5cac160983f806e3873c98df170593fe57b36b83d6fc6f
Instruction Fuzzy Hash: 170233726003989FDB749F3ACC847DA7BB2FF55310F85412ADC88AB215D3715A8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 0242318A, Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db8a09d1551705a373a0660d1ed2f4504717fa55bd430cf7f1922046dfc752a
Instruction ID: 9e9e6fc6c9ce9570dcad0525a239cdb6ac40ad8eecd76ffb510bf8f09dbed35b
Opcode Fuzzy Hash: 5db8a09d1551705a373a0660d1ed2f4504717fa55bd430cf7f1922046dfc752a
Instruction Fuzzy Hash: 3CF1EF71A017969FCB24DF29C880BDAB7B2FF49310F95822EDC899B345D7746A45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02424EB4, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c6cc7c546df962d7599ccbafd5b1967cd2adf2c250b56c4a2b9bb80254ac25
Instruction ID: f6514d9f65720101113468ee187f6b435cceeb211a1c7ac4f7fa637e9674a3ee
Opcode Fuzzy Hash: 04c6cc7c546df962d7599ccbafd5b1967cd2adf2c250b56c4a2b9bb80254ac25
Instruction Fuzzy Hash: 04F132726013989FCB759F3ACC847DA7BB2FF54310F95412ADC88AB214D3715A8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 024232CA, Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f647ad4322ac2dce5ea82c1e75e279618ce2cc68147d44a94b6e6ab50f302db
Instruction ID: ca41c1638cfc6d4bd82bbef083ebf006ee8a759bc94cd11d093da686eb52a6bf
Opcode Fuzzy Hash: 5f647ad4322ac2dce5ea82c1e75e279618ce2cc68147d44a94b6e6ab50f302db
Instruction Fuzzy Hash: 59E1E271A017959FCB28CF29C8807DABBA6FF49310F95822EDC8D97341D7756A45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02424F17, Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c272853fece9da6a9ae7cb9e4f7c157d99e2310ceaf81c2ace24da252c85636
Instruction ID: 916b914f5950d717d25f393450ac4c1e1770034ffc281de656e8efffea34637d
Opcode Fuzzy Hash: 5c272853fece9da6a9ae7cb9e4f7c157d99e2310ceaf81c2ace24da252c85636
Instruction Fuzzy Hash: 8DE1FE726043A99FDB759F3ACC447DA7BB2FF98310F85412ADC889B214D7309A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02424F28, Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d083bd69a279a60898951ff51e4de471e8bebf719ee940fd1198480e0bb4d
Instruction ID: a63ff74011561eb0cf28b230c3fbfb4dded8aee722b37c8d53ac1ca59ad35da8
Opcode Fuzzy Hash: 348d083bd69a279a60898951ff51e4de471e8bebf719ee940fd1198480e0bb4d
Instruction Fuzzy Hash: 2FE1EE726043A99FDB759F3ACC447DA7BB2FF58310F85412ADC889B214D3709A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02424FE4, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f45b1a090044a1cf10a85e5e217947d776f24a6c9af0d0b3ced3d99384a3216
Instruction ID: ebd0188f8901a2e907e061f7c86462859ec2aca9a26fca8c0b0577ae2f4f573a
Opcode Fuzzy Hash: 3f45b1a090044a1cf10a85e5e217947d776f24a6c9af0d0b3ced3d99384a3216
Instruction Fuzzy Hash: 93E141726013988FCB759F3ACC847DA7BB2FF59310F95411ADC88AB214D3715A8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 024233FF, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a4efe69ef1ac5c1621f33c8187223eff7da34dbd024641c6e223f510e78e0a
Instruction ID: 2d95f0f35df448cf8ffd4887ce3e96022823df9e712cd8f6977c48e8e15e2427
Opcode Fuzzy Hash: a8a4efe69ef1ac5c1621f33c8187223eff7da34dbd024641c6e223f510e78e0a
Instruction Fuzzy Hash: EEC101726017958FCB24DF29C8807DEBBA2FF49310F95822EDC899B345D7756A49CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02425118, Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018d782a7eb4ffb8d520cb8742b8a401d0f9f93247a211ba52b97c8cc9f491e3
Instruction ID: 9dc10b26a9f0af6d4595099eca36682c69b561cf9eb7f2b8c9ae9cfb989605fa
Opcode Fuzzy Hash: 018d782a7eb4ffb8d520cb8742b8a401d0f9f93247a211ba52b97c8cc9f491e3
Instruction Fuzzy Hash: 7DC12F72A016989FCB759F39CC887DE7BB2FF18310F95411ADD88AB214D3715A89CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02425234, Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ed71911a4bdd2c7c0fbe088ecfdf6968207103488ac0865bfc46f31aaa0567
Instruction ID: 7982acb405c32e0911f951b94a25b6b28acb030b6cf57bb84710336530994632
Opcode Fuzzy Hash: 20ed71911a4bdd2c7c0fbe088ecfdf6968207103488ac0865bfc46f31aaa0567
Instruction Fuzzy Hash: 98A10E766016A98FCB359F398C843CE7BA2FF19314F95411ADD88AB205E3715B89CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02423534, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8262830b98253be9bbfd07a81cbd13bdfb904d03f10fb6292329fb8e4886df6e
Instruction ID: 8b05c9351e6f89e169940d00b01124c2050fd7c0c9e486c8bdfb9e217ff5b77f
Opcode Fuzzy Hash: 8262830b98253be9bbfd07a81cbd13bdfb904d03f10fb6292329fb8e4886df6e
Instruction Fuzzy Hash: 7A91FF366017958FCB24DF29C8807DABBA2FF09320F94426ADC8997245D7756A48CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0242538A, Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0e0b8b4695017f21bf78b932551f4b1b800eaa05f9e44876f643f059d7615b
Instruction ID: c80de46e7ae2ea336008b77c3b49b9cc42e2e9033a030d355e407213325dedfe
Opcode Fuzzy Hash: 7e0e0b8b4695017f21bf78b932551f4b1b800eaa05f9e44876f643f059d7615b
Instruction Fuzzy Hash: 4C8125769022998FCB359F79CC843CE7BA2FF19314F54412ADD88AB205E3751B49CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02424625, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ff30e315d86f8ad5ca4704dcb4b1f2a28faccabb14358296ddd1493cf855aa
Instruction ID: 7f1b90df7ba6ceb49795d25adce315e56e3f703efbca729960653f284002564d
Opcode Fuzzy Hash: 26ff30e315d86f8ad5ca4704dcb4b1f2a28faccabb14358296ddd1493cf855aa
Instruction Fuzzy Hash: 8351CDB2A0838A9FCBA49F29CD417EAB7F1FF59340F55411EE98A8B210D7304985CF46

Uniqueness

Uniqueness Score: -1.00%

Function 02422ED7, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75248c89ba16f71c61c069505004344a0fa3fa186fba608bef728b5895a56354
Instruction ID: 225eebc3b5406c961e43cb3672a4af27d95cc90818998865a6359ff441118a36
Opcode Fuzzy Hash: 75248c89ba16f71c61c069505004344a0fa3fa186fba608bef728b5895a56354
Instruction Fuzzy Hash: 4B413676609385DFCB34CE3ACC416EABFA2AF95340F56441EDC498B222D770990ACB01

Uniqueness

Uniqueness Score: -1.00%

Function 0242A499, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8a5e74f4e990445ee7c7ac768f12936cbf629163e697c4ee10f7d4356abcfa
Instruction ID: 9beef93ed477fa6f267b4b57d25bf020b54e0fe7dbbc41974f1d049e6a10e439
Opcode Fuzzy Hash: dc8a5e74f4e990445ee7c7ac768f12936cbf629163e697c4ee10f7d4356abcfa
Instruction Fuzzy Hash: 113115369063C08FCB259E39C8D93DEBB61AF12624F54429FC986AF24AD2B5538DC741

Uniqueness

Uniqueness Score: -1.00%

Function 02422F7C, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5136f9af69dc7640f49e1e3098764a40b479c6ae38987e704e6b0f8c406c46b5
Instruction ID: 1ca00d74985eadfe18949d1608191c91f932f967f4e7c765d75fe545a0f08ff1
Opcode Fuzzy Hash: 5136f9af69dc7640f49e1e3098764a40b479c6ae38987e704e6b0f8c406c46b5
Instruction Fuzzy Hash: 4931593B1073814BC3159E7E88C07CAFBA6BF56624F65014FD98567257E2B5170D8782

Uniqueness

Uniqueness Score: -1.00%

Function 02424190, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603f9c906ac8e2bbf7cd4a7bb891dc3cd36a8b13759c4c1c653d668d69c1012f
Instruction ID: 90776b512fda780bc18f4bf507e9256cec75e23bf7c55e16f21a9dc076d7ee6a
Opcode Fuzzy Hash: 603f9c906ac8e2bbf7cd4a7bb891dc3cd36a8b13759c4c1c653d668d69c1012f
Instruction Fuzzy Hash: CE31F92650B7C18BCB229EBD44C4BC5AF416B17438F6843DFCA945B2DBF1A6524EC382

Uniqueness

Uniqueness Score: -1.00%

Function 0242414E, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7434d2872ea5452635908ace2f7d3d3edb4dfebe9a33d74490ede03e4bac0d
Instruction ID: 059d12bf71383aef34bbb4cee246c53d9f7d6d76c77c1a96ad82b2cbdfa56873
Opcode Fuzzy Hash: 0e7434d2872ea5452635908ace2f7d3d3edb4dfebe9a33d74490ede03e4bac0d
Instruction Fuzzy Hash: 0E31F9712047918BDF72CE7CC4D4B867B91AB16214F49829EC89C8B39BE771804AC752

Uniqueness

Uniqueness Score: -1.00%

Function 02425B4B, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879b8d85339a8c1658d0abaae6ac8e71987a5260c1319356e862d01ac78fb594
Instruction ID: d2e33a20ca402429aa45b0d6bdbdcd2f4a18da324b06e88889e13a83a7f5dc85
Opcode Fuzzy Hash: 879b8d85339a8c1658d0abaae6ac8e71987a5260c1319356e862d01ac78fb594
Instruction Fuzzy Hash: 67118E761043508BDB798F7A4941BDA7693EFC6330F23012FDD4A9B200DBB4490ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0242914F, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4775710be94b7dbe7975df7e578d178661c048a6032f6ee6e36015aa21fe54b
Instruction ID: 144e2aaf29cf5f2c721f693a68661c09cc4d6626b84d201847119390c702bb37
Opcode Fuzzy Hash: d4775710be94b7dbe7975df7e578d178661c048a6032f6ee6e36015aa21fe54b
Instruction Fuzzy Hash: 8F114C79688259CFDB34DF19C998AEA73A1AF54310F61441ADC09AF324C770AA45CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02425FBD, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 02428C43, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.868117942.0000000002420000.00000040.00000001.sdmp, Offset: 02420000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9f9c0b49914b91dc63117529f12be8917efe928dfc8fdc7e27797a7c0526a2
Instruction ID: 885e45ef464282fa254b5870cbbab36f712794e6cced61c055b5637c04cb8882
Opcode Fuzzy Hash: 9b9f9c0b49914b91dc63117529f12be8917efe928dfc8fdc7e27797a7c0526a2
Instruction Fuzzy Hash: 30B092302119808FCA81CA08C190F4173A4B700700F814484E5119BA91C228E800CF00

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00415517
__vbaNew2.MSVBVM60(0040276C,00416384,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041552F
__vbaHresultCheckObj.MSVBVM60(00000000,02D5ED94,0040275C,00000014), ref: 00415554
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040277C,0000013C), ref: 0041559F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004155A8
__vbaFreeStr.MSVBVM60(004155C9,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004155C2

Strings

Brsmatadorernes, xrefs: 0041557C

Memory Dump Source

Source File: 00000000.00000002.867527360.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.867503992.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.867518023.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.867552378.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.867561331.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$CopyNew2
String ID: Brsmatadorernes
API String ID: 3978771648-1175637329
Opcode ID: 9b60a26d2439c52211203d279c8a76bead59d54038a39e52b5bd04cdadcae79c
Instruction ID: b4c59039516ebec004af1595d036e627448ef9adee737233fb2a8cd84c182090
Opcode Fuzzy Hash: 9b60a26d2439c52211203d279c8a76bead59d54038a39e52b5bd04cdadcae79c
Instruction Fuzzy Hash: BF21C170A40605EFCB04DF64CA49EEABBF9EF48700F20802AE545B72A5D3749941CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004152E0, Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 00415323
__vbaHresultCheckObj.MSVBVM60(00000000,00401118,00402440,000000A8,?,?,?,?,?,?,?,?,?,00401176), ref: 00415348
__vbaStrCmp.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00415353
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 00415365
_adj_fdiv_m64.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 00415399
__vbaFpI4.MSVBVM60(43370000,?,42040000,?,?,?,?,?,?,?,?,?,00401176), ref: 004153C2
__vbaHresultCheckObj.MSVBVM60(00000000,00401118,00402440,000002C0,?,42040000,?,?,?,?,?,?,?,?,?,00401176), ref: 004153F6
__vbaFreeStr.MSVBVM60(00415418,?,?,?,?,?,?,?,?,?,00401176), ref: 00415411

Memory Dump Source

Source File: 00000000.00000002.867527360.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.867503992.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.867518023.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.867552378.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.867561331.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$Copy_adj_fdiv_m64
String ID:
API String ID: 1025136667-0
Opcode ID: b7031d043b475988eb99e3f75b204159299a1409a23d58a93a846a9c13571596
Instruction ID: 1479ca79db4db314719179a0d68df020f8c6ff2451fcb6807db1588e1850f019
Opcode Fuzzy Hash: b7031d043b475988eb99e3f75b204159299a1409a23d58a93a846a9c13571596
Instruction Fuzzy Hash: 7D31C270900619EFCB149F50DE49FEEBBB8FB88305F10842AF695B71A0C7785885CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004155E0, Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

#521.MSVBVM60(00402958,?,?,?,?,?,?,?,?,?,00401176), ref: 00415622
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 00415633
__vbaStrCmp.MSVBVM60(00402964,00000000,?,?,?,?,?,?,?,?,?,00401176), ref: 0041563B
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 0041564E
__vbaNew2.MSVBVM60(0040276C,00416384,?,?,?,?,?,?,?,?,?,00401176), ref: 0041566B
__vbaHresultCheckObj.MSVBVM60(00000000,02D5ED94,0040275C,00000048,?,?,?,?,?,?,?,?,?,00401176), ref: 00415692
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,00401176), ref: 004156A1
__vbaFreeStr.MSVBVM60(004156BE,?,?,?,?,?,?,?,?,?,00401176), ref: 004156B7

Memory Dump Source

Source File: 00000000.00000002.867527360.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.867503992.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.867518023.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.867552378.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.867561331.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$FreeMove$#521CheckHresultNew2
String ID:
API String ID: 765188452-0
Opcode ID: 454631c7eaa0051973a2962c5793213b3c204742d04904b96a05bc52a0500d7a
Instruction ID: 77ffc069222747844ec2c19d70d75172d275cb43ee61277fc65a7342a246e026
Opcode Fuzzy Hash: 454631c7eaa0051973a2962c5793213b3c204742d04904b96a05bc52a0500d7a
Instruction Fuzzy Hash: 2D21A774D40649EFCB00DF51CE49AEEBBB8EF44700F10812AE555B36A0D7785986CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00415440, Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

#525.MSVBVM60(00000001,?,?,?,?,?,?,00401176), ref: 0041547C
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401176), ref: 00415487
__vbaStrCmp.MSVBVM60(0040292C,00000000,?,?,?,?,?,?,00401176), ref: 00415493
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00401176), ref: 0041549C

Memory Dump Source

Source File: 00000000.00000002.867527360.0000000000404000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.867503992.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.867518023.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.867552378.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.867561331.0000000000418000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#525FreeMove
String ID:
API String ID: 1074920346-0
Opcode ID: be4e123f34134937210843b7ad63994ad027a9f4e4b67f0750887b7d7715c4ad
Instruction ID: 72cc434dbf22c2bef4564626b6d40a35b6592a54c8bbab0b1aa2375314e599fb
Opcode Fuzzy Hash: be4e123f34134937210843b7ad63994ad027a9f4e4b67f0750887b7d7715c4ad
Instruction Fuzzy Hash: 0EF06275900644EFC700AFA4CE49BAEBF78FB08B00F108026F902A76A1C7785985CF99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PO#578946.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PO#578946.exe PID: 4828 Parent PID: 5976

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: PO#578946.exe PID: 4828 Parent PID: 5976 PO#578946.exeCOMMON

Executed Functions

Function 024268DE, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245memorynativeCOMMON

Function 004012BC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88COMMON

Function 004012BC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
COMMON