Play interactive tour

Edit tour

Windows Analysis Report Invoice-NBM01557.exe

Overview

General Information

Sample Name:	Invoice-NBM01557.exe
Analysis ID:	457884
MD5:	32c099a7b9a5cfe1920c5e27d4c26f87
SHA1:	efd4d3670d59054a5e616d8cdc72ffc7239a39ca
SHA256:	cdf3ed20864deb7d7c28a188e14bd8369855e44f9cc3a8abf187146e9ce847b0
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

GuLoader behavior detected

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Invoice-NBM01557.exe (PID: 3164 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 32C099A7B9A5CFE1920C5E27D4C26F87)

RegAsm.exe (PID: 5044 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 5048 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 1112 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 5164 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

RegAsm.exe (PID: 5196 cmdline: 'C:\Users\user\Desktop\Invoice-NBM01557.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://spuredge.com/BarristerRicky_WVgORQXWI61.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.197691242.0000000000401000.00000020.00020000.sdmp	JoeSecurity_GuLoader_1	Yara detected GuLoader	Joe Security
00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp	JoeSecurity_GuLoader_1	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: Invoice-NBM01557.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://spuredge.com/BarristerRicky_WVgORQXWI61.bin"}

Multi AV Scanner detection for domain / URL

Show sources

Source: spuredge.com	Virustotal: Detection: 12%			Perma Link
Source: https://spuredge.com/	Virustotal: Detection: 9%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: Invoice-NBM01557.exe	Virustotal: Detection: 78%	Perma Link
Source: Invoice-NBM01557.exe	Metadefender: Detection: 51%	Perma Link
Source: Invoice-NBM01557.exe	ReversingLabs: Detection: 92%

Source: Invoice-NBM01557.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 164.90.131.131:443 -> 192.168.2.3:49745 version: TLS 1.2

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://spuredge.com/BarristerRicky_WVgORQXWI61.bin

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: spuredge.com

Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.c
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: Invoice-NBM01557.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Invoice-NBM01557.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: Invoice-NBM01557.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Invoice-NBM01557.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Invoice-NBM01557.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Invoice-NBM01557.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Invoice-NBM01557.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Invoice-NBM01557.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Invoice-NBM01557.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/4
Source: RegAsm.exe	String found in binary or memory: https://spuredge.com/BarristerRicky_WVgORQXWI61.bin
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/BarristerRicky_WVgORQXWI61.bin0
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/BarristerRicky_WVgORQXWI61.bin8
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/BarristerRicky_WVgORQXWI61.binH
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/M
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/_
Source: RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	String found in binary or memory: https://spuredge.com/h
Source: Invoice-NBM01557.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 164.90.131.131:443 -> 192.168.2.3:49745 version: TLS 1.2

Source: Invoice-NBM01557.exe, 00000000.00000002.467409461.00000000007BA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Invoice-NBM01557.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Invoice-NBM01557.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process Stats: CPU usage > 98%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1140D NtProtectVirtualMemory,	23_2_00F1140D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A4FE NtAllocateVirtualMemory,	23_2_00F0A4FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A457 NtAllocateVirtualMemory,	23_2_00F0A457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10C21 NtProtectVirtualMemory,	23_2_00F10C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A414 NtAllocateVirtualMemory,	23_2_00F0A414
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A591 NtAllocateVirtualMemory,	23_2_00F0A591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A680 NtAllocateVirtualMemory,	23_2_00F0A680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A26D NtAllocateVirtualMemory,	23_2_00F0A26D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A63E NtAllocateVirtualMemory,	23_2_00F0A63E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A3B9 NtAllocateVirtualMemory,	23_2_00F0A3B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A785 NtAllocateVirtualMemory,	23_2_00F0A785
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A731 NtAllocateVirtualMemory,	23_2_00F0A731
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A30F NtAllocateVirtualMemory,	23_2_00F0A30F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A093	23_2_00F0A093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1140D	23_2_00F1140D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F00E61	23_2_00F00E61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11A55	23_2_00F11A55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0AFAA	23_2_00F0AFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0BFAE	23_2_00F0BFAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F050F1	23_2_00F050F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F054F5	23_2_00F054F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0D4F5	23_2_00F0D4F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F104F9	23_2_00F104F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F4F9	23_2_00F0F4F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A4FE	23_2_00F0A4FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F108E1	23_2_00F108E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0DCE9	23_2_00F0DCE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E0D1	23_2_00F0E0D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F124D5	23_2_00F124D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B4DD	23_2_00F0B4DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04CCD	23_2_00F04CCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F064CD	23_2_00F064CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11CB1	23_2_00F11CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0ECB5	23_2_00F0ECB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0ACA3	23_2_00F0ACA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F044A3	23_2_00F044A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F024A5	23_2_00F024A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F018AE	23_2_00F018AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E496	23_2_00F0E496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02086	23_2_00F02086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01C8F	23_2_00F01C8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B073	23_2_00F0B073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0507D	23_2_00F0507D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B064	23_2_00F0B064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05869	23_2_00F05869
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F06055	23_2_00F06055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05455	23_2_00F05455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F09056	23_2_00F09056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A457	23_2_00F0A457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B45A	23_2_00F0B45A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01C41	23_2_00F01C41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F06443	23_2_00F06443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04C4F	23_2_00F04C4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10435	23_2_00F10435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10C21	23_2_00F10C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0FC11	23_2_00F0FC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A414	23_2_00F0A414
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1201E	23_2_00F1201E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0D5F1	23_2_00F0D5F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0DDF1	23_2_00F0DDF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01DF5	23_2_00F01DF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F019F6	23_2_00F019F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F019F9	23_2_00F019F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F025F9	23_2_00F025F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F109E1	23_2_00F109E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F051D4	23_2_00F051D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F055C6	23_2_00F055C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F1C6	23_2_00F0F1C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04DB7	23_2_00F04DB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F049BE	23_2_00F049BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F045A5	23_2_00F045A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A591	23_2_00F0A591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E99E	23_2_00F0E99E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1058A	23_2_00F1058A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01D8D	23_2_00F01D8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11D61	23_2_00F11D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B56A	23_2_00F0B56A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0656F	23_2_00F0656F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0555D	23_2_00F0555D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01942	23_2_00F01942
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04929	23_2_00F04929
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0212D	23_2_00F0212D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B107	23_2_00F0B107
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0DEF9	23_2_00F0DEF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01AFB	23_2_00F01AFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10EE9	23_2_00F10EE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E6EE	23_2_00F0E6EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F106D0	23_2_00F106D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F06ED3	23_2_00F06ED3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0EED5	23_2_00F0EED5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F012C5	23_2_00F012C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04ACA	23_2_00F04ACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B2B6	23_2_00F0B2B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F03EA1	23_2_00F03EA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F102A2	23_2_00F102A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11AAD	23_2_00F11AAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F293	23_2_00F0F293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05297	23_2_00F05297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02299	23_2_00F02299
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E699	23_2_00F0E699
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F29B	23_2_00F0F29B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10685	23_2_00F10685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10A75	23_2_00F10A75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05E76	23_2_00F05E76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01A79	23_2_00F01A79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A26D	23_2_00F0A26D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B253	23_2_00F0B253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04E55	23_2_00F04E55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0D645	23_2_00F0D645
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1224D	23_2_00F1224D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0FE35	23_2_00F0FE35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F621	23_2_00F0F621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0FE19	23_2_00F0FE19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11E1A	23_2_00F11E1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02204	23_2_00F02204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10605	23_2_00F10605
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0EA0A	23_2_00F0EA0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F00FF5	23_2_00F00FF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F103F4	23_2_00F103F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F023F8	23_2_00F023F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F123E3	23_2_00F123E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F3E5	23_2_00F0F3E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F047E6	23_2_00F047E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F09FD1	23_2_00F09FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0B3D1	23_2_00F0B3D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F053D5	23_2_00F053D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F013D6	23_2_00F013D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10FDD	23_2_00F10FDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11FC5	23_2_00F11FC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F023CA	23_2_00F023CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11BB1	23_2_00F11BB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A3B9	23_2_00F0A3B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F063A1	23_2_00F063A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F047A1	23_2_00F047A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F033A9	23_2_00F033A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0EBAA	23_2_00F0EBAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0979E	23_2_00F0979E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02382	23_2_00F02382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F372	23_2_00F0F372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0637A	23_2_00F0637A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05360	23_2_00F05360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10F6A	23_2_00F10F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04F55	23_2_00F04F55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0335D	23_2_00F0335D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10741	23_2_00F10741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02F32	23_2_00F02F32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01F39	23_2_00F01F39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04F3B	23_2_00F04F3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05325	23_2_00F05325
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F11B0A	23_2_00F11B0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0A30F	23_2_00F0A30F

Source: Invoice-NBM01557.exe

Static PE information: invalid certificate

Source: Invoice-NBM01557.exe, 00000000.00000002.467082489.0000000000650000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Invoice-NBM01557.exe
Source: Invoice-NBM01557.exe, 00000000.00000000.197742468.0000000000462000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemasterer.exe vs Invoice-NBM01557.exe
Source: Invoice-NBM01557.exe	Binary or memory string: OriginalFilenamemasterer.exex vs Invoice-NBM01557.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: Invoice-NBM01557.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_01

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC8D15DAE0C85FFC3.TMP

Jump to behavior

Source: Invoice-NBM01557.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Invoice-NBM01557.exe	Virustotal: Detection: 78%
Source: Invoice-NBM01557.exe	Metadefender: Detection: 51%
Source: Invoice-NBM01557.exe	ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Users\user\Desktop\Invoice-NBM01557.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000000.00000000.197691242.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Code function: 0_2_00404C6D push 00000000h; retf	0_2_00404C70
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Code function: 0_2_00404653 pushfd ; iretd	0_2_0040466D
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Code function: 0_2_00404364 push dword ptr [esi]; iretd	0_2_00404368
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Code function: 0_2_004037BD pushfd ; iretd	0_2_004037C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F00E61 push edi; iretd	23_2_00F011B7

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F104F9	23_2_00F104F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F024A5	23_2_00F024A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F018AE	23_2_00F018AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02086	23_2_00F02086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01C8F	23_2_00F01C8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F06055	23_2_00F06055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01C41	23_2_00F01C41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F06443	23_2_00F06443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10435	23_2_00F10435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01DF5	23_2_00F01DF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F019F6	23_2_00F019F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F019F9	23_2_00F019F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F05D8A	23_2_00F05D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F1058A	23_2_00F1058A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01D8D	23_2_00F01D8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01942	23_2_00F01942
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0212D	23_2_00F0212D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01AFB	23_2_00F01AFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F106D0	23_2_00F106D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F102A2 LoadLibraryA,	23_2_00F102A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02299	23_2_00F02299
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10685	23_2_00F10685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01A79	23_2_00F01A79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02204	23_2_00F02204
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10605	23_2_00F10605
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F103F4	23_2_00F103F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F023F8	23_2_00F023F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F023CA	23_2_00F023CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F063A1	23_2_00F063A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F02382	23_2_00F02382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0637A LoadLibraryA,	23_2_00F0637A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F01F39	23_2_00F01F39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04F3B LoadLibraryA,	23_2_00F04F3B

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058097C second address: 000000000058097C instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058A7A9 second address: 000000000058A854 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov esi, dword ptr [ebp+00000235h] 0x00000010 test edx, eax 0x00000012 mov dword ptr [ebp+00000148h], 00000000h 0x0000001c add ebx, 04h 0x0000001f mov dword ptr [ebp+00000224h], ecx 0x00000025 mov ecx, ebx 0x00000027 cmp bh, dh 0x00000029 push ecx 0x0000002a jmp 00007F8754A67B82h 0x0000002c cmp bl, bl 0x0000002e mov ecx, dword ptr [ebp+00000224h] 0x00000034 push B55527F2h 0x00000039 sub dword ptr [esp], 0BBED90Bh 0x00000040 pushad 0x00000041 mov bx, C0A2h 0x00000045 cmp bx, C0A2h 0x0000004a jne 00007F8754A5E5B7h 0x00000050 popad 0x00000051 xor dword ptr [esp], 244C7A83h 0x00000058 cmp ch, ah 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058A854 second address: 000000000058A854 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580AA4 second address: 0000000000580ACB instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp dl, 00000011h 0x0000000d push 2C063A5Bh 0x00000012 test ax, 00000BDCh 0x00000016 test di, 9AB7h 0x0000001b push B0C249E6h 0x00000020 test dl, FFFFFFDCh 0x00000023 test bx, ax 0x00000026 pushad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580ACB second address: 0000000000580B49 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a push 85327120h 0x0000000f push 61685288h 0x00000014 jmp 00007F8754A685EEh 0x00000016 test al, F1h 0x00000018 test ax, 0000EAC5h 0x0000001c push 0F0C7812h 0x00000021 test di, 7C66h 0x00000026 test dl, FFFFFFE7h 0x00000029 push 06F5AB6Ch 0x0000002e test bx, ax 0x00000031 pushad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580B49 second address: 0000000000580B49 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000059219D second address: 000000000059219D instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000590C66 second address: 0000000000590C66 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000581732 second address: 0000000000581732 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000582354 second address: 0000000000582354 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 00000000005826C3 second address: 00000000005826C3 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000582828 second address: 0000000000582828 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000588B7C second address: 0000000000588B7C instructions:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000000F0B183 second address: 0000000000F0B1AD instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor ebx, 4F20D102h 0x00000010 test bl, dl 0x00000012 xor ebx, 508983A2h 0x00000018 push ebx 0x00000019 mov ebx, dword ptr [ebp+00000261h] 0x0000001f cmp al, dl 0x00000021 mov dword ptr [ebp+0000022Dh], esi 0x00000027 mov esi, eax 0x00000029 pushad 0x0000002a rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000000F0B1AD second address: 0000000000F0B1AD instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Invoice-NBM01557.exe, 00000000.00000002.467409461.00000000007BA000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.465256164.0000000000BD0000.00000004.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058097C second address: 000000000058097C instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058A7A9 second address: 000000000058A854 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov esi, dword ptr [ebp+00000235h] 0x00000010 test edx, eax 0x00000012 mov dword ptr [ebp+00000148h], 00000000h 0x0000001c add ebx, 04h 0x0000001f mov dword ptr [ebp+00000224h], ecx 0x00000025 mov ecx, ebx 0x00000027 cmp bh, dh 0x00000029 push ecx 0x0000002a jmp 00007F8754A67B82h 0x0000002c cmp bl, bl 0x0000002e mov ecx, dword ptr [ebp+00000224h] 0x00000034 push B55527F2h 0x00000039 sub dword ptr [esp], 0BBED90Bh 0x00000040 pushad 0x00000041 mov bx, C0A2h 0x00000045 cmp bx, C0A2h 0x0000004a jne 00007F8754A5E5B7h 0x00000050 popad 0x00000051 xor dword ptr [esp], 244C7A83h 0x00000058 cmp ch, ah 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000058A854 second address: 000000000058A854 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580AA4 second address: 0000000000580ACB instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp dl, 00000011h 0x0000000d push 2C063A5Bh 0x00000012 test ax, 00000BDCh 0x00000016 test di, 9AB7h 0x0000001b push B0C249E6h 0x00000020 test dl, FFFFFFDCh 0x00000023 test bx, ax 0x00000026 pushad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580ACB second address: 0000000000580B49 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a push 85327120h 0x0000000f push 61685288h 0x00000014 jmp 00007F8754A685EEh 0x00000016 test al, F1h 0x00000018 test ax, 0000EAC5h 0x0000001c push 0F0C7812h 0x00000021 test di, 7C66h 0x00000026 test dl, FFFFFFE7h 0x00000029 push 06F5AB6Ch 0x0000002e test bx, ax 0x00000031 pushad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000580B49 second address: 0000000000580B49 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 000000000059219D second address: 000000000059219D instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000590C66 second address: 0000000000590C66 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000581732 second address: 0000000000581732 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000581EE7 second address: 000000000058202A instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp cl, dl 0x0000000d xor dword ptr [esp], 46C0A8E7h 0x00000014 cmp dx, ax 0x00000017 add dword ptr [esp], 4E6B1662h 0x0000001e cmp ah, bh 0x00000020 add dword ptr [esp], 081A73C5h 0x00000027 nop 0x00000028 mov dword ptr [ebp+00000210h], esi 0x0000002e mov esi, 37BD0A28h 0x00000033 cmp al, dl 0x00000035 cmp ax, ax 0x00000038 xor esi, 8DC6BC3Ah 0x0000003e cmp bh, dh 0x00000040 xor esi, E7896D65h 0x00000046 test bl, bl 0x00000048 xor esi, 5DF2DB77h 0x0000004e jmp 00007F8754A67B82h 0x00000050 cmp bl, dl 0x00000052 test edx, eax 0x00000054 push esi 0x00000055 test bh, bh 0x00000057 mov esi, dword ptr [ebp+00000210h] 0x0000005d cmp ch, ch 0x0000005f push F195925Ah 0x00000064 xor dword ptr [esp], 68357457h 0x0000006b cmp bh, dh 0x0000006d xor dword ptr [esp], 7C9227D0h 0x00000074 test bl, bl 0x00000076 xor dword ptr [esp], E532C1DDh 0x0000007d pushad 0x0000007e mov si, BA90h 0x00000082 cmp si, BA90h 0x00000087 jne 00007F8754A66E3Ch 0x0000008d popad 0x0000008e pushad 0x0000008f mov ah, 59h 0x00000091 cmp ah, 00000059h 0x00000094 jne 00007F8754A6CA38h 0x0000009a popad 0x0000009b mov dword ptr [ebp+0000027Eh], edi 0x000000a1 jmp 00007F8754A67B7Eh 0x000000a3 pushad 0x000000a4 lfence 0x000000a7 rdtsc
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000582354 second address: 0000000000582354 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 00000000005826C3 second address: 00000000005826C3 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000582828 second address: 0000000000582828 instructions:
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	RDTSC instruction interceptor: First address: 0000000000588B7C second address: 0000000000588B7C instructions:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000000F01EE7 second address: 0000000000F0202A instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp cl, dl 0x0000000d xor dword ptr [esp], 46C0A8E7h 0x00000014 cmp dx, ax 0x00000017 add dword ptr [esp], 4E6B1662h 0x0000001e cmp ah, bh 0x00000020 add dword ptr [esp], 081A73C5h 0x00000027 nop 0x00000028 mov dword ptr [ebp+00000210h], esi 0x0000002e mov esi, 37BD0A28h 0x00000033 cmp al, dl 0x00000035 cmp ax, ax 0x00000038 xor esi, 8DC6BC3Ah 0x0000003e cmp bh, dh 0x00000040 xor esi, E7896D65h 0x00000046 test bl, bl 0x00000048 xor esi, 5DF2DB77h 0x0000004e jmp 00007F8754A685F2h 0x00000050 cmp bl, dl 0x00000052 test edx, eax 0x00000054 push esi 0x00000055 test bh, bh 0x00000057 mov esi, dword ptr [ebp+00000210h] 0x0000005d cmp ch, ch 0x0000005f push F195925Ah 0x00000064 xor dword ptr [esp], 68357457h 0x0000006b cmp bh, dh 0x0000006d xor dword ptr [esp], 7C9227D0h 0x00000074 test bl, bl 0x00000076 xor dword ptr [esp], E532C1DDh 0x0000007d pushad 0x0000007e mov si, BA90h 0x00000082 cmp si, BA90h 0x00000087 jne 00007F8754A678ACh 0x0000008d popad 0x0000008e pushad 0x0000008f mov ah, 59h 0x00000091 cmp ah, 00000059h 0x00000094 jne 00007F8754A6D4A8h 0x0000009a popad 0x0000009b mov dword ptr [ebp+0000027Eh], edi 0x000000a1 jmp 00007F8754A685EEh 0x000000a3 pushad 0x000000a4 lfence 0x000000a7 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000000F0B183 second address: 0000000000F0B1AD instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a xor ebx, 4F20D102h 0x00000010 test bl, dl 0x00000012 xor ebx, 508983A2h 0x00000018 push ebx 0x00000019 mov ebx, dword ptr [ebp+00000261h] 0x0000001f cmp al, dl 0x00000021 mov dword ptr [ebp+0000022Dh], esi 0x00000027 mov esi, eax 0x00000029 pushad 0x0000002a rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000000F0B1AD second address: 0000000000F0B1AD instructions:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 23_2_00F11A55 rdtsc

23_2_00F11A55

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	API coverage: 1.9 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 9.3 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3476

Thread sleep time: -630000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Invoice-NBM01557.exe, 00000000.00000002.467409461.00000000007BA000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.465256164.0000000000BD0000.00000004.00000001.sdmp

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 23_2_00F11A55 rdtsc

23_2_00F11A55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 23_2_00F0C059 LdrInitializeThunk,

23_2_00F0C059

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0F090 mov eax, dword ptr fs:[00000030h]	23_2_00F0F090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F10435 mov eax, dword ptr fs:[00000030h]	23_2_00F10435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0E9E3 mov eax, dword ptr fs:[00000030h]	23_2_00F0E9E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F095C2 mov eax, dword ptr fs:[00000030h]	23_2_00F095C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F102A2 mov eax, dword ptr fs:[00000030h]	23_2_00F102A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F103F4 mov eax, dword ptr fs:[00000030h]	23_2_00F103F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F0637A mov eax, dword ptr fs:[00000030h]	23_2_00F0637A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00F04F3B mov eax, dword ptr fs:[00000030h]	23_2_00F04F3B

Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Invoice-NBM01557.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Invoice-NBM01557.exe'	Jump to behavior

Source: Invoice-NBM01557.exe, 00000000.00000002.470790714.0000000000D40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.467566779.00000000017C0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Invoice-NBM01557.exe, 00000000.00000002.470790714.0000000000D40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.467566779.00000000017C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Invoice-NBM01557.exe, 00000000.00000002.470790714.0000000000D40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.467566779.00000000017C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Invoice-NBM01557.exe, 00000000.00000002.470790714.0000000000D40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.467566779.00000000017C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection12	Virtualization/Sandbox Evasion22	Input Capture1	Security Software Discovery621	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery31	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Invoice-NBM01557.exe	79%	Virustotal		Browse
Invoice-NBM01557.exe	54%	Metadefender		Browse
Invoice-NBM01557.exe	93%	ReversingLabs	Win32.Trojan.AgentTesla

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.Invoice-NBM01557.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1140082		Download File
0.2.Invoice-NBM01557.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1140082		Download File

Domains

Source	Detection	Scanner	Label	Link
spuredge.com	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://spuredge.com/4	0%	Avira URL Cloud	safe
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin0	0%	Avira URL Cloud	safe
https://spuredge.com/	9%	Virustotal		Browse
https://spuredge.com/	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://spuredge.com/M	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://spuredge.com/h	0%	Avira URL Cloud	safe
https://spuredge.com/BarristerRicky_WVgORQXWI61.binH	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://spuredge.com/_	0%	Avira URL Cloud	safe
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin	0%	Avira URL Cloud	safe
http://apps.identrust.c	0%	Avira URL Cloud	safe
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin8	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
spuredge.com	164.90.131.131	true	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://spuredge.com/4	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://spuredge.com/	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://spuredge.com/M	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://spuredge.com/h	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://spuredge.com/BarristerRicky_WVgORQXWI61.binH	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://spuredge.com/_	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://apps.identrust.c	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://spuredge.com/BarristerRicky_WVgORQXWI61.bin8	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://cps.root-x1.letsencrypt.org0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	RegAsm.exe, 00000017.00000002.466091020.00000000010C9000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
164.90.131.131	spuredge.com	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457884
Start date:	02.08.2021
Start time:	13:33:04
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Invoice-NBM01557.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 75.6% (good quality ratio 38.9%) Quality average: 31.6% Quality standard deviation: 34.7%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 40.88.32.150, 20.82.209.183, 23.211.4.86, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.82.210.154 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, skypedataprdcoleus15.cloudapp.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:35:41	API Interceptor	64x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
164.90.131.131	HSBC Customer Information.exe	Get hash	malicious	Browse
	HSBC Payment Advice.exe	Get hash	malicious	Browse
	Invoice-NBM01557.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
spuredge.com	HSBC Customer Information.exe	Get hash	malicious	Browse	164.90.131.131
	HSBC Payment Advice.exe	Get hash	malicious	Browse	164.90.131.131
	Invoice-NBM01557.exe	Get hash	malicious	Browse	164.90.131.131

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	w4DEaimFEt	Get hash	malicious	Browse	64.227.61.197
	fJn3N6piJM	Get hash	malicious	Browse	68.183.107.28
	1sHut1OhEU	Get hash	malicious	Browse	68.183.107.28
	dIuTSU7cWx	Get hash	malicious	Browse	68.183.107.28
	Z0MWp1rWrI	Get hash	malicious	Browse	46.101.74.107
	140oGL81Z9	Get hash	malicious	Browse	46.101.74.107
	WVS6wDRacf	Get hash	malicious	Browse	68.183.107.28
	30Bzshze5J	Get hash	malicious	Browse	68.183.107.28
	t9ZTYARTkb	Get hash	malicious	Browse	46.101.74.107
	u9vk6372pG	Get hash	malicious	Browse	46.101.74.107
	McDGsbifWs	Get hash	malicious	Browse	46.101.74.107
	K0UbuGy6TL	Get hash	malicious	Browse	46.101.74.107
	7D2r6OGZYr	Get hash	malicious	Browse	68.183.107.28
	uiInKzkLQx	Get hash	malicious	Browse	188.226.156.33
	0wagQPl5bl	Get hash	malicious	Browse	167.174.106.204
	tajmWT78Gh	Get hash	malicious	Browse	167.172.53.230
	X7S5qVt2kU	Get hash	malicious	Browse	188.166.148.220
	z8TB44PMED	Get hash	malicious	Browse	188.166.148.220
	iGyh86ydRb	Get hash	malicious	Browse	188.166.148.220
	JyZtWJg3OU	Get hash	malicious	Browse	188.166.148.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	o12nY1xwUl.exe	Get hash	malicious	Browse	164.90.131.131
	R4qgfTvaiK.exe	Get hash	malicious	Browse	164.90.131.131
	Zaobz-rdbmw-xdw-f.exe	Get hash	malicious	Browse	164.90.131.131
	AR2rPMLtaN.exe	Get hash	malicious	Browse	164.90.131.131
	NEW PO pdf.exe	Get hash	malicious	Browse	164.90.131.131
	BFE85B846350851DD4F83DFED498AE60F85D4129329C2.exe	Get hash	malicious	Browse	164.90.131.131
	Aging invoice.html	Get hash	malicious	Browse	164.90.131.131
	R5L9IoaG67.exe	Get hash	malicious	Browse	164.90.131.131
	flJrVwWebP.exe	Get hash	malicious	Browse	164.90.131.131
	QfVER41Fwx.exe	Get hash	malicious	Browse	164.90.131.131
	1A263B2603212FF1E492D9E0C718F12601789E27EAABA.exe	Get hash	malicious	Browse	164.90.131.131
	mbVrdKm3zX.exe	Get hash	malicious	Browse	164.90.131.131
	bHC6bZhkMz.exe	Get hash	malicious	Browse	164.90.131.131
	5qW61eKDTp.exe	Get hash	malicious	Browse	164.90.131.131
	WWzUml7m53.exe	Get hash	malicious	Browse	164.90.131.131
	e7V79qGVJT.exe	Get hash	malicious	Browse	164.90.131.131
	it2TiN2UtR.exe	Get hash	malicious	Browse	164.90.131.131
	4Dm89IWqe9.exe	Get hash	malicious	Browse	164.90.131.131
	5mr8riiH5q.exe	Get hash	malicious	Browse	164.90.131.131
	YoKh9rD5xR.exe	Get hash	malicious	Browse	164.90.131.131

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.070814493721219
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Invoice-NBM01557.exe
File size:	406648
MD5:	32c099a7b9a5cfe1920c5e27d4c26f87
SHA1:	efd4d3670d59054a5e616d8cdc72ffc7239a39ca
SHA256:	cdf3ed20864deb7d7c28a188e14bd8369855e44f9cc3a8abf187146e9ce847b0
SHA512:	92718e45b150eefc458f782955fdb63983c2ea1792703fb63d3aa6387a1d73046b3d2f52d4105a214ee779143350a1e90fe3808c9a5fa12b7124ba1fbf223876
SSDEEP:	6144:X5JSVcNqNU2DqySM7cCezPu71By3WqCADi52ovelDv:y+N5XySpCoPu71BoND22x
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...&(.`.....................`......D.............@................

File Icon


Icon Hash:	1d1d0b481b2d1e7b

Static PE Info

General
Entrypoint:	0x401944
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x60E42826 [Tue Jul 6 09:53:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2a8f8fe86b805d013a793966040bd3e6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=SURROGATKAFFES@positionslyset.JOR, CN=TRIBUN, OU=Liminess, O=Howe, L=Afrikaniseringerne, S=AANDINGSLUFTS, C=WF
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	7/6/2021 2:53:43 AM 7/6/2022 2:53:43 AM
Subject Chain	E=SURROGATKAFFES@positionslyset.JOR, CN=TRIBUN, OU=Liminess, O=Howe, L=Afrikaniseringerne, S=AANDINGSLUFTS, C=WF
Version:	3
Thumbprint MD5:	124522CD2089964485F61C096F9A0D19
Thumbprint SHA-1:	601B5785D599363311C7F6646A07536D03A81D48
Thumbprint SHA-256:	C196911BAAA100ED78BD9FEA9A748CD038154CEFAECF4159513CE925FB28650A
Serial:	00

Entrypoint Preview

Instruction
push 00408534h
call 00007F8754B45A33h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ch, dh
cld
aam 4Ah
push 00000045h
inc ebp
mov ch, C7h
xor ecx, dword ptr [edi+55E7E214h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc edx
add byte ptr [esi], al
push eax
add dword ptr [ecx], 62h
jc 00007F8754B45AA8h
insb
jnc 00007F8754B45AA7h
jc 00007F8754B45AB0h
add byte ptr [eax], al
les ebp, fword ptr [ecx]
push cs
add eax, dword ptr [eax]
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
or al, C4h
jnc 00007F8754B45ABEh
pushfd
lodsb

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c834	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x3376c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x62000	0x1478
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1f0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2be9c	0x2c000	False	0.359996448864	data	5.19267836508	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x2d000	0x1208	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2f000	0x3376c	0x34000	False	0.254216120793	data	4.44258915763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2f0e8	0x3334c	data
RT_GROUP_ICON	0x62434	0x14	data
RT_VERSION	0x62448	0x324	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, __vbaOnError, __vbaCyAdd, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaI2I4, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaFpCmpCy, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, __vbaInStr, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, __vbaAryCopy, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Veeva Systems
InternalName	masterer
FileVersion	1.00
CompanyName	Veeva Systems
LegalTrademarks	Veeva Systems
Comments	Veeva Systems
ProductName	Veeva Systems
ProductVersion	1.00
FileDescription	Veeva Systems
OriginalFilename	masterer.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2021 13:35:40.789267063 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:40.892699003 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:40.894449949 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:40.927284002 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.028748989 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.029031038 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.029071093 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.029109001 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.029135942 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.029208899 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.029263973 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.030519962 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.034167051 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.139246941 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.240998983 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.241269112 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.280236959 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.383631945 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.383760929 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.511296034 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.613480091 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.613603115 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.729620934 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.831511974 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:41.831629038 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:41.948720932 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.050656080 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:42.051207066 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.167452097 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.269274950 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:42.272334099 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.386699915 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.491229057 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:42.491507053 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.605616093 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.710289001 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:42.710567951 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.824354887 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:42.926182985 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:42.926501989 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.043262959 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.149116993 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:43.149346113 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.262417078 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.367554903 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:43.367763042 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.480498075 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.584925890 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:43.585114956 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.702326059 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.804044008 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:43.804184914 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:43.917119026 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.019752979 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:44.019999027 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.136116982 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.237888098 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:44.238063097 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.355176926 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.457658052 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:44.457751036 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.573474884 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.675307989 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:44.675410986 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.792594910 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:44.894566059 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:44.894752026 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.010694981 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.112613916 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:45.112782955 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.231662989 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.333462954 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:45.334356070 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.448331118 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.550421000 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:45.550674915 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.667653084 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.769488096 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:45.775439978 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:45.901645899 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.003710985 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:46.003987074 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.121721983 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.223608017 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:46.223870039 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.343348026 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.445341110 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:46.445605040 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.562244892 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.664100885 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:46.664356947 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.777786970 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.879820108 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:46.880073071 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:46.996202946 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.097904921 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:47.098193884 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.213947058 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.316598892 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:47.316689968 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.432728052 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.534759998 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:47.534903049 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.652726889 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.754878044 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:47.755163908 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.871330023 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:47.974225044 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:47.976516008 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.089934111 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.191838026 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:48.192085028 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.308959007 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.410903931 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:48.412183046 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.526997089 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.628794909 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:48.629060030 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.747057915 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.848983049 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:48.849348068 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:48.965898037 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.067764997 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:49.068012953 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.183600903 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.285334110 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:49.285644054 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.405066967 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.506928921 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:49.507246971 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.622292995 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.724159956 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:49.724277973 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.839947939 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:49.942543983 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:49.942651987 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.058027983 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.161024094 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:50.161155939 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.276936054 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.378814936 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:50.378945112 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.497163057 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.598936081 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:50.599173069 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.715555906 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.817886114 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:50.817989111 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:50.934988976 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.036796093 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:51.037108898 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.152565956 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.254511118 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:51.254709959 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.371556997 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.473953962 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:51.474273920 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.591568947 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.694498062 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:51.694860935 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.808969021 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:51.911017895 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:51.914128065 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.028608084 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.132086039 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:52.132385015 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.247627020 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.352166891 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:52.352487087 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.465596914 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.567974091 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:52.568171978 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.683801889 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.787075043 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:52.787280083 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:52.902730942 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.004760981 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:53.004882097 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.120847940 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.226104021 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:53.227148056 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.340507984 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.442223072 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:53.444775105 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.558733940 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.665060997 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:53.665309906 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.778129101 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.879811049 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:53.879961014 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:53.996994972 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.098743916 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:54.098921061 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.216790915 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.319677114 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:54.319977045 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.434587955 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.537319899 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:54.537626028 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.653520107 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.755525112 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:54.755620003 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.871895075 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:54.975459099 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:54.975637913 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:55.090590000 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:35:55.192838907 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:35:55.193006992 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:36:00.197355986 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:36:00.197374105 CEST	443	49745	164.90.131.131	192.168.2.3
Aug 2, 2021 13:36:00.197469950 CEST	49745	443	192.168.2.3	164.90.131.131
Aug 2, 2021 13:36:00.197503090 CEST	49745	443	192.168.2.3	164.90.131.131

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2021 13:33:42.970093012 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:42.996419907 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:43.986186028 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:44.011964083 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:45.039146900 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:45.063771009 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:45.905956984 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:45.930618048 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:46.615179062 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:46.641977072 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:47.270052910 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:47.304307938 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:48.053533077 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:48.080106974 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:49.064507008 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:49.089667082 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:49.713998079 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:49.744657993 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:51.830730915 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:51.858619928 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:52.636219025 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:52.665013075 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:56.232443094 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:56.268361092 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:57.629832029 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:57.656357050 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 2, 2021 13:33:59.382101059 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:33:59.407244921 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:00.104933023 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:00.132669926 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:00.806318045 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:00.834259033 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:01.948477983 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:01.984610081 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:15.751302004 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:15.784214020 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:21.827714920 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:21.863329887 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:46.912652016 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:46.973166943 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:47.549884081 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:47.630480051 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:48.131292105 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:48.166340113 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:48.607642889 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:48.643054008 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:49.193661928 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:49.225845098 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:49.335520983 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:49.383615971 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:49.768141985 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:49.800760984 CEST	53	60633	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:50.440877914 CEST	61292	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:50.465858936 CEST	53	61292	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:51.274610043 CEST	63619	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:51.310234070 CEST	53	63619	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:52.377286911 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:52.411283970 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:52.781558037 CEST	61946	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:52.806242943 CEST	53	61946	8.8.8.8	192.168.2.3
Aug 2, 2021 13:34:58.255539894 CEST	64910	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:34:58.290641069 CEST	53	64910	8.8.8.8	192.168.2.3
Aug 2, 2021 13:35:28.107701063 CEST	52123	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:35:28.140614033 CEST	53	52123	8.8.8.8	192.168.2.3
Aug 2, 2021 13:35:31.468569040 CEST	56130	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:35:31.504657984 CEST	53	56130	8.8.8.8	192.168.2.3
Aug 2, 2021 13:35:40.641864061 CEST	56338	53	192.168.2.3	8.8.8.8
Aug 2, 2021 13:35:40.756855011 CEST	53	56338	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 2, 2021 13:35:40.641864061 CEST	192.168.2.3	8.8.8.8	0x4556	Standard query (0)	spuredge.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 2, 2021 13:35:40.756855011 CEST	8.8.8.8	192.168.2.3	0x4556	No error (0)	spuredge.com		164.90.131.131	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 2, 2021 13:35:41.030519962 CEST	164.90.131.131	443	192.168.2.3	49745	CN=spuredge.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 22 04:59:46 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 20 04:59:45 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Invoice-NBM01557.exe PID: 3164 Parent PID: 5552

General

Start time:	13:33:49
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\Invoice-NBM01557.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0x400000
File size:	406648 bytes
MD5 hash:	32C099A7B9A5CFE1920C5E27D4C26F87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000000.00000000.197691242.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 5044 Parent PID: 3164

General

Start time:	13:35:01
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0x320000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegAsm.exe PID: 5048 Parent PID: 3164

General

Start time:	13:35:01
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0x390000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegAsm.exe PID: 1112 Parent PID: 3164

General

Start time:	13:35:02
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0x220000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegAsm.exe PID: 5164 Parent PID: 3164

General

Start time:	13:35:02
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0x3f0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegAsm.exe PID: 5196 Parent PID: 3164

General

Start time:	13:35:02
Start date:	02/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Invoice-NBM01557.exe'
Imagebase:	0xa90000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5332 Parent PID: 5196

General

Start time:	13:35:03
Start date:	02/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Invoice-NBM01557.exe PID: 3164 Parent PID: 5552 Invoice-NBM01557.exeCOMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	0%
Total number of Nodes:	569
Total number of Limit Nodes:	3

Executed Functions

Function 0042AA40, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0042AA80
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042AA9F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042AAC2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409AE8,00000120), ref: 0042AAE5
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042AAF7
__vbaStrVarMove.MSVBVM60(00000000), ref: 0042AB01
__vbaStrMove.MSVBVM60 ref: 0042AB0C
#690.MSVBVM60(Spisesedler5,Pakkelsninger7,margens,00000000), ref: 0042AB22
__vbaFreeStr.MSVBVM60 ref: 0042AB2B
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042AB3B
__vbaFreeVar.MSVBVM60 ref: 0042AB47
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042AB60
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042AB75
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,000001C0), ref: 0042AB94
__vbaFreeObj.MSVBVM60 ref: 0042AB9D
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042ABB6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042ABCB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042AC0F
__vbaFreeObj.MSVBVM60 ref: 0042AC18
__vbaFreeStr.MSVBVM60(0042AC64), ref: 0042AC5D

Strings

MILITAERFOLK, xrefs: 0042ABEE
Spisesedler5, xrefs: 0042AB1D
margens, xrefs: 0042AB13
Pakkelsninger7, xrefs: 0042AB18

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$Move$#690CallCopyLateList
String ID: MILITAERFOLK$Pakkelsninger7$Spisesedler5$margens
API String ID: 630048585-2488380470
Opcode ID: 594b3762210cce143b99cb181dd82cab812e3d463d4d00264b948fd49a49184f
Instruction ID: 1bafe84189e418bbbe903dfc3b9485846cfec61f683c285c1520cf57dc4fa80e
Opcode Fuzzy Hash: 594b3762210cce143b99cb181dd82cab812e3d463d4d00264b948fd49a49184f
Instruction Fuzzy Hash: B2515071A00214ABCB14DFA4DD49FDA77B8BF0C704F20452AF546B72A1D674A905CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401944, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			_entry_(signed int __eax, signed int __ebx, void* __ecx, void* __edx, signed int __edi, intOrPtr* __esi) {
				signed char _t25;
				signed char _t26;
				signed int _t27;
				signed int _t28;
				signed char _t29;
				intOrPtr* _t30;
				signed char _t31;
				signed int _t32;
				intOrPtr* _t33;
				signed int _t39;
				void* _t41;
				intOrPtr* _t42;
				void* _t45;
				intOrPtr* _t46;
				signed int _t48;
				intOrPtr* _t56;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t68;

				_t56 = __esi;
				_t48 = __edi;
				_t32 = __ebx;
				_push("VB5!6&*"); // executed
				L0040193C(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t25 = __eax + 1;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				asm("cld");
				asm("lock aam 0x4a");
				_push(0x45);
				_t63 = _t62 + 1;
				_t39 = 0x000000c7 ^  *(__edi + 0x55e7e214);
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				_t45 = __edx + 1;
				 *__esi =  *__esi + _t25;
				_push(_t25);
				 *_t39 =  *_t39 + 0x62;
				_t68 =  *_t39;
				if(_t68 < 0) {
					L8:
					 *_t25 =  *_t25 + _t25;
					 *_t25 =  *_t25 + _t25;
					goto L9;
				} else {
					asm("insb");
					if(_t68 >= 0) {
						L9:
						 *((intOrPtr*)(_t56 - 0x52ffff96)) =  *((intOrPtr*)(_t56 - 0x52ffff96)) + _t32;
						_push(0x12000000);
						goto L10;
					} else {
						if(_t68 < 0) {
							L10:
							 *((intOrPtr*)(_t48 + 0x56)) =  *((intOrPtr*)(_t48 + 0x56)) + _t39;
							_push(_t45);
							_push(_t32);
							_push(_t45);
							_t41 = _t39 + 1 - 1;
							_t63 = _t63 + 2;
							_push(_t45);
							 *0x53000d01 =  *0x53000d01 + _t41;
							_push(_t25);
							_t56 = _t56 - 0xfffffffffffffffe;
							_t45 = _t45 + 1;
							_t66 = _t66 + 1 - 1;
							_t39 = _t41 + 1;
						} else {
							 *[gs:eax] =  *[gs:eax] + _t25;
							asm("les ebp, [ecx]");
							_push(cs);
							while(1) {
								_t31 = _t25 +  *_t25;
								 *_t31 =  *_t31 + _t31;
								_t32 = _t32 + _t32;
								asm("int3");
								 *_t31 =  *_t31 ^ _t31;
								_t25 = _t31 | 0x000000c4;
								if(_t25 >= 0) {
									goto L11;
								}
								asm("pushfd");
								asm("lodsb");
								asm("invalid");
								_t45 = 0xc4;
								_t39 = _t39 - 0x00000001 & _t48;
								if(_t39 <= 0) {
									continue;
								} else {
									asm("scasb");
									_pop(_t56);
									asm("wait");
									asm("fbld tword [esi-0x48ea14d7]");
									_t66 = _t66 - 1;
									_t25 = 0x6b;
									asm("adc bh, [edx]");
									asm("popfd");
									asm("lodsd");
									_t32 = _t32 + 0x00000001 ^  *(_t39 - 0x48ee309a);
									asm("cdq");
									asm("iretw");
									asm("adc [edi+0xaa000c], esi");
									asm("pushad");
									asm("rcl dword [ebx], cl");
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									 *0x6b =  *0x6b + 0x6b;
									goto L8;
								}
								goto L11;
							}
						}
					}
				}
				L11:
				_push(_t32);
				_push(_t66);
				_t42 = _t39 - 1;
				_t33 = _t32 + 1;
				 *_t42 =  *_t42 + _t33;
				 *_t25 =  *_t25 + _t25;
				_t46 = _t45 + 1;
				 *_t46 =  *_t46 + _t25;
				 *_t33 =  *_t33 + _t66;
				_push(0x746c0000);
				 *_t25 =  *_t25 + _t25;
				_push(0);
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 | _t25;
				asm("adc [eax], dl");
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 | _t25;
				_push(0x86000005);
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t46;
				asm("adc [eax], al");
				 *_t42 =  *_t42 + _t25;
				 *_t25 =  *_t25 + _t25;
				 *((intOrPtr*)(_t25 + 4)) =  *((intOrPtr*)(_t25 + 4)) + _t42;
				 *_t25 =  *_t25 + _t25;
				asm("out dx, al");
				_t26 = _t25 + 0x18180000;
				 *_t26 =  *_t26 + _t26;
				 *_t26 =  *_t26 + _t26;
				 *_t26 =  *_t26 | _t26;
				asm("enter 0x6, 0x0");
				_push(_t56 - 1 + 1);
				_t27 = _t26 |  *_t26;
				 *_t27 =  *_t27 + _t33;
				asm("sbb [eax], al");
				 *_t42 =  *_t42 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *((intOrPtr*)(_t27 + 0x1e000009)) =  *((intOrPtr*)(_t27 + 0x1e000009)) + _t42;
				asm("adc [eax], eax");
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 & _t27;
				 *_t42 =  *_t42 + _t27;
				 *_t27 =  *_t27 + _t42;
				 *((intOrPtr*)(_t27 - 0x59fffff8)) =  *((intOrPtr*)(_t27 - 0x59fffff8)) + _t42;
				asm("sbb al, [eax]");
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 & _t27;
				 *_t42 =  *_t42 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *((intOrPtr*)(_t27 + 0x4e000010)) =  *((intOrPtr*)(_t27 + 0x4e000010)) + _t42;
				_t28 = _t27 &  *_t27;
				 *_t28 =  *_t28 + _t46;
				 *_t28 =  *_t28 ^ _t28;
				 *_t42 =  *_t42 + _t28;
				 *_t28 =  *_t28 + _t42;
				 *((intOrPtr*)(_t28 - 0x9fffff2)) =  *((intOrPtr*)(_t28 - 0x9fffff2)) + _t42;
				_t29 = _t28 ^  *_t28;
				 *_t29 =  *_t29 + _t46;
				 *_t29 =  *_t29 ^ _t29;
				 *_t42 =  *_t42 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *((intOrPtr*)(_t29 - 0x61ffffdb)) =  *((intOrPtr*)(_t29 - 0x61ffffdb)) + _t42;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 - _t29;
				 *_t29 =  *_t29 + _t29;
				asm("adc [eax], al");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 & _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 | _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				_t30 = _t29 + 1;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				asm("invalid");
				 *((intOrPtr*)(_t33 + _t33)) =  *((intOrPtr*)(_t33 + _t33)) + _t30;
				 *_t30 =  *_t30 + 1;
				asm("a16 scasb");
				return _t30;
			}

0x00401944
0x00401944
0x00401944
0x00401944
0x00401949
0x0040194e
0x00401950
0x00401952
0x00401954
0x00401956
0x00401958
0x00401959
0x0040195b
0x0040195d
0x00401961
0x00401962
0x00401965
0x00401967
0x0040196a
0x00401970
0x00401972
0x00401974
0x00401976
0x00401978
0x0040197a
0x0040197b
0x0040197d
0x0040197e
0x0040197e
0x00401981
0x004019e9
0x004019e9
0x004019eb
0x00000000
0x00401984
0x00401984
0x00401985
0x004019ec
0x004019ec
0x004019f2
0x00000000
0x00401987
0x00401987
0x004019f7
0x004019f7
0x004019fb
0x00401a00
0x00401a02
0x00401a05
0x00401a08
0x00401a09
0x00401a0a
0x00401a10
0x00401a12
0x00401a15
0x00401a16
0x00401a17
0x00401989
0x00401989
0x0040198c
0x0040198e
0x0040198f
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401996
0x00401998
0x0040199a
0x00000000
0x00000000
0x0040199c
0x0040199d
0x0040199e
0x004019a1
0x004019a3
0x004019a5
0x00000000
0x004019a7
0x004019a7
0x004019a8
0x004019a9
0x004019aa
0x004019b0
0x004019b1
0x004019b3
0x004019b6
0x004019bb
0x004019bc
0x004019bd
0x004019be
0x004019c0
0x004019c6
0x004019c7
0x004019cd
0x004019cf
0x004019d1
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019e1
0x004019e3
0x004019e5
0x004019e7
0x00000000
0x004019e7
0x00000000
0x004019a5
0x0040198f
0x00401987
0x00401985
0x00401a18
0x00401a18
0x00401a19
0x00401a1a
0x00401a1b
0x00401a1c
0x00401a1e
0x00401a20
0x00401a21
0x00401a23
0x00401a26
0x00401a2b
0x00401a2e
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a44
0x00401a46
0x00401a48
0x00401a4a
0x00401a4c
0x00401a4e
0x00401a51
0x00401a53
0x00401a54
0x00401a59
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a63
0x00401a64
0x00401a66
0x00401a68
0x00401a6a
0x00401a6c
0x00401a6e
0x00401a74
0x00401a76
0x00401a78
0x00401a7a
0x00401a7c
0x00401a7e
0x00401a84
0x00401a86
0x00401a88
0x00401a8a
0x00401a8c
0x00401a8e
0x00401a94
0x00401a96
0x00401a98
0x00401a9a
0x00401a9c
0x00401a9e
0x00401aa4
0x00401aa6
0x00401aa8
0x00401aaa
0x00401aac
0x00401aae
0x00401ab5
0x00401ab7
0x00401ab9
0x00401abb
0x00401abd
0x00401abf
0x00401ac1
0x00401ac3
0x00401ac5
0x00401ac7
0x00401ac9
0x00401acb
0x00401acc
0x00401ace
0x00401ad0
0x00401ad2
0x00401ad4
0x00401ad6
0x00401ad8
0x00401ada
0x00401adc
0x00401ade
0x00401ae0
0x00401ae4
0x00401ae6
0x00401aed
0x00401aef
0x00401af1

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401949

Strings

VB5!6&*, xrefs: 00401944

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 49eda9988085b2c0d92c1db57d33f6987569df7de6b7888ac88843bf5002f541
Instruction ID: 91babe460517667bceb3096b77b6d23548d5d38539658dc8f7a893e3b9818c0e
Opcode Fuzzy Hash: 49eda9988085b2c0d92c1db57d33f6987569df7de6b7888ac88843bf5002f541
Instruction Fuzzy Hash: 255173A148E7C06FD34397709C2AA923FB49E53229B1A46DBC0C2DF4B3E1580C5AC776

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042AC90, Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0042ACEB
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042AD04
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042AD23
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000218), ref: 0042AD42
__vbaFreeObj.MSVBVM60 ref: 0042AD4B
__vbaStrCopy.MSVBVM60 ref: 0042AD59
#524.MSVBVM60(?,?), ref: 0042AD74
__vbaVarTstNe.MSVBVM60(?,?), ref: 0042AD90
__vbaFreeVar.MSVBVM60 ref: 0042AD9C
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042ADBE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042ADD7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000148), ref: 0042ADFA
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0042AE0A
__vbaStrVarMove.MSVBVM60(00000000), ref: 0042AE14
__vbaStrMove.MSVBVM60 ref: 0042AE1F
#531.MSVBVM60(00000000), ref: 0042AE26
__vbaFreeStr.MSVBVM60 ref: 0042AE2F
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042AE3F
__vbaFreeVar.MSVBVM60 ref: 0042AE4B
#709.MSVBVM60(ABC,00409944,000000FF,00000000), ref: 0042AE5E
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042AE7F
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000004C), ref: 0042AEA4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409994,0000001C), ref: 0042AEEE
__vbaObjSet.MSVBVM60(?,?), ref: 0042AF03
__vbaFreeObj.MSVBVM60 ref: 0042AF0C
__vbaFreeStr.MSVBVM60(0042AF60), ref: 0042AF4F
__vbaFreeObj.MSVBVM60 ref: 0042AF54
__vbaFreeStr.MSVBVM60 ref: 0042AF5D

Strings

ABC, xrefs: 0042AE59

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$CopyMove$#524#531#709CallLateList
String ID: ABC
API String ID: 1356135559-2743272264
Opcode ID: 4402aa67ae52609cd76e0a28bc0f930c41db4765ca7df24a4c469628892f9cb1
Instruction ID: 019fa39903f28019cc1a476a41a1802a4c54f4f6bf8582c91c61d3c19f127ddf
Opcode Fuzzy Hash: 4402aa67ae52609cd76e0a28bc0f930c41db4765ca7df24a4c469628892f9cb1
Instruction Fuzzy Hash: 7B813C71D002099BCB04DFA5D988EDEBBB8FF58304F10812AE516B72B0DB749945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0042B1B0, Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0042B217
__vbaStrCopy.MSVBVM60 ref: 0042B21F
#646.MSVBVM60(?), ref: 0042B233
__vbaStrMove.MSVBVM60 ref: 0042B23E
__vbaStrCmp.MSVBVM60(goglet,00000000), ref: 0042B24A
__vbaFreeStr.MSVBVM60 ref: 0042B25C
__vbaFreeVar.MSVBVM60 ref: 0042B265
__vbaHresultCheckObj.MSVBVM60(00000000,?,004095E0,00000160), ref: 0042B296
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042B2AE
__vbaObjSet.MSVBVM60(?,?,Friturekurvens8), ref: 0042B2CC
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000040), ref: 0042B2E6
__vbaFreeObj.MSVBVM60 ref: 0042B2EF
#660.MSVBVM60(?,0000000A,?,00000001,00000001), ref: 0042B322
__vbaVarTstNe.MSVBVM60(?,?), ref: 0042B343
__vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?), ref: 0042B35A
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B37F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B398
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409AE8,000000E8), ref: 0042B3C2
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042B3DA
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000034,?,?,?,?), ref: 0042B426
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 0042B437
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0042B440
__vbaFreeStr.MSVBVM60(0042B4A3), ref: 0042B492
__vbaFreeStr.MSVBVM60 ref: 0042B497
__vbaFreeObj.MSVBVM60 ref: 0042B49C

Strings

Friturekurvens8, xrefs: 0042B2BD
goglet, xrefs: 0042B245
s, xrefs: 0042B446

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$Copy$#646#660ListMove
String ID: Friturekurvens8$goglet$s
API String ID: 1853211704-556132612
Opcode ID: bf65de5dd9fe6949bb4f581fec849fe0bbfa160f7676709f708f0f64e1082751
Instruction ID: bf9f8ab7a2f5857480c09b3296be6fb03b9b97a34af5382506ca136ba3c370f0
Opcode Fuzzy Hash: bf65de5dd9fe6949bb4f581fec849fe0bbfa160f7676709f708f0f64e1082751
Instruction Fuzzy Hash: F3815DB1E00218DBCB14DF95DD88ADEBBB8FF58700F10801AE516B72A1D7745945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004237C0, Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00409A28,00000005), ref: 0042382F
#517.MSVBVM60(004099E0), ref: 0042383A
__vbaStrMove.MSVBVM60 ref: 00423845
__vbaStrCmp.MSVBVM60(004099E8,00000000), ref: 00423851
__vbaFreeStr.MSVBVM60 ref: 00423864
#685.MSVBVM60 ref: 00423873
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423884
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 004238BD
__vbaObjSet.MSVBVM60(?,00000000), ref: 004238D6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001D8), ref: 004238FC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004099EC,00000044), ref: 0042392F
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042393F
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 00423957
#682.MSVBVM60(?,?), ref: 004239A1
__vbaFpR8.MSVBVM60 ref: 004239A7
__vbaFreeVar.MSVBVM60 ref: 004239C6
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 004239E9
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000001C), ref: 00423A0E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004099C4,00000060), ref: 00423A5B
__vbaFreeObj.MSVBVM60 ref: 00423A64
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423A7D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423A96
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000108), ref: 00423AC0
__vbaFreeObj.MSVBVM60 ref: 00423AD2
__vbaAryDestruct.MSVBVM60(00000000,?,00423B2E), ref: 00423B27

Strings

Lupanar, xrefs: 00423A3C

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$List$#517#682#685Construct2DestructMove
String ID: Lupanar
API String ID: 1762197567-3217326196
Opcode ID: 7cdf8f706f59b0e4631993192e1dc9367a281487de0b6dfa5ac4e8c37e419777
Instruction ID: 6919a7ced6d8492ad7f433be0b2f01ba77bf40c0d1d1f1b8092efad30218e59f
Opcode Fuzzy Hash: 7cdf8f706f59b0e4631993192e1dc9367a281487de0b6dfa5ac4e8c37e419777
Instruction Fuzzy Hash: 24A14CB1A00218AFCB14DF94DD88EDEBBB8FB08701F50416EE545B72A1DB745985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00429B60, Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00429BD3
__vbaStrCopy.MSVBVM60 ref: 00429BDD
#523.MSVBVM60(?), ref: 00429BE3
__vbaStrMove.MSVBVM60 ref: 00429BEE
__vbaStrCmp.MSVBVM60(004096FC,00000000), ref: 00429BFA
__vbaFreeStr.MSVBVM60 ref: 00429C0D
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00429C2E
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000004C), ref: 00429C53
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409994,0000001C), ref: 00429CA1
__vbaObjSet.MSVBVM60(?,?), ref: 00429CB2
__vbaFreeObj.MSVBVM60 ref: 00429CBB
#711.MSVBVM60(?,00409D90,?,000000FF,00000000), ref: 00429CDF
__vbaAryVar.MSVBVM60(00002008,?), ref: 00429CEE
__vbaAryCopy.MSVBVM60(?,?), ref: 00429D05
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 00429D15
__vbaGenerateBoundsError.MSVBVM60 ref: 00429D37
__vbaGenerateBoundsError.MSVBVM60 ref: 00429D49
__vbaStrCmp.MSVBVM60(004099E8,00000000), ref: 00429D5E
__vbaLateMemCall.MSVBVM60(?,A9IWnV6OU8nxkkGgvYnrokBiEqWu46,00000002), ref: 00429DB3
__vbaFreeObj.MSVBVM60(00429E1D), ref: 00429DF9
__vbaFreeObj.MSVBVM60 ref: 00429DFE
__vbaFreeStr.MSVBVM60 ref: 00429E09
__vbaFreeStr.MSVBVM60 ref: 00429E0E
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00429E16

Strings

OVOVIVIPARISM, xrefs: 00429D7A
A9IWnV6OU8nxkkGgvYnrokBiEqWu46, xrefs: 00429DAA

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$Copy$BoundsCheckErrorGenerateHresult$#523#711CallDestructLateListMoveNew2
String ID: A9IWnV6OU8nxkkGgvYnrokBiEqWu46$OVOVIVIPARISM
API String ID: 1438792996-4169294878
Opcode ID: 63789d63c8acf54cf6b6b09270433d521245be547650567a70934f85d16422f9
Instruction ID: c2338e75e0db7d90ff4dbfe4fdf3377c01d2bc52383e6d45243d624f8c4f2cc0
Opcode Fuzzy Hash: 63789d63c8acf54cf6b6b09270433d521245be547650567a70934f85d16422f9
Instruction Fuzzy Hash: F7810AB1E002189FCB14DFA9DA85AEDBBB8FF48700F20816AE505B72A1D7746D45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00423B60, Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60 ref: 00423BB7
#547.MSVBVM60(?,?), ref: 00423BC5
__vbaVarTstNe.MSVBVM60(?,?), ref: 00423BE1
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00423BF4
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00423C18
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000001C), ref: 00423C3D
__vbaCastObj.MSVBVM60(?,00409A58), ref: 00423C74
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423C85
__vbaHresultCheckObj.MSVBVM60(00000000,?,004099C4,00000058), ref: 00423C9B
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00423CAB
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423CD1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423CEA
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423D0F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423D28
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,000000A0), ref: 00423D4B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 00423D8C
__vbaFreeStr.MSVBVM60 ref: 00423D95
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00423DA5
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423DC1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423DDA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 00423E24
__vbaFreeObj.MSVBVM60 ref: 00423E2D
__vbaFreeObj.MSVBVM60(00423E7C), ref: 00423E75

Strings

12:12:12, xrefs: 00423BA9
Sorgers, xrefs: 00423E03

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$List$#547Cast
String ID: 12:12:12$Sorgers
API String ID: 1739637979-3902600086
Opcode ID: 7e320e61fa50c169369a9d2cffdc19d4d4a738bbe20561f2f5652bc8f8c09cb6
Instruction ID: 1107faa603f927594049e00d2eb2bb7a484343d29e13ec7b35f34450520a4ada
Opcode Fuzzy Hash: 7e320e61fa50c169369a9d2cffdc19d4d4a738bbe20561f2f5652bc8f8c09cb6
Instruction Fuzzy Hash: C1915CB1A003099FCB04DFA5D948EDEBBB8FF48705F20452AE545B72A1D7789A05CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00424310, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#521.MSVBVM60(00409894), ref: 00424367
__vbaStrMove.MSVBVM60 ref: 00424372
__vbaStrCmp.MSVBVM60(004098A0,00000000), ref: 0042437E
__vbaFreeStr.MSVBVM60 ref: 00424391
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 004243B3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004243CC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000170), ref: 004243F3
__vbaLateMemCall.MSVBVM60(?,MsjfpH140,00000002), ref: 0042444B
__vbaFreeObj.MSVBVM60 ref: 00424457
__vbaFreeVar.MSVBVM60 ref: 00424460
#610.MSVBVM60(?), ref: 00424470
__vbaStrVarVal.MSVBVM60(?,?), ref: 0042447A
#540.MSVBVM60(?,00000000), ref: 00424485
#610.MSVBVM60(?), ref: 0042448F
__vbaVarTstNe.MSVBVM60(?,?), ref: 00424499
__vbaFreeStr.MSVBVM60 ref: 004244A5
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 004244B9
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 004244DD
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000004C), ref: 00424502
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409994,0000001C,?,?,?,?), ref: 00424550
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00424561
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0042456A
__vbaFreeObj.MSVBVM60(004245BD), ref: 004245B5
__vbaFreeObj.MSVBVM60 ref: 004245BA

Strings

MsjfpH140, xrefs: 0042443F

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$#610New2$#521#540CallLateListMove
String ID: MsjfpH140
API String ID: 878090992-88622464
Opcode ID: a7bda9d2ab3e0d83f62c3709be9e0feac5a60337a4b9359679c366c156215759
Instruction ID: d2a5e1b81b6901b3a38112d60fa1c7e121b6a8422199cb4e5bbd85aacf3e2d93
Opcode Fuzzy Hash: a7bda9d2ab3e0d83f62c3709be9e0feac5a60337a4b9359679c366c156215759
Instruction Fuzzy Hash: 6C813FB1D00219DFCB14DFA4DA84AEEBBF8FF48700F10816AE545B7264D6786A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00429880, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 004298EA
__vbaStrCopy.MSVBVM60 ref: 004298F2
#594.MSVBVM60(?), ref: 00429906
__vbaFreeVar.MSVBVM60 ref: 0042990F
__vbaVarDup.MSVBVM60 ref: 00429929
#543.MSVBVM60(?,0000000A), ref: 00429937
__vbaVarTstNe.MSVBVM60(?,?), ref: 00429953
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 00429966
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042998A
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000001C), ref: 004299AF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004099C4,0000005C,?,?,?,?), ref: 00429A03
__vbaStrMove.MSVBVM60(?,?,?,?), ref: 00429A12
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00429A1B
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00429A34
__vbaObjSet.MSVBVM60(?,00000000), ref: 00429A53
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,000001C4), ref: 00429A72
__vbaFreeObj.MSVBVM60 ref: 00429A7B
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00429A94
__vbaObjSet.MSVBVM60(?,00000000), ref: 00429AAD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000000D8), ref: 00429AD0
__vbaFreeObj.MSVBVM60 ref: 00429ADF
__vbaFreeStr.MSVBVM60(00429B2C), ref: 00429B1F
__vbaFreeStr.MSVBVM60 ref: 00429B24
__vbaFreeStr.MSVBVM60 ref: 00429B29

Strings

18:18:18, xrefs: 0042991B

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$Copy$#543#594ListMove
String ID: 18:18:18
API String ID: 1461875154-2086002022
Opcode ID: 8e406b39bc9f3d78433d19acf88d2b60d36146bc365a2dba7c4bae9ac5ff6c2a
Instruction ID: 9c31e9c753143ea41fe9ac48934a9cf0c38919b3a719b6a4ee4b6fbbff310328
Opcode Fuzzy Hash: 8e406b39bc9f3d78433d19acf88d2b60d36146bc365a2dba7c4bae9ac5ff6c2a
Instruction Fuzzy Hash: 1A81EBB1E002199FCB14DFA5D988EDEBBB8FB4C704F10802AE515B72A0DB745945CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00423EA0, Relevance: 40.8, APIs: 27, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423F1D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423F3C
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423F61
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423F7A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,000001B8), ref: 00423F9D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00423FCB
__vbaStrVarMove.MSVBVM60(00000000), ref: 00423FD5
__vbaStrMove.MSVBVM60 ref: 00423FE0
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 00424000
__vbaFreeStr.MSVBVM60 ref: 00424009
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0042401D
__vbaFreeVar.MSVBVM60 ref: 0042402F
__vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000), ref: 00424042
__vbaVarMove.MSVBVM60 ref: 0042406F
__vbaVarMove.MSVBVM60 ref: 0042409B
__vbaVarMove.MSVBVM60 ref: 004240B8
__vbaVarMove.MSVBVM60 ref: 004240E1
#665.MSVBVM60(?,3F800000,?), ref: 004240F0
__vbaErase.MSVBVM60(00000000,?), ref: 004240FC
__vbaVarTstNe.MSVBVM60(00008002,?), ref: 0042411D
__vbaFreeVar.MSVBVM60 ref: 00424129
__vbaFpI4.MSVBVM60 ref: 0042413B
__vbaHresultCheckObj.MSVBVM60(00000000,00401270,004095E0,00000064), ref: 0042415B
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00424178
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 0042419D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000078), ref: 004241C0
__vbaFreeObj.MSVBVM60 ref: 004241C5

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Move$CheckFreeHresult$New2$#665CallEraseLateListRedim
String ID:
API String ID: 3732751907-0
Opcode ID: 6931b81dc6296275856ad9d8656f347a2926c25dd5a789418d9c3a7316947dcc
Instruction ID: 1a36d92ee96962d438fd72feedd016aa527698249dcf8a02f9326689a93b09b9
Opcode Fuzzy Hash: 6931b81dc6296275856ad9d8656f347a2926c25dd5a789418d9c3a7316947dcc
Instruction Fuzzy Hash: 60A14B71E00218AFDB14DFA9DD48EAEBBB8FF58300F10815AE506B7261D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00429E40, Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00429E92
#594.MSVBVM60(?), ref: 00429EAA
__vbaFreeVar.MSVBVM60 ref: 00429EB3
__vbaVarDup.MSVBVM60 ref: 00429ECD
#543.MSVBVM60(?,0000000A), ref: 00429EDB
__vbaVarTstNe.MSVBVM60(?,?), ref: 00429EF7
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 00429F0A
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00429F2E
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000001C), ref: 00429F53
__vbaHresultCheckObj.MSVBVM60(00000000,?,004099C4,0000005C,?,?,?,?), ref: 00429F9F
__vbaStrMove.MSVBVM60(?,?,?,?), ref: 00429FAE
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00429FB7
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00429FD0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00429FEF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,0000020C), ref: 0042A00E
__vbaFreeObj.MSVBVM60 ref: 0042A017
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A030
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A049
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000190), ref: 0042A06C
__vbaFreeObj.MSVBVM60 ref: 0042A07B
__vbaFreeStr.MSVBVM60(0042A0C3), ref: 0042A0BB
__vbaFreeStr.MSVBVM60 ref: 0042A0C0

Strings

18:18:18, xrefs: 00429EBF

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$#543#594CopyListMove
String ID: 18:18:18
API String ID: 591326717-2086002022
Opcode ID: 43acfb3afcf2742f82e8c2d921190aa7295acc4979548707f980f13c2fb6515c
Instruction ID: 7c1f7619c0a0d873a8bfee80a1bcd62021c347000abb2f3199390cb1b37cc23b
Opcode Fuzzy Hash: 43acfb3afcf2742f82e8c2d921190aa7295acc4979548707f980f13c2fb6515c
Instruction Fuzzy Hash: DA714EB1E002099FCB14DFA5DA88EDEBBB8FF48304F20452AE505B72A1D7745A45CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00423390, Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaInStr.MSVBVM60(00000000,00409944,ABC,00000002), ref: 004233EF
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00423410
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000004C), ref: 0042343B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409994,00000024), ref: 0042346D
__vbaStrMove.MSVBVM60 ref: 00423478
__vbaFreeObj.MSVBVM60 ref: 00423481
#598.MSVBVM60 ref: 0042348F
#670.MSVBVM60(?), ref: 00423499
__vbaVarTstEq.MSVBVM60(?,?), ref: 004234B5
__vbaFreeVar.MSVBVM60 ref: 004234C1
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 004234DE
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000001C), ref: 00423503
__vbaHresultCheckObj.MSVBVM60(00000000,?,004099C4,00000064), ref: 00423525
__vbaFreeObj.MSVBVM60 ref: 0042352A
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423543
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042355C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098C8,00000078), ref: 0042357D
__vbaFreeObj.MSVBVM60 ref: 00423588
__vbaFreeStr.MSVBVM60(004235C6), ref: 004235BF

Strings

CIVILARBEJDERNE, xrefs: 0042344E
Trafikfarligeres7, xrefs: 00423453
ABC, xrefs: 004233C9
vinterstvler, xrefs: 004234A7

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresult$New2$#598#670Move
String ID: ABC$CIVILARBEJDERNE$Trafikfarligeres7$vinterstvler
API String ID: 1029844685-2426219459
Opcode ID: 1700827b7520ed638ee4999568400f7ef2899d7e42215344419fb930d7f41e94
Instruction ID: a90eb44c8bf46a3c4d8b18ad8917b7d15d01cff0ec85c01d5deb78bcb31b5541
Opcode Fuzzy Hash: 1700827b7520ed638ee4999568400f7ef2899d7e42215344419fb930d7f41e94
Instruction Fuzzy Hash: CB5151B1A00219ABCB10EF95DD88EDEBBB8FF08705F50442AE505B72A1D7789985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042A2F0, Relevance: 39.2, APIs: 26, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00409E04,00000008), ref: 0042A34D
#708.MSVBVM60(?,?,004096FC,000000FF,00000000), ref: 0042A376
__vbaAryVar.MSVBVM60(00002008,?), ref: 0042A385
__vbaAryCopy.MSVBVM60(?,?), ref: 0042A396
__vbaFreeVar.MSVBVM60 ref: 0042A39F
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A3B8
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A3D7
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A3FC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A415
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000150), ref: 0042A438
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042A479
__vbaFreeStr.MSVBVM60 ref: 0042A482
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042A492
__vbaR8Str.MSVBVM60(00409DFC), ref: 0042A4A0
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A4CA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A4E3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000108), ref: 0042A50A
#600.MSVBVM60(?,00000002), ref: 0042A526
__vbaFreeObj.MSVBVM60 ref: 0042A531
__vbaFreeVar.MSVBVM60 ref: 0042A53A
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A553
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A56C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,000001A0), ref: 0042A593
__vbaFreeObj.MSVBVM60 ref: 0042A5A2
__vbaAryDestruct.MSVBVM60(00000000,?,0042A5F3), ref: 0042A5E9
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0042A5F0

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$Destruct$#600#708Construct2CopyList
String ID:
API String ID: 2289096559-0
Opcode ID: aefea1e797520f528af481961eba607ceb4d9d28586e1957f718d5b7c55e2817
Instruction ID: e96acbbacde2b42aac6d849f5387ecaf2f1bfaa04a3b58b6e3f3e403ee98fc94
Opcode Fuzzy Hash: aefea1e797520f528af481961eba607ceb4d9d28586e1957f718d5b7c55e2817
Instruction Fuzzy Hash: 08911B70A00218AFCB14DFA4DD88E9EBBB8FF48700F20852AE555B72A1DB745946CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042C0C0, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaVarDup.MSVBVM60 ref: 0042C123
#591.MSVBVM60(?), ref: 0042C12D
__vbaStrMove.MSVBVM60 ref: 0042C138
__vbaStrCmp.MSVBVM60(String,00000000), ref: 0042C144
__vbaFreeStr.MSVBVM60 ref: 0042C157
__vbaFreeVar.MSVBVM60 ref: 0042C160
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C182
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C1A1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001D0), ref: 0042C1C4
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042C1DC
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000034), ref: 0042C22D
__vbaObjSet.MSVBVM60(?,?), ref: 0042C23E
__vbaFreeObj.MSVBVM60 ref: 0042C243
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C264
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C27D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000000D8), ref: 0042C2A0
__vbaFreeObj.MSVBVM60 ref: 0042C2AF
__vbaFreeObj.MSVBVM60(0042C2EC), ref: 0042C2E5

Strings

Dietical, xrefs: 0042C115
String, xrefs: 0042C13F

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$#591Move
String ID: Dietical$String
API String ID: 1247683541-1333297720
Opcode ID: 829ba65b0ac7181a06c74d5a7ad7a7b1e33c015182c242c63929e931aa0a91a3
Instruction ID: e2719e67f41acf9731d276d0ad32b9f72c136bf66020234ce0d00883806fac9e
Opcode Fuzzy Hash: 829ba65b0ac7181a06c74d5a7ad7a7b1e33c015182c242c63929e931aa0a91a3
Instruction Fuzzy Hash: D0511BB1E00214DFCB14DFA4D988ADEBBB4BB0C704F54456AE546F7260DB345946CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00423150, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 00423199
#615.MSVBVM60 ref: 0042319F
#572.MSVBVM60(?), ref: 004231B7
__vbaStrMove.MSVBVM60 ref: 004231C2
__vbaStrCmp.MSVBVM60(004098EC,00000000), ref: 004231CE
__vbaFreeStr.MSVBVM60 ref: 004231E1
__vbaFreeVar.MSVBVM60 ref: 004231EA
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042320C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423225
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000108), ref: 0042324C
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00423264
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000038,?,?,?,?,?), ref: 004232D0
__vbaVar2Vec.MSVBVM60(?,?,?,?,?,?,?), ref: 004232DE
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,?), ref: 004232EC
__vbaFreeObj.MSVBVM60(?,?,?,?,?), ref: 004232F5
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,?,?,?,?,?), ref: 00423305
__vbaAryDestruct.MSVBVM60(00000000,?,00423365), ref: 00423355
__vbaFreeStr.MSVBVM60 ref: 0042335E

Strings

37K, xrefs: 0042330E
K, xrefs: 004231A9

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultMoveNew2$#572#615CopyDestructListVar2
String ID: K$37K
API String ID: 2097586051-3885948781
Opcode ID: 175de24e89d600b7d9321dd89c514243c73e6f19de87cbb514bf8595f21f5245
Instruction ID: d1201d3794426a9c721f4b7469a9998aa619a47a8f623e5e69e74982762e368b
Opcode Fuzzy Hash: 175de24e89d600b7d9321dd89c514243c73e6f19de87cbb514bf8595f21f5245
Instruction Fuzzy Hash: 6E514B71D002089FCB04DFA4DA88ADEBBF8FF58701F10806AE546B7260DB745946CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004245E0, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424633
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042464C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042469A
__vbaFreeObj.MSVBVM60 ref: 004246A3
__vbaStrCopy.MSVBVM60 ref: 004246B1
#619.MSVBVM60(?,?,00000001), ref: 004246CE
__vbaVarTstNe.MSVBVM60(?,?), ref: 004246EA
__vbaFreeVar.MSVBVM60 ref: 004246FC
__vbaVarDup.MSVBVM60 ref: 00424717
#667.MSVBVM60(?), ref: 00424721
__vbaStrMove.MSVBVM60 ref: 0042472C
__vbaFreeVar.MSVBVM60 ref: 00424735
#589.MSVBVM60(00000001), ref: 00424739
__vbaHresultCheckObj.MSVBVM60(00000000,?,004095E0,00000084), ref: 0042477A

Strings

var, xrefs: 004246A9
EGNETHEDERNES, xrefs: 00424709
Dosers9, xrefs: 00424679

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$#589#619#667CopyMoveNew2
String ID: Dosers9$EGNETHEDERNES$var
API String ID: 2589535015-2811488698
Opcode ID: 36b1d96c5fa19d7a7f522ad137d06dd88625373c1965ca87e464454d5e1572b9
Instruction ID: 54af31cc7f7bbb9681bd49f02a48856f2db9d806f7ff97e98bc4ec8b44291fe0
Opcode Fuzzy Hash: 36b1d96c5fa19d7a7f522ad137d06dd88625373c1965ca87e464454d5e1572b9
Instruction Fuzzy Hash: 22516E71D002499FCB04DFA4D988ADEBBB8FF48700F50842AE155B72A0DB785906CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042A0F0, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0042A142
#648.MSVBVM60(?), ref: 0042A15A
__vbaFreeVar.MSVBVM60 ref: 0042A163
#521.MSVBVM60(00409894), ref: 0042A16E
__vbaStrMove.MSVBVM60 ref: 0042A179
__vbaStrCmp.MSVBVM60(004098A0,00000000), ref: 0042A185
__vbaFreeStr.MSVBVM60 ref: 0042A198
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042A1B5
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000034), ref: 0042A1FF
__vbaObjSet.MSVBVM60(?,?), ref: 0042A210
#606.MSVBVM60(00000001,0000000A), ref: 0042A22D
__vbaStrMove.MSVBVM60 ref: 0042A238
__vbaStrCmp.MSVBVM60(004099D8,00000000), ref: 0042A244
__vbaFreeStr.MSVBVM60 ref: 0042A257
__vbaFreeVar.MSVBVM60 ref: 0042A260
__vbaHresultCheckObj.MSVBVM60(00000000,004014E0,00409610,00000774), ref: 0042A284
__vbaFreeStr.MSVBVM60(0042A2C8), ref: 0042A2B8
__vbaFreeObj.MSVBVM60 ref: 0042A2C1

Strings

, xrefs: 0042A21F

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultMove$#521#606#648CopyNew2
String ID:
API String ID: 489329638-3916222277
Opcode ID: e08c80697a30fb5a137ebba682de15eb3add6a93e05079ea32386b54b9d7ff12
Instruction ID: f682ea340545ceb7c6ff4110244f091946a207170298ef879205030317eb7471
Opcode Fuzzy Hash: e08c80697a30fb5a137ebba682de15eb3add6a93e05079ea32386b54b9d7ff12
Instruction Fuzzy Hash: FC514E71E00218DFCB04DFA5EA89ADDBBB8EF48704F10812AF902B7261DB745945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0042B9E0, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

#616.MSVBVM60(00409B50,00000001), ref: 0042BA30
__vbaStrMove.MSVBVM60 ref: 0042BA3B
__vbaStrCmp.MSVBVM60(004099E0,00000000), ref: 0042BA47
__vbaFreeStr.MSVBVM60 ref: 0042BA5A
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042BA7C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042BA95
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000170), ref: 0042BABC
__vbaFpI4.MSVBVM60 ref: 0042BACA
__vbaHresultCheckObj.MSVBVM60(00000000,004015D0,004095E0,000002C8), ref: 0042BB05
__vbaFreeObj.MSVBVM60 ref: 0042BB0E
__vbaStrCopy.MSVBVM60 ref: 0042BB1C
#618.MSVBVM60(?,00000001), ref: 0042BB28
__vbaStrMove.MSVBVM60 ref: 0042BB33
__vbaStrCmp.MSVBVM60(00409AC4,00000000), ref: 0042BB3F
__vbaFreeStr.MSVBVM60 ref: 0042BB52
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000016,Kausalitets6), ref: 0042BB68
__vbaFreeStr.MSVBVM60(0042BBA1), ref: 0042BB9A

Strings

var, xrefs: 0042BB14
Kausalitets6, xrefs: 0042BB5D

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultMove$#616#618CopyFileNew2Open
String ID: Kausalitets6$var
API String ID: 1924590394-4254552659
Opcode ID: 7a33d5dd95cb64a87c6e263e7e384cfbb01136386483540541b45013638d7dcc
Instruction ID: a605319d66e035244b0b246057bedf3e00610c53080f728bf52674ca3f05bad5
Opcode Fuzzy Hash: 7a33d5dd95cb64a87c6e263e7e384cfbb01136386483540541b45013638d7dcc
Instruction Fuzzy Hash: 73416E71A00214AFCB14DFA5DE89EEE7BB4FB4C701F604129F602B72A0DB785945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00422E90, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 00422EE7
#522.MSVBVM60(?,?), ref: 00422EF1
__vbaVarTstNe.MSVBVM60(?,?), ref: 00422F0D
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00422F20
__vbaVarDup.MSVBVM60 ref: 00422F42
#667.MSVBVM60(?), ref: 00422F48
__vbaStrMove.MSVBVM60 ref: 00422F53
__vbaFreeVar.MSVBVM60 ref: 00422F5C
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00422F75
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422F94
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098C8,000001AC), ref: 00422FB3
__vbaFreeObj.MSVBVM60 ref: 00422FBC
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00422FD5
__vbaObjSet.MSVBVM60(?,00000000), ref: 00422FEE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,00000208), ref: 0042300D
__vbaFreeObj.MSVBVM60 ref: 00423016
__vbaFreeStr.MSVBVM60(0042305C), ref: 00423055

Strings

knopskydninger, xrefs: 00422F34

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$#522#667ListMove
String ID: knopskydninger
API String ID: 2357291029-3678261433
Opcode ID: 8099b4a92f6c3bb3c7ca72edbfa62cbe811e1630157bc9a811e0c16f4ee2326e
Instruction ID: 7ce3e391193b74bbe529d618f7eaf8ae1e3447217da33b1234a3cb3d16451c68
Opcode Fuzzy Hash: 8099b4a92f6c3bb3c7ca72edbfa62cbe811e1630157bc9a811e0c16f4ee2326e
Instruction Fuzzy Hash: 7B513F71900219AFCB10EF94DD88EDEBBB4FF48304F54452AE546B72A0DB785509CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042C320, Relevance: 30.2, APIs: 20, Instructions: 180COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0042C375
#648.MSVBVM60(?), ref: 0042C38D
__vbaFreeVar.MSVBVM60 ref: 0042C396
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042C3AE
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 0042C3D9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000068), ref: 0042C401
__vbaFreeObj.MSVBVM60 ref: 0042C406
#585.MSVBVM60(00000000,00000000), ref: 0042C40E
__vbaFpR8.MSVBVM60 ref: 0042C414
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042C43D
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,0000004C), ref: 0042C462
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409994,0000001C), ref: 0042C4AA
__vbaObjSet.MSVBVM60(?,?), ref: 0042C4BF
__vbaFreeObj.MSVBVM60 ref: 0042C4C8
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C4E1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C4FA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098C8,00000098), ref: 0042C521
__vbaFreeObj.MSVBVM60 ref: 0042C52C
__vbaFreeObj.MSVBVM60(0042C56A), ref: 0042C55A
__vbaFreeStr.MSVBVM60 ref: 0042C563

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$New2$#585#648Copy
String ID:
API String ID: 2998728405-0
Opcode ID: 22ca745c71eeb2b881b69787a2264ca01f5092ac47257d3e70715be1154ca94c
Instruction ID: 9676ccd656221aecd72159040b865acda7233f3cda480d56fa041aac84f7c0e9
Opcode Fuzzy Hash: 22ca745c71eeb2b881b69787a2264ca01f5092ac47257d3e70715be1154ca94c
Instruction Fuzzy Hash: 40614070A40214EFCB14EFA5DD88EEEBBB8FF58300B10842AE545B72A1D7785945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00424C80, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00424CD2
__vbaStrCopy.MSVBVM60 ref: 00424CDA
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00424CEE
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 00424D13
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,000000F8), ref: 00424D3D
__vbaStrMove.MSVBVM60 ref: 00424D4C
__vbaFreeObj.MSVBVM60 ref: 00424D55
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424D6E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424D87
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 00424DCF
__vbaFreeObj.MSVBVM60 ref: 00424DD8
__vbaFreeStr.MSVBVM60(00424E0E), ref: 00424E01
__vbaFreeStr.MSVBVM60 ref: 00424E06
__vbaFreeStr.MSVBVM60 ref: 00424E0B

Strings

tonto, xrefs: 00424DAE

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$CopyNew2$Move
String ID: tonto
API String ID: 438941495-2099408982
Opcode ID: 5217c4bdb4338c9f955b274f7fc716ad470978e43ff85793b45d7061401d4d47
Instruction ID: 55359be3be6b8e803d96e707b11de992b12b97a4944fe4b2401044cb0a14b12d
Opcode Fuzzy Hash: 5217c4bdb4338c9f955b274f7fc716ad470978e43ff85793b45d7061401d4d47
Instruction Fuzzy Hash: 66414071A402199BCB04DF94DD88EEEBBB8FF58310F24406AE505B72A0D6749946CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042C5A0, Relevance: 25.7, APIs: 17, Instructions: 183COMMON

Download Yara Rule

APIs

#582.MSVBVM60(00000000,00000000), ref: 0042C5E5
__vbaFpR8.MSVBVM60 ref: 0042C5EB
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C615
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C634
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000170), ref: 0042C657
_adj_fdiv_m64.MSVBVM60 ref: 0042C682
__vbaFpI4.MSVBVM60(43680000,?,42AA0000), ref: 0042C6AB
__vbaHresultCheckObj.MSVBVM60(00000000,00401648,004095E0,000002C0,?,42AA0000), ref: 0042C6E4
__vbaFreeObj.MSVBVM60(?,42AA0000), ref: 0042C6ED
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C710
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C729
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C740
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C759
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,000000A0), ref: 0042C77C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042C7C1
__vbaFreeStr.MSVBVM60 ref: 0042C7CA
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042C7DA

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$FreeNew2$#582List_adj_fdiv_m64
String ID:
API String ID: 25449687-0
Opcode ID: d32d748b53c073754340d1078c4bbdc3154bd3002759f355d0aa047c84dadca7
Instruction ID: fb38c3a175f24e2632e1c2ed2341aabfcd3b76836387b09b199066fb8c7a76cd
Opcode Fuzzy Hash: d32d748b53c073754340d1078c4bbdc3154bd3002759f355d0aa047c84dadca7
Instruction Fuzzy Hash: C5618170A00215EFD7109FA4DD88FAE7BB8FF48704F60452AF582B72A1D7789846CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCE0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042BD42
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042BD5B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042BDA9
__vbaFreeObj.MSVBVM60 ref: 0042BDB6
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042BDCE
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 0042BDF3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000118), ref: 0042BE19
__vbaI2I4.MSVBVM60 ref: 0042BE1E
__vbaFreeObj.MSVBVM60 ref: 0042BE27
#714.MSVBVM60(?,?,00000000), ref: 0042BE4B
__vbaVarTstNe.MSVBVM60(?,?), ref: 0042BE67
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 0042BE7A
__vbaHresultCheckObj.MSVBVM60(00000000,004015F8,004095E0,00000254), ref: 0042BEAB

Strings

carpeted, xrefs: 0042BD82

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$Free$New2$#714List
String ID: carpeted
API String ID: 1235898942-2766835323
Opcode ID: 7d739858955d139dd4a87985c9a61684394b548bb457fff63962ac4439ee48cc
Instruction ID: 3c0ac12688a538c942c2c274a0d41e2aedec4cff09574dc8e3d15c097ce95fcb
Opcode Fuzzy Hash: 7d739858955d139dd4a87985c9a61684394b548bb457fff63962ac4439ee48cc
Instruction Fuzzy Hash: 75515E71A00214AFCB14DFA5DD89EDEBBF8EF48704F20442AE545BB2A1C7745945CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00424A40, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00424A8C
__vbaStrCopy.MSVBVM60 ref: 00424A94
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 00424AA8
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 00424ACD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000078), ref: 00424AF1
__vbaFreeObj.MSVBVM60 ref: 00424AFA
__vbaI4Str.MSVBVM60(00409AFC), ref: 00424B05
#608.MSVBVM60(?,00000000), ref: 00424B10
__vbaVarTstNe.MSVBVM60(?,?), ref: 00424B2C
__vbaFreeVar.MSVBVM60 ref: 00424B37
#531.MSVBVM60(Barskabene8), ref: 00424B47
__vbaFreeStr.MSVBVM60(00424B82), ref: 00424B7A
__vbaFreeStr.MSVBVM60 ref: 00424B7F

Strings

Barskabene8, xrefs: 00424B42

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckCopyHresult$#531#608New2
String ID: Barskabene8
API String ID: 2409260331-4041090310
Opcode ID: 16cd285cfd341211ee824fbd38e900ee1f863bc2f3de95babac7042dcdc2a990
Instruction ID: 60e4142825ba30a3d9ae12e8b862b467bacf902e897faee41db2e784573b17d3
Opcode Fuzzy Hash: 16cd285cfd341211ee824fbd38e900ee1f863bc2f3de95babac7042dcdc2a990
Instruction Fuzzy Hash: 03312F71D40229ABCB04DF94EE49DEEBBB8FF58700F10412AE501B72A4D7786945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004247D0, Relevance: 22.7, APIs: 15, Instructions: 185COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424817
__vbaObjSet.MSVBVM60(?,00000000), ref: 00424836
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001D8), ref: 00424859
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424872
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042488B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409AE8,00000178), ref: 00424918
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00424928
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424944
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042495D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001FC), ref: 0042499D
__vbaFreeObj.MSVBVM60 ref: 004249AC
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 004249C1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004249DA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,000001C4), ref: 004249FD
__vbaFreeObj.MSVBVM60 ref: 00424A06

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID:
API String ID: 191279167-0
Opcode ID: f434106a84bc1868dc0456c608dee49db77b063845e3964e2cebe5aa2a93c3c1
Instruction ID: e3309b57b821bd3151292ee1f491d7f4005648c70aabdc8ec5863b037597d45f
Opcode Fuzzy Hash: f434106a84bc1868dc0456c608dee49db77b063845e3964e2cebe5aa2a93c3c1
Instruction Fuzzy Hash: DA6161B0A002059FC710EFA8D988F9ABBF8EF4C704F60847AE545F7361D6349846CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004235F0, Relevance: 22.6, APIs: 15, Instructions: 117COMMON

Download Yara Rule

APIs

#526.MSVBVM60(?,00000001), ref: 00423636
__vbaVarTstNe.MSVBVM60(?,?), ref: 00423652
__vbaFreeVar.MSVBVM60 ref: 00423664
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423682
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042369B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000050), ref: 004236BC
#667.MSVBVM60(?), ref: 004236D6
__vbaStrMove.MSVBVM60 ref: 004236E1
__vbaFreeObj.MSVBVM60 ref: 004236EA
__vbaFreeVar.MSVBVM60 ref: 004236F3
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00423708
__vbaObjSet.MSVBVM60(?,00000000), ref: 00423721
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,00000158), ref: 00423748
__vbaFreeObj.MSVBVM60 ref: 00423757
__vbaFreeStr.MSVBVM60(00423794), ref: 0042378D

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$#526#667Move
String ID:
API String ID: 1956310804-0
Opcode ID: c9bb0f80bba9fedaf13ae4dd70f4ba910e77034accea0960c2abe0352c932ed1
Instruction ID: 8228726e8cfd381dfe3d782d7af7da4898919f8cd44819d6e2e338182496acb0
Opcode Fuzzy Hash: c9bb0f80bba9fedaf13ae4dd70f4ba910e77034accea0960c2abe0352c932ed1
Instruction Fuzzy Hash: B5416370900215DFCB10DF94DE88EEEB7B8FF48705F10402AE542B7260DB785545CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042AF80, Relevance: 21.1, APIs: 14, Instructions: 142COMMON

Download Yara Rule

APIs

#517.MSVBVM60(004099E0), ref: 0042AFD7
__vbaStrMove.MSVBVM60 ref: 0042AFE2
__vbaStrCmp.MSVBVM60(004099E8,00000000), ref: 0042AFEE
__vbaFreeStr.MSVBVM60 ref: 0042B001
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B023
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B03C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,000001B8), ref: 0042B063
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042B07B
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000038,?,?,?,?,?), ref: 0042B0E7
__vbaVar2Vec.MSVBVM60(?,?,?,?,?,?,?), ref: 0042B0F5
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,?), ref: 0042B103
__vbaFreeObj.MSVBVM60(?,?,?,?,?), ref: 0042B10C
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?), ref: 0042B11C
__vbaAryDestruct.MSVBVM60(00000000,?,0042B179), ref: 0042B172

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultMoveNew2$#517DestructListVar2
String ID:
API String ID: 4173891514-0
Opcode ID: 3e01a7ff9cd4993cb1f11166d4494df89b5c4ce4794bc489f1fc571ef0242f20
Instruction ID: fd856919aea96aa9ae838c0992edff77b95bbc361149ecb321eb706398e8ad4c
Opcode Fuzzy Hash: 3e01a7ff9cd4993cb1f11166d4494df89b5c4ce4794bc489f1fc571ef0242f20
Instruction Fuzzy Hash: 6E513E70E00218AFCB10DFA5D989ADEBBF8FF48700F10812AE545B7261D7745946CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0042BF20, Relevance: 21.1, APIs: 14, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BF75
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BF7D
__vbaNew2.MSVBVM60(00409924,0042D33C), ref: 0042BF91
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 0042BFBC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000060), ref: 0042BFE4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BFEF
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BFF8
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042C011
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042C02A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,0000020C), ref: 0042C04D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042C052
__vbaFreeStr.MSVBVM60(0042C08F), ref: 0042C082
__vbaFreeStr.MSVBVM60 ref: 0042C087
__vbaFreeStr.MSVBVM60 ref: 0042C08C

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresult$CopyNew2$Move
String ID:
API String ID: 438941495-0
Opcode ID: 5285b40c3250f1cdb9944caece7a9cfb34b2abc51afc5825b0179570d13e7d03
Instruction ID: 87028fce92ec3fa3ba679e96a1cd2ddb550758573f60db62d71bd7117c49f0a8
Opcode Fuzzy Hash: 5285b40c3250f1cdb9944caece7a9cfb34b2abc51afc5825b0179570d13e7d03
Instruction Fuzzy Hash: E0412B71E002199BCB10DFA5DD88DEEBBB8EF5C704B244426E501B72A1D7789946CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042A620, Relevance: 19.7, APIs: 13, Instructions: 153COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 0042A68F
#528.MSVBVM60(?,?), ref: 0042A69D
__vbaVarTstNe.MSVBVM60(?,?), ref: 0042A6B9
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0042A6CC
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A6F1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A710
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000150), ref: 0042A733
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A74C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042A765
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001A0), ref: 0042A788
__vbaFpI4.MSVBVM60 ref: 0042A799
__vbaHresultCheckObj.MSVBVM60(00000000,00401508,004095E0,000002C8), ref: 0042A7E5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042A7F5

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$FreeListNew2$#528
String ID:
API String ID: 2869566290-0
Opcode ID: 5458f07abe9c2429ad2c07be9088884a131a211d4ad380e3db0b57d2d82738f5
Instruction ID: 57c5e18c5adafa0e89ca3d91da866300865e3309eb8d6146b0402d712ba498e2
Opcode Fuzzy Hash: 5458f07abe9c2429ad2c07be9088884a131a211d4ad380e3db0b57d2d82738f5
Instruction Fuzzy Hash: B05149B1A00208AFDB10DF95D948EDEBBB8FF88700F20452AF545B72A1D7745A45CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4D0, Relevance: 16.6, APIs: 11, Instructions: 83COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0042B522
#610.MSVBVM60(?), ref: 0042B52C
#552.MSVBVM60(?,?,00000001), ref: 0042B53C
__vbaVarMove.MSVBVM60 ref: 0042B548
__vbaFreeVar.MSVBVM60 ref: 0042B551
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B56A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B583
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,00000078), ref: 0042B5A4
__vbaFreeObj.MSVBVM60 ref: 0042B5B3
__vbaFreeVar.MSVBVM60(0042B5F1), ref: 0042B5E1
__vbaFreeStr.MSVBVM60 ref: 0042B5EA

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$#552#610CheckCopyHresultMoveNew2
String ID:
API String ID: 3736399677-0
Opcode ID: 5dd55810ae2ef37d0ab3545c98c22a02add8fd0735ab66f06181445cdbfd4217
Instruction ID: d8dcacf36cd006151fefa240b8000f9cef7ddb819a6ab1b45a600580af9b47ad
Opcode Fuzzy Hash: 5dd55810ae2ef37d0ab3545c98c22a02add8fd0735ab66f06181445cdbfd4217
Instruction Fuzzy Hash: 90310770D00259EBCB00DFA4D988EDEBBB8FF58704F10452AE502B7260DB749946CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004297A0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 004297DA
__vbaVarDup.MSVBVM60 ref: 004297FA
#563.MSVBVM60(?), ref: 00429800
__vbaFreeVar.MSVBVM60 ref: 0042981B
__vbaVarDup.MSVBVM60 ref: 00429836
#529.MSVBVM60(?), ref: 0042983C
__vbaFreeVar.MSVBVM60 ref: 00429845
__vbaFreeStr.MSVBVM60(00429862), ref: 0042985B

Strings

Oprevet, xrefs: 00429828

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$#529#563Copy
String ID: Oprevet
API String ID: 1811884707-3027852692
Opcode ID: 92d0f65181c6a1e7a366000068deac00918ca0560e8a419abe6ef1e04a9fa0a3
Instruction ID: 9b6542e37c1e9da65828dd0b23eb7ee43cd96f4b9f0c7eec03bd332865f6cc5f
Opcode Fuzzy Hash: 92d0f65181c6a1e7a366000068deac00918ca0560e8a419abe6ef1e04a9fa0a3
Instruction Fuzzy Hash: 41112975D012499BCB04DFA4DA85ADEBBF4EF48700F60452AE402B7250DB746E08CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0042B850, Relevance: 15.1, APIs: 10, Instructions: 105COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0042B88D
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B8A6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B8C5
__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B8E1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0042B8FA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000158), ref: 0042B91D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 0042B95D
__vbaFreeStr.MSVBVM60 ref: 0042B966
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0042B976
__vbaFreeStr.MSVBVM60(0042B9BC), ref: 0042B9B5

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$CheckHresultNew2$CopyList
String ID:
API String ID: 4130517723-0
Opcode ID: 251bec8be01291e7fd97d4966f189f062db4f962327660629e626027532c21b6
Instruction ID: 54b2da29e0a1ca01dfa30365270ffaccce4885c37bd5eeb201aa079f469ddffb
Opcode Fuzzy Hash: 251bec8be01291e7fd97d4966f189f062db4f962327660629e626027532c21b6
Instruction Fuzzy Hash: C5413EB0A00214AFCB00DFA4DD89F9E7BB8FB4C700F60452AF545B7261D7799946CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBD0, Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC07
__vbaNew2.MSVBVM60(004089D4,0042D010,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC20
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC39
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098C8,000001B0), ref: 0042BC7C
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC85
#586.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC8D
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BC93
#569.MSVBVM60(00000047,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BCA8
__vbaFreeStr.MSVBVM60(0042BCCA,?,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042BCC3

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$#569#586CheckCopyHresultNew2
String ID:
API String ID: 3854721184-0
Opcode ID: 1ca4fba7bee375458b3a3bd177dcb13195c9b55650f3aa7e29e63b14974b665d
Instruction ID: 23c166fdb9a90ae8d839556ddcc1668d99d108c8a54f42adc16f856ae9e85769
Opcode Fuzzy Hash: 1ca4fba7bee375458b3a3bd177dcb13195c9b55650f3aa7e29e63b14974b665d
Instruction Fuzzy Hash: 8F218270A40204DBCB04DFA5DE89FAA7BB4FF48700F10852AF545BB2A0CB385801CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042A870, Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042A8B6
__vbaNew2.MSVBVM60(00409924,0042D33C,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042A8CE
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014), ref: 0042A8F3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000068), ref: 0042A917
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042A920
__vbaFreeStr.MSVBVM60(0042A941,?,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042A93A

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresult$CopyNew2
String ID:
API String ID: 3978771648-0
Opcode ID: 9c15d1fbf022055924717e5f40043210a85bc9d35a22f15357500e9cb525bc8b
Instruction ID: 807e90aba424f8d9916d54827e0b487c5fa419bfa5e6550a1fdd1c8d8f3027b5
Opcode Fuzzy Hash: 9c15d1fbf022055924717e5f40043210a85bc9d35a22f15357500e9cb525bc8b
Instruction Fuzzy Hash: CF218070A00215AFCB04EF95DD48EAEBBB8FF58700B50442AE801B32A0D7785946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00424BA0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00424BE3
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00424BFC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,000001EC), ref: 00424C44
__vbaFreeObj.MSVBVM60 ref: 00424C4D

Strings

ECTORETINA, xrefs: 00424C23

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: ECTORETINA
API String ID: 1645334062-2591629326
Opcode ID: 894dd1a5e4af5d4d11907b7f7d936b6dc017548029b5cc36359c35e4c051a1ab
Instruction ID: f948cdbdc9e3eac076e56cf776dcc7e4552cddffc375d0564e03987ea6297d59
Opcode Fuzzy Hash: 894dd1a5e4af5d4d11907b7f7d936b6dc017548029b5cc36359c35e4c051a1ab
Instruction Fuzzy Hash: 0C118470A00305ABC704DFA9DE49F9A7BB8FB48700F604529E545F7690D73899058B99

Uniqueness

Uniqueness Score: -1.00%

Function 00424230, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

#535.MSVBVM60(?,?,?,?,?,?,?,?,?,00401666), ref: 00424261
__vbaNew2.MSVBVM60(004089D4,0042D010,?,?,?,?,?,?,?,?,?,00401666), ref: 0042427C
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401666), ref: 00424295
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,000000D8,?,?,?,?,?,?,?,?,?,00401666), ref: 004242BC
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401666), ref: 004242CB

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$#535CheckFreeHresultNew2
String ID:
API String ID: 1576155240-0
Opcode ID: 36644edfec21deefecc3e9d243ad45f73d69c2e0050d965f63af84be1a549b56
Instruction ID: 8194637e2c3272895ba1ca69e11d3dba1e4de73c54a107feeae017d8f3c53660
Opcode Fuzzy Hash: 36644edfec21deefecc3e9d243ad45f73d69c2e0050d965f63af84be1a549b56
Instruction Fuzzy Hash: AE118F74A40215EBCB10DF95DE49FAEBBB8FB88B00F604466F441B32A0DB785506CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0042B770, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00409924,0042D33C,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042B7BF
__vbaHresultCheckObj.MSVBVM60(00000000,029DEDCC,00409914,00000014,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042B7E4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00409A7C,00000140,?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042B80E
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401666), ref: 0042B817

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: d4008906016463c28c51238b756ac95e6ce2b820f0c27ccb22d55527df9ee822
Instruction ID: c52b1af457283d8aa73477b89a612a297d5cd9d0bed0cb1ce3b457dcab0e04ca
Opcode Fuzzy Hash: d4008906016463c28c51238b756ac95e6ce2b820f0c27ccb22d55527df9ee822
Instruction Fuzzy Hash: 70117270E40214ABCB00EF95DD49EAABBB8FF88704F54402AF405A72A1D7785545CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004296C0, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 00429703
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0042971C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098F4,000001C8), ref: 0042975F
__vbaFreeObj.MSVBVM60 ref: 00429768

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 79787c4335697ab1793763ae137bf8f3393222af4237b6fa95df771be8997dfc
Instruction ID: 2f2a64263a4284c691ea084fecb88cb12195c954e544dd7237d22dede56bb0cf
Opcode Fuzzy Hash: 79787c4335697ab1793763ae137bf8f3393222af4237b6fa95df771be8997dfc
Instruction Fuzzy Hash: FD116370A40205EFD710DFA8DA49F9ABBB8FB48704F60452AF145E72A0D7389805CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00423080, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E00423080(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr* _t12;
				intOrPtr* _t14;
				intOrPtr* _t16;
				void* _t17;
				intOrPtr* _t26;
				void* _t27;
				void* _t29;
				intOrPtr _t30;

				_t30 = _t29 - 0xc;
				 *[fs:0x0] = _t30;
				_v16 = _t30 - 0x14;
				_v12 = 0x401200;
				_v8 = 0;
				_t12 = _a4;
				 *((intOrPtr*)( *_t12 + 4))(_t12, __edi, __esi, __ebx,  *[fs:0x0], 0x401666, _t27);
				_t14 =  *0x42d010; // 0x7bfa70
				_v28 = 0;
				if(_t14 == 0) {
					__imp____vbaNew2(0x4089d4, 0x42d010);
					_t14 =  *0x42d010; // 0x7bfa70
				}
				_t16 =  &_v28;
				__imp____vbaObjSet(_t16,  *((intOrPtr*)( *_t14 + 0x314))(_t14));
				_t26 = _t16;
				_t17 =  *((intOrPtr*)( *_t26 + 0x20c))(_t26);
				asm("fclex");
				if(_t17 < 0) {
					__imp____vbaHresultCheckObj(_t17, _t26, 0x4098d8, 0x20c);
				}
				__imp____vbaFreeObj();
				_push(0x42312a);
				return _t17;
			}

0x00423083
0x00423092
0x0042309f
0x004230a2
0x004230ab
0x004230ae
0x004230b4
0x004230b7
0x004230be
0x004230c1
0x004230cd
0x004230d3
0x004230d3
0x004230e2
0x004230e6
0x004230ec
0x004230f1
0x004230f7
0x004230fb
0x00423109
0x00423109
0x00423112
0x00423118
0x00000000

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010,?,?,?,?,?,?,?,00401666), ref: 004230CD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00401666), ref: 004230E6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004098D8,0000020C,?,?,?,?,?,?,?,00401666), ref: 00423109
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00401666), ref: 00423112

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: a2c371175675b3e944a94dbc98e0d63fbe95d913a59efa9e8d6cc524910f9873
Instruction ID: 061b2664c6080dacace045f8579bf7c14ef690c7d1f31242d13dc28d4563ff08
Opcode Fuzzy Hash: a2c371175675b3e944a94dbc98e0d63fbe95d913a59efa9e8d6cc524910f9873
Instruction Fuzzy Hash: 20118270A40214EBC710EFA4DD4DF9ABBB8FF48701F604566F441E36A1C67895468BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042A960, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042A9A3
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0042A9BC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409AE8,00000180), ref: 0042A9DF
__vbaFreeObj.MSVBVM60 ref: 0042A9E8

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 4cd351514d30655ad9336c1c2e38133f6eaed24b7d4cdbf05a1e71a4df54ed04
Instruction ID: 41a231ef2ddbafca82ee11e553ec7afff37680de0b60e89b3ad3d92853cc8b90
Opcode Fuzzy Hash: 4cd351514d30655ad9336c1c2e38133f6eaed24b7d4cdbf05a1e71a4df54ed04
Instruction Fuzzy Hash: 1A018E74A40204AFC7109FA5DE49F9B7BB8AB08B05F504426F841B72A0D7785505CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B620, Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004089D4,0042D010), ref: 0042B663
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0042B67C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00409A10,00000218), ref: 0042B69F
__vbaFreeObj.MSVBVM60 ref: 0042B6A8

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: ef1746344966962acad85306d1ac1a86d2ee6f06cc96b506d9e0b48a7ac8b710
Instruction ID: 30d6ef91059611946878f575f639c718c5a7eac44910c71ae605f343571dae38
Opcode Fuzzy Hash: ef1746344966962acad85306d1ac1a86d2ee6f06cc96b506d9e0b48a7ac8b710
Instruction Fuzzy Hash: 3D015274A40214AFC710DFA4DE4DF9A7BB8EB08B05F600526F441F71B1D77899458BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042B6E0, Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

#704.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 0042B724
__vbaStrMove.MSVBVM60 ref: 0042B72F
__vbaFreeVar.MSVBVM60 ref: 0042B738
__vbaFreeStr.MSVBVM60(0042B759), ref: 0042B752

Memory Dump Source

Source File: 00000000.00000002.465303046.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.465266053.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465572694.000000000042D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.465602453.000000000042F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465787257.0000000000462000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Invoice-NBM01557.jbxd

Yara matches

Similarity

API ID: __vba$Free$#704Move
String ID:
API String ID: 3473371104-0
Opcode ID: 3e1adacb0461ca6b7aa97375eaa204849ed213992005ab79e0c93b31538bdc1b
Instruction ID: 0c8606013d4f4d4be749ad83a84589ab835fb6eb3a5ff28ece10a6118d154626
Opcode Fuzzy Hash: 3e1adacb0461ca6b7aa97375eaa204849ed213992005ab79e0c93b31538bdc1b
Instruction Fuzzy Hash: 6AF03670900158AFCB00DFA8DE45EADBBB8EB49721F304325E516B21E0D7341A04CB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 5196 Parent PID: 3164 RegAsm.exeCOMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	60.8%
Total number of Nodes:	265
Total number of Limit Nodes:	13

Executed Functions

Function 00F10C21, Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1119COMMON

Download Yara Rule

Strings

ij, xrefs: 00F084C2
.d%, xrefs: 00F116CA
h7, xrefs: 00F07291
gq, xrefs: 00F07787
RL22, xrefs: 00F0879E
t/M, xrefs: 00F0794C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: .d%$RL22$t/M$gq$h7$ij
API String ID: 0-4183542688
Opcode ID: 89f9151914855ad32854c4c2b26250c06b7ad77633cf5a672774328f4cc125e1
Instruction ID: a7233dfd8b139fce977039c381108f07424413660012d76ba4269ed464d54e94
Opcode Fuzzy Hash: 89f9151914855ad32854c4c2b26250c06b7ad77633cf5a672774328f4cc125e1
Instruction Fuzzy Hash: 27726C36918240CECF2DCF3858753C677A1FB92364F56416EC592CF066E6A648C7EE82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E99E, Relevance: 12.5, APIs: 1, Strings: 5, Instructions: 1985libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

9, xrefs: 00F0F10C
8, xrefs: 00F0EAE8
o, xrefs: 00F0F4BF
vNE@, xrefs: 00F0F3C7
D,Uq, xrefs: 00F0F339

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: 8$9$D,Uq$o$vNE@
API String ID: 1029625771-3383889576
Opcode ID: 1e2831f77e129b4df8ebb8bf01a191dd67767bae425fcba9ab594b9bcc1860b3
Instruction ID: ad50b87accf113868423f9987f0740699df1332dba2684f26c101e69d28e1e80
Opcode Fuzzy Hash: 1e2831f77e129b4df8ebb8bf01a191dd67767bae425fcba9ab594b9bcc1860b3
Instruction Fuzzy Hash: 75E2D37A905201CECF3DCE79947538377A1FB90364B96857AC8428F5A1E2664C8BFEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F11A55, Relevance: 5.2, APIs: 1, Strings: 1, Instructions: 1713COMMON

Download Yara Rule

Strings

L, xrefs: 00F11EBA

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-1735490630
Opcode ID: 8fc625a7cc45aeb894b5630a97e2d910f0b6144c142dae51b32c4a886b7c3c2d
Instruction ID: ef175d8f5311bdc925209d3d37afadd1ab4d8b8660768df1dff5773d285a2a24
Opcode Fuzzy Hash: 8fc625a7cc45aeb894b5630a97e2d910f0b6144c142dae51b32c4a886b7c3c2d
Instruction Fuzzy Hash: 00C2E23A915100CECE6CCFB964753C277A1FB50368B96916AC552CF131E26A48E7FEC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E0D1, Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1483COMMON

Download Yara Rule

Strings

vNE@, xrefs: 00F0F3C7

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: vNE@
API String ID: 0-4005984838
Opcode ID: 9a6bbbe692b060513959800bd96ee7b08ce0019a8b7999ffee186c1010d4dd03
Instruction ID: 241c952a6269e0978537b95635e8c5dd22e606140dec8a11f46e11a57b45c5f6
Opcode Fuzzy Hash: 9a6bbbe692b060513959800bd96ee7b08ce0019a8b7999ffee186c1010d4dd03
Instruction Fuzzy Hash: 2FA24C3A905201CFCF39CE7994753C337A1AF91364F96857ACC428F5A1E676488AFAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F04F3B, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 733
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: c8cb4e9f54044036e5d9fca3807698d19c8fca716a470ea9a962770429cd9fa4
Instruction ID: 5f7bc96d740dbdac417d82033220a7e05a3356f438dcd80fbfb47fcfb025f34e
Opcode Fuzzy Hash: c8cb4e9f54044036e5d9fca3807698d19c8fca716a470ea9a962770429cd9fa4
Instruction Fuzzy Hash: 0F42337270470ADFDB249E28CC94BEA77E2FF49750F94422EDC8987280D7749985EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F0637A, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.C1K, xrefs: 00F064A3

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: .C1K
API String ID: 0-874949410
Opcode ID: fd2d7766f01572689930ae11584c83a5e5f15f36f794987ed4a115359d24ed84
Instruction ID: a8c531f9d072fa995196a0f7538c2541dd20ab19d46ba2b9fbf87dc7fb9bf196
Opcode Fuzzy Hash: fd2d7766f01572689930ae11584c83a5e5f15f36f794987ed4a115359d24ed84
Instruction Fuzzy Hash: 19E15871604306CFDB34AE748D953EA77E2AF553A0FA5412EDC8AC7185D335C985EB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EA0A, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

8, xrefs: 00F0EAE8

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: 8
API String ID: 1029625771-4194326291
Opcode ID: 513022e1870a1a273da3517098008717bc71adbf070ad540ea969feac05633ab
Instruction ID: efa15c41d749e12a1f1c637c15d5dd490a70482c8a1567ef3395960c8f3437e9
Opcode Fuzzy Hash: 513022e1870a1a273da3517098008717bc71adbf070ad540ea969feac05633ab
Instruction Fuzzy Hash: C34182BAA05100CECF7DCF7A507670377A2BBD0369B97497AC8038E0B0E5AA4D55B9C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F00E61, Relevance: 2.7, APIs: 1, Instructions: 1171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88140a75ed9e88fff445944f6c66541951fb7c416ce189763a3bb94c429bd8b3
Instruction ID: a4d901a7ef40836a215a891357214bd995da928a74a18c1145e48acc3d10e0f2
Opcode Fuzzy Hash: 88140a75ed9e88fff445944f6c66541951fb7c416ce189763a3bb94c429bd8b3
Instruction Fuzzy Hash: C082F33A915600CECF2DCF79587638337A1FF91364B96856AC842CF0A1E6664897FEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F102A2, Relevance: 2.0, APIs: 1, Instructions: 505
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4985e49161acfefc199ea623b856790d1bc17accc6c950daffd07d82a999ef
Instruction ID: c01c469aab5fdc0d487f54c9078034c2e672ffd068e471da238aac9bff6f0708
Opcode Fuzzy Hash: 3d4985e49161acfefc199ea623b856790d1bc17accc6c950daffd07d82a999ef
Instruction Fuzzy Hash: CB026C216083428FDB258F3888A87D77BD25F53370F5982A9CC958B1D7D7B588C6E702

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AFAA, Relevance: 1.8, APIs: 1, Instructions: 318
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 85b1a4df4f1820dbda7bc73856041b5593975897f36f5d2769cc082592b326b7
Instruction ID: 26a2473d80c3ffef285e66d61c4e4b852ceb02a6f20897af299cc3f2ccd84e67
Opcode Fuzzy Hash: 85b1a4df4f1820dbda7bc73856041b5593975897f36f5d2769cc082592b326b7
Instruction Fuzzy Hash: EFB12236644346DFDF309E74CD95BEE37A2AF51360F95462EDC8AA7190E3318981BB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B073, Relevance: 1.8, APIs: 1, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033c5cdaed49c2f52fcbf8caea823926655389e2526fb4a2a1859e735bab8f47
Instruction ID: 2610981839395f3cd8611a322a0e0e7cf0d54b04639546a5982cede848909bc7
Opcode Fuzzy Hash: 033c5cdaed49c2f52fcbf8caea823926655389e2526fb4a2a1859e735bab8f47
Instruction Fuzzy Hash: 7CA15776604346CFDF348E74CDA5BEA37A1AF51350F95412ADC49AB1A0E3318A81FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A30F, Relevance: 1.8, APIs: 1, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dba6e641932d6e56cc0377619dc0a913b037929f21792b845d5b5bf4abc1782
Instruction ID: 89973cfa6b6ddae0abf6ba6482d3cfcef6c64c4510d9f135b8f64ca1255e4299
Opcode Fuzzy Hash: 2dba6e641932d6e56cc0377619dc0a913b037929f21792b845d5b5bf4abc1782
Instruction Fuzzy Hash: 7991367AA05300CFCF79CE7588653E677A2FF41364F56402ACC46AB160E2B64D85BBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B064, Relevance: 1.8, APIs: 1, Instructions: 259
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: c740beb88cdbb1b2373ac6e412e74152c30416bfef43b68f75df43fa151b9007
Instruction ID: 72ecd1c025f62bbebdd6acaefed13f780d856bf6b23e0bdd46eaf2e0df8efeb9
Opcode Fuzzy Hash: c740beb88cdbb1b2373ac6e412e74152c30416bfef43b68f75df43fa151b9007
Instruction Fuzzy Hash: 2B91573264434ADFDF308E74CD95BEE37A1AF55350F95412ADC89AB290E3318A81FB16

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A26D, Relevance: 1.8, APIs: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc660e8d7ccbd557cc22e98d2b3ebe21cae3e20ad3ab0cd8b9a3575fdb5483e2
Instruction ID: 1501c0eebf6be464f5f04c9d9b382da35d9c92e8fa95d19daa1e339a8337aac8
Opcode Fuzzy Hash: bc660e8d7ccbd557cc22e98d2b3ebe21cae3e20ad3ab0cd8b9a3575fdb5483e2
Instruction Fuzzy Hash: 8781797AA05300CFCF34CE7588257EA37A2EF45360F56402ACC869B161E2768D81FB83

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B253, Relevance: 1.8, APIs: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fb9b554b97723af08ce8b298910c5790a162485636c12fe7a92aeaa60715f9
Instruction ID: 1befc2f1cc1dfef9401679e75de7e03f96b9636216285e3e916e59c5ea358902
Opcode Fuzzy Hash: 80fb9b554b97723af08ce8b298910c5790a162485636c12fe7a92aeaa60715f9
Instruction Fuzzy Hash: B4913736A44346CFDF348E74CD65BEE37A1AF91350F55412ADC4AAB1A0D3318A81BB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B107, Relevance: 1.7, APIs: 1, Instructions: 244
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 41d87b0c6580b75573064e7cb932e56505c18ab5fc6402a017fcb6c126c0357b
Instruction ID: f6ba1d8753a86bdc7897fb4c0beea96fd64710b2e8b198ffabf68754822505ea
Opcode Fuzzy Hash: 41d87b0c6580b75573064e7cb932e56505c18ab5fc6402a017fcb6c126c0357b
Instruction Fuzzy Hash: 2C916A3264438ADFDF308E74CD94BEE37A2AF55350F54412ADC49AB294D3318A81FB16

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B2B6, Relevance: 1.7, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3665ad542e22bfdac4d4b37e79576bbe01227b9ff13d271f7b1e3235dbcde3
Instruction ID: cae430703f86a8f393b00fba65096a13ac4190e86e3e0bb242ae78d1f97aaac1
Opcode Fuzzy Hash: 1f3665ad542e22bfdac4d4b37e79576bbe01227b9ff13d271f7b1e3235dbcde3
Instruction Fuzzy Hash: 31816632A44386CFDF348F74CD59BEA37A2EF51350F55412ADC89AB1A0D3318A85BB06

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B4DD, Relevance: 1.7, APIs: 1, Instructions: 230
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 7afd4f50103c1cbbb0e5642bde00f1ac5e59cad5b49f3c976322d798d1e662f0
Instruction ID: 2b052019e11a66cc9136292e9496c5ac8833d47fd769b4e270bfd645b25e99b2
Opcode Fuzzy Hash: 7afd4f50103c1cbbb0e5642bde00f1ac5e59cad5b49f3c976322d798d1e662f0
Instruction Fuzzy Hash: DB811736604246CFCF38CF789D657EA37A1EF50360F59416ACC069B1A5E3318A85FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F11CB1, Relevance: 1.7, APIs: 1, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ee3b56e766e8fc41233ab684824d9f900b90b306e8897a7b6833281e9f617e
Instruction ID: 9555499c42ce5852d151cf7252fdab31da17940ff7a984c2247f99cf5284dc62
Opcode Fuzzy Hash: 01ee3b56e766e8fc41233ab684824d9f900b90b306e8897a7b6833281e9f617e
Instruction Fuzzy Hash: EE71F53A904601CECF7CDE7890757D336A1BF50364FA6412ACD438B060E76A8CD6EAC6

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A3B9, Relevance: 1.7, APIs: 1, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2066e4f14c11c567d17f94a5b4035a282e0c8c1bd9dbbea7fdc81423ba1b6b40
Instruction ID: 3da1596c0a3cea859bce931f62b9afedf96783e2eb9eee72981bbe6385757729
Opcode Fuzzy Hash: 2066e4f14c11c567d17f94a5b4035a282e0c8c1bd9dbbea7fdc81423ba1b6b40
Instruction Fuzzy Hash: 07718C3AA05344CFDF748E7488153EA77A2EF05320F56402ADC89AB161E3748D80FB83

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A414, Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b24bfb21a0061fd7c109e93c5a2ae4f4f123856ced553dfb39cd9ba843ca559
Instruction ID: bf5fec43b246a40d8a8eebe0567b25044511305f1043f40c8f33217189285d7d
Opcode Fuzzy Hash: 8b24bfb21a0061fd7c109e93c5a2ae4f4f123856ced553dfb39cd9ba843ca559
Instruction Fuzzy Hash: 75619A36A40345DFDB319E648C057EE77A2EF46320F5A405ADC89AB251D3748DC1FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F11AAD, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22fa5c04c5bee61e594d551e948296bdfadda369dd9b35b3185b0c07190614c
Instruction ID: 735e2898d40a78b9c9455350f3bb13bf756fd11df5cae74a90daf7115857154f
Opcode Fuzzy Hash: d22fa5c04c5bee61e594d551e948296bdfadda369dd9b35b3185b0c07190614c
Instruction Fuzzy Hash: 51612A36908205CEDF7DDE7481713E737A1BFA1354FA6412ACD538B060E72988D5FA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F11BB1, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a492d4ba6f9388bfd4ffb099ec67330f50cf044bbd87c509f978c158e5d335
Instruction ID: 5416c091f437d1c06b79a4f7006e8fdeaf6dc781640d9ebe9e30d541d1a2d4d7
Opcode Fuzzy Hash: c8a492d4ba6f9388bfd4ffb099ec67330f50cf044bbd87c509f978c158e5d335
Instruction Fuzzy Hash: 0E610636904201CECF7CDE7490757E736A1BF91364F66412ACD438B060D76A8DD5EAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A4FE, Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c0d8b88934e88371d38a82f25c6fe2602bc75075c419a5771c692a0173b69c
Instruction ID: df67b23439412587145b32f11dcc6b44509c7912e7c06a70f53f70d87ba11b34
Opcode Fuzzy Hash: f9c0d8b88934e88371d38a82f25c6fe2602bc75075c419a5771c692a0173b69c
Instruction Fuzzy Hash: 5F517A7AA01344CFDF35CE758C117EA77A2BF45320F5A4029DC49AB261E3758E85EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A457, Relevance: 1.7, APIs: 1, Instructions: 190memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0E9FE: LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 5e7c5a9865fd5c9f3316c7984660eddfe2756d996104804a65faff075fc5aba7
Instruction ID: ee16501b1948285ecdd756377a8e67aa16a1d5a7d983d01a2d9963d71f450118
Opcode Fuzzy Hash: 5e7c5a9865fd5c9f3316c7984660eddfe2756d996104804a65faff075fc5aba7
Instruction Fuzzy Hash: E9518A76A41345DFDF709E648D143FE77A2EF0A320FA94029DC89A7251E3748A80FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F11B0A, Relevance: 1.7, APIs: 1, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f12039798b233cc3e29ea18d16672d89fd4dcd371e6e06aee60adfad18c24d
Instruction ID: c67851f591050dd96bf1fdc0bd5fc7ee45940c6a6e4938a999b784978366275a
Opcode Fuzzy Hash: e0f12039798b233cc3e29ea18d16672d89fd4dcd371e6e06aee60adfad18c24d
Instruction Fuzzy Hash: CB512936908206CFDF78DE7485713E733A1BFA1354FA6412ACD438B060D72A88D5FA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B3D1, Relevance: 1.7, APIs: 1, Instructions: 185networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: a13df4aea32c3530420a76854e6885588f5f9c299d9dde8c8ad591e95064e4f3
Instruction ID: e6604a9663db7579fbac27948b1c696237bcb63e3110ec40106d03ab32e275a1
Opcode Fuzzy Hash: a13df4aea32c3530420a76854e6885588f5f9c299d9dde8c8ad591e95064e4f3
Instruction Fuzzy Hash: D4613976A44346CFCF34CE74DD65BEA37A1AF51360F55412ADC059B1A0E3318A81FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F11E1A, Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990ee6523b2919d55217f3819c6a1b8187821e4175fabd36f485e4e904942f5b
Instruction ID: 6ca112069df34a6ca4f4e5fe69211ea52364c4bb94d426c5eda2e3889efae6ab
Opcode Fuzzy Hash: 990ee6523b2919d55217f3819c6a1b8187821e4175fabd36f485e4e904942f5b
Instruction Fuzzy Hash: A851F63A914601CECF6CDEB980767D737A1BF60394F56416ACD438B060D76A8CD6EAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F11D61, Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7f436beb4f876c3df81f560b67e7e079a7d4aefb153b8c14091be23e5f285e
Instruction ID: 0b4728d06ea52a2972f74e10c47bda8a0bfe819b90e0a969107c01cdf49aa24a
Opcode Fuzzy Hash: ab7f436beb4f876c3df81f560b67e7e079a7d4aefb153b8c14091be23e5f285e
Instruction Fuzzy Hash: 5E513936A04201CFDF789EB880757E733A1BF60354FA6412ACD438B060D76A8DD5EAC6

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A591, Relevance: 1.7, APIs: 1, Instructions: 174memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Part of subcall function 00F0E9FE: LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID:
API String ID: 2616484454-0
Opcode ID: 006781ad0cfd15fb36a0493d905aaab62d699d1a19e08efcb3a36ffc8e3e2298
Instruction ID: 9ebd0405c542164ccd64ded189d34b3fa1b99ebf8a8e71048d00fb8b152343e4
Opcode Fuzzy Hash: 006781ad0cfd15fb36a0493d905aaab62d699d1a19e08efcb3a36ffc8e3e2298
Instruction Fuzzy Hash: 6251697AA04344CFDF75CF6588217EA77B2AF45320F6A4029D845AB161D3758E81FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B45A, Relevance: 1.7, APIs: 1, Instructions: 166networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: ebbc917ea7064720e6740fe4070334114d5aa253429673666ce6c9a5764eb41c
Instruction ID: 1799e50f63426b3b38f13d7f48b6dcfd483011371a2d403634e203c10b5442cb
Opcode Fuzzy Hash: ebbc917ea7064720e6740fe4070334114d5aa253429673666ce6c9a5764eb41c
Instruction Fuzzy Hash: 29512876A04346CFCF34CE74DD65BEA37A5AF51360F55412ADC09AB1A0E3318A81FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F11FC5, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc42ffb2b1a355ac843470d0a69adfcc890c666d710110b0d39d69176c300c2
Instruction ID: 2905c50af41338ae071c5df672e002ae5d691ad66c5ce89cd57023af8004e720
Opcode Fuzzy Hash: 7fc42ffb2b1a355ac843470d0a69adfcc890c666d710110b0d39d69176c300c2
Instruction Fuzzy Hash: 0F513736900201CFDFA8DEB884767D337A1BF61364F56416ACC429B060D76A8CE5EAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A63E, Relevance: 1.6, APIs: 1, Instructions: 143memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 560d2b12f4916e4024c5224460d73045775054a83b1c2b02803909621bfb9061
Instruction ID: 8ad7f3c25fe31639db4a31336b54613125f2aeb2b26ab897096f081f79880d8e
Opcode Fuzzy Hash: 560d2b12f4916e4024c5224460d73045775054a83b1c2b02803909621bfb9061
Instruction Fuzzy Hash: 0F417836A40286DFDB319E65CC447E9BBB2EF46320F59405ADC899B111D2348A81FB46

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B56A, Relevance: 1.6, APIs: 1, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 8564725cc85adf895ca5aaea7d406e60ffe3bbcc7b6845194afead579c5e4d52
Instruction ID: 2f151d70ad0edb6508a18b2f9d7b1d9d081f687efd3774a85a2eda198a6a2b25
Opcode Fuzzy Hash: 8564725cc85adf895ca5aaea7d406e60ffe3bbcc7b6845194afead579c5e4d52
Instruction Fuzzy Hash: 7D51B236608346CFDF34CE74CD65BEA37A5AF50360F55412ADC06AB1A1E7328981FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F1201E, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e191d9e38396f8bc8e2fad3132955427808c4f9183c9b70310dc74d59ac07143
Instruction ID: d1359395e4b94f2c8d3fcd59f9dcc9563b6d3719cd42845c435f6cf0a9fe0387
Opcode Fuzzy Hash: e191d9e38396f8bc8e2fad3132955427808c4f9183c9b70310dc74d59ac07143
Instruction Fuzzy Hash: 79415B35900301CFDFA89EB881757D737A1AF61360F66415ACC468B060D73E8CE9EA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F123E3, Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d48df5b0ae01ef79b5b2575c332fcf50dac2529c83dc0da0ab45462a12a0f54
Instruction ID: cd8fd27507393c1f2bdc492e9eedb0db73f6969be6bcce55ac6c7f4c99e56c40
Opcode Fuzzy Hash: 4d48df5b0ae01ef79b5b2575c332fcf50dac2529c83dc0da0ab45462a12a0f54
Instruction Fuzzy Hash: C241A436905200CECFA9CEA990753C233A1EF61364F96515AC8A58F061D37A48FAEEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A680, Relevance: 1.6, APIs: 1, Instructions: 124memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 52ab576938ab90fa1832a53737d2789bc7d7c6de8bb15a456f7b86e0ed92223f
Instruction ID: 992a59a1ab2598e63dd39cb1b30f85ecd6ed7f32e7b27f9129b7323881f6922d
Opcode Fuzzy Hash: 52ab576938ab90fa1832a53737d2789bc7d7c6de8bb15a456f7b86e0ed92223f
Instruction Fuzzy Hash: 4E417D36A45385DFDF719F658C407EC77B2EF1A320F694059DC899B251D3348A80EB46

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A093, Relevance: 1.6, APIs: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?), ref: 00F0A207

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2b001a54d1231ca27657e019ec151c712438e02ade03943b3ed6413dbb95c32
Instruction ID: e22b555fe61b6144cfa98e08f50f4103f5cde573ed7ee923747877da5df38483
Opcode Fuzzy Hash: e2b001a54d1231ca27657e019ec151c712438e02ade03943b3ed6413dbb95c32
Instruction Fuzzy Hash: 7941E232908300CFCE69DF79947628777A2FF90354F57456EC8828B060A2B64896FEC3

Uniqueness

Uniqueness Score: -1.00%

Function 00F1224D, Relevance: 1.6, APIs: 1, Instructions: 111networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00F12349

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: daa9edabf03ea2ed0a63aa034d4230c66430427bd4a5f55ef9fb87de799de248
Instruction ID: 10d956b6765e3330ec6866b4e5a4f83f244daf994d131561beae7164e5b6066e
Opcode Fuzzy Hash: daa9edabf03ea2ed0a63aa034d4230c66430427bd4a5f55ef9fb87de799de248
Instruction Fuzzy Hash: B0313936904200CFDFA8DEB8C4B57D673A0EF51364F66442ACC559B010D33E8CEAEA91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1140D, Relevance: 1.6, APIs: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-E1512D40,0000003A,0000003A), ref: 00F1147F

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: c2c629add52828b8966dba2c2d3412dd73abbcd3205c9f244e3511932ecb825b
Instruction ID: db83ad7b48d847dfe66d3e3314f75490c262dd093162ca92d16c2d88b84b8146
Opcode Fuzzy Hash: c2c629add52828b8966dba2c2d3412dd73abbcd3205c9f244e3511932ecb825b
Instruction Fuzzy Hash: 4731137A919240CECF3CCF7A94753D37BA1FB92764B56416BC5128F020D6660C96EAC0

Uniqueness

Uniqueness Score: -1.00%

Function 00F00FF5, Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00F01247,?,00000000,?,00F0AA11,?,?), ref: 00F01123

Part of subcall function 00F0E9FE: LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: EnumLibraryLoadWindows
String ID:
API String ID: 2773682629-0
Opcode ID: 8164aa83402cbb1b42d531d8e6fdf1b26b6066542ab9d062dc3fae42f8e5943b
Instruction ID: a104e653ea20254b3180cf7023f55bf5425e7aa05c402652d03c1836d5ef33e4
Opcode Fuzzy Hash: 8164aa83402cbb1b42d531d8e6fdf1b26b6066542ab9d062dc3fae42f8e5943b
Instruction Fuzzy Hash: 61312335A04245CFCF28DF79886579A33F5BF853A4F21412EDC86CB190EA758985BB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A731, Relevance: 1.6, APIs: 1, Instructions: 108memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: a7a03c196da0458e086d4e4ce34091f02fcd76684afa1bc49ae60a8c6c33e4cc
Instruction ID: dd6bd7a0d51484db9550e6c8cf2c7827c682f2c3024435a53c3468cac81a257d
Opcode Fuzzy Hash: a7a03c196da0458e086d4e4ce34091f02fcd76684afa1bc49ae60a8c6c33e4cc
Instruction Fuzzy Hash: A731277AA01244CFDF79CF7688613DA77F2AF45314F668469C8469B160E2718A81FB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A785, Relevance: 1.6, APIs: 1, Instructions: 99memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00F0A867

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fc59e11973e643b548d3ca05854b4b2d7d09aa452e1efab6895af2d066e532a2
Instruction ID: 5a8aa235383aa8783824d4fbab6df1107c6d17706d38e698432cbe36e1a99877
Opcode Fuzzy Hash: fc59e11973e643b548d3ca05854b4b2d7d09aa452e1efab6895af2d066e532a2
Instruction Fuzzy Hash: E3315E36A41245DFDF719F658D007FC77B2EF4A320F698069DC499B151D2348A80FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F09FD1, Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?), ref: 00F0A207

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2e3c67002385155bafb2ac33c92856789f9d8f3d367e04935e95a2097c26353d
Instruction ID: 01009f4794d958a896db6c091b1563b756419f2ef6ea2f5d3e1f503ca7a94982
Opcode Fuzzy Hash: 2e3c67002385155bafb2ac33c92856789f9d8f3d367e04935e95a2097c26353d
Instruction Fuzzy Hash: 73312832608309CFDB656E7589683EAB7A2EF92360F96452F8CC243141E37148C6FB03

Uniqueness

Uniqueness Score: -1.00%

Function 00F0C059, Relevance: 1.5, APIs: 1, Instructions: 5libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00F0C068

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dc1d8b6acca05cbf8e6902629defd883fc741a568683b63ee611bd6a919662b7
Instruction ID: 3ef749bb789c27ebf350e707452d68fd5fd6ad1c5b028325873216e87610b3c9
Opcode Fuzzy Hash: dc1d8b6acca05cbf8e6902629defd883fc741a568683b63ee611bd6a919662b7
Instruction Fuzzy Hash: 6CA002B139200D12D580B57A490A64E111957E1342FE9C415F0119F68ECE598A7A77E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F02F32, Relevance: 1.4, APIs: 1, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(-E1A31BC1,00000000,?), ref: 00F03291

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 58b2b4d688f54a7f371faac2d2e974e38d21dc327c7c9d4321c5ac604a0c3f07
Instruction ID: dc733f16229e99680aaff9e381ee2a03738cc48b06e8f428f7af448510985a86
Opcode Fuzzy Hash: 58b2b4d688f54a7f371faac2d2e974e38d21dc327c7c9d4321c5ac604a0c3f07
Instruction Fuzzy Hash: 03412232A04345DFCF348E388DAA7D737A7AF41391F95421ACC855B091E77A0A89FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F018AE, Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd875f180610d14780cc9cd7c035961fad8e5cd0ff66670324e7ac7b27f981e2
Instruction ID: 4059b62fa5a43bad88e322ecad5c726c5c6a59f29f7ada81d1984d1a82118449
Opcode Fuzzy Hash: fd875f180610d14780cc9cd7c035961fad8e5cd0ff66670324e7ac7b27f981e2
Instruction Fuzzy Hash: CD22BA35A0030A9FDF345E788DA97EA37A7AF56360FA5402DDC8997181D33489C6FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F019F9, Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578d2b9999e48570d9f90bfbb9e16b869e2aaddee8463aead5c7a41b8354afe2
Instruction ID: 1f34344efd6e8170d5c1295b2c63d697eab349592ad4b272d8ed4adc78be62db
Opcode Fuzzy Hash: 578d2b9999e48570d9f90bfbb9e16b869e2aaddee8463aead5c7a41b8354afe2
Instruction Fuzzy Hash: 4312A935A0430A9FDF345E748CA93EA37A7AF56360FA5402EDC8697181D33489C6FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F01A79, Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793f8139f513b7c483d71a09dcd18dee417231a6449d11dafe02feca526319dd
Instruction ID: 482eb9070257102cbb02ae40b04714b04d77b9ef3f07283eb6d4efdd84e2f59e
Opcode Fuzzy Hash: 793f8139f513b7c483d71a09dcd18dee417231a6449d11dafe02feca526319dd
Instruction Fuzzy Hash: 4B12AA35A003069FDF345E788CA97EB37A7AF56360FA5402EDC8697181D33489C6FA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F01942, Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3576cf5d7b4baaea59d18cb0b7867f748aaabd492ed5425ca940f09fb55ebf2e
Instruction ID: e44452a89db28f3d52fc25293113881bf72f7339334dd3771b157ab154236ec0
Opcode Fuzzy Hash: 3576cf5d7b4baaea59d18cb0b7867f748aaabd492ed5425ca940f09fb55ebf2e
Instruction Fuzzy Hash: 3912AA35B0030A9FDB305E748DA87EA37A7AF56360FA5402DDC8997185D73489C6FB12

Uniqueness

Uniqueness Score: -1.00%

Function 00F01AFB, Relevance: .6, Instructions: 615COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417e98c42479451d36919a46fed1295b3123da61b451c39dd8f7c9d52a0ce64a
Instruction ID: a829b02aa396902a292431c1f1c5963dc4dbd109d29eb967f65585f16d684ea1
Opcode Fuzzy Hash: 417e98c42479451d36919a46fed1295b3123da61b451c39dd8f7c9d52a0ce64a
Instruction Fuzzy Hash: 4612AC75A003069FDF345E788CA97EA37A7AF56360FA5402EDC86D7181D33489C6FA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F019F6, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6efbe9cdc926583886c0d0902f8d67ba305f3be84a7a5f37cc82104862399797
Instruction ID: d574c9036fc9c5f2bb65181e0f20baf900dc75493f0d3f8e2c74d76508784542
Opcode Fuzzy Hash: 6efbe9cdc926583886c0d0902f8d67ba305f3be84a7a5f37cc82104862399797
Instruction Fuzzy Hash: D502AB35B0430A9FDB305E748DA87EA37A7AF56360FA5402DDC8597185D33489C6FB12

Uniqueness

Uniqueness Score: -1.00%

Function 00F01C8F, Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e2fb06cf498841c93ca326a0b1e84628f9fd8ce7981b66777102af0da9643e
Instruction ID: 3461e25f73bfd068f6e4648233fd20d5407822e3cf252501ab9a1563381b7a08
Opcode Fuzzy Hash: b6e2fb06cf498841c93ca326a0b1e84628f9fd8ce7981b66777102af0da9643e
Instruction Fuzzy Hash: 8B02AB35A043059FDF305E748DA93EB37A7AF56360F95402EDC8697181D33489C6FA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F01C41, Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef6eaf07820104f9393f5f4e565456643411fee630b8d1d385cff3e6dab042f
Instruction ID: eda060284c5582f4da6f40d979477db8943c8d54c597f8cf6ca36fac7fab0294
Opcode Fuzzy Hash: 4ef6eaf07820104f9393f5f4e565456643411fee630b8d1d385cff3e6dab042f
Instruction Fuzzy Hash: 51F1A935A043059FDF345EB489A93EB37A7AF52360FA9402EDC8697181D3748DC6FA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F124D5, Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78a62e27b6fc8c3415cbf4c913359151569b50c9eb0eb6b826a447e52b08252
Instruction ID: 374c3abfc77d6e56ea634c657930040756b1c08de6de213c0ac62666dfbf211d
Opcode Fuzzy Hash: f78a62e27b6fc8c3415cbf4c913359151569b50c9eb0eb6b826a447e52b08252
Instruction Fuzzy Hash: 74B17B715083468FDB216E348DA53DA7BA2BF53360F69465ECCC6C7192D3258886E742

Uniqueness

Uniqueness Score: -1.00%

Function 00F09056, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9d582d7e7c5b2ce2355b4a0a41d35b7545de0c39791481d9549318bd72f808
Instruction ID: 5eeee4776dc06ce7b7461ba78bf07849f01cb5a21bd269e6fb4b28192d7e7262
Opcode Fuzzy Hash: 1d9d582d7e7c5b2ce2355b4a0a41d35b7545de0c39791481d9549318bd72f808
Instruction Fuzzy Hash: C681497160430ACFDB24AE3489553EA3BA2BF56390F95461EDCC687294D330C985EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F0BFAE, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 321796d75ed5a68b075cd0caf48e6fa6eb76e5110ae4da56938e204e14519313
Instruction ID: 2c362a3ccb87419a8637bce68b83024afadc4778cd165e5c9ebaf56ecc66561a
Opcode Fuzzy Hash: 321796d75ed5a68b075cd0caf48e6fa6eb76e5110ae4da56938e204e14519313
Instruction Fuzzy Hash: A1613A7160430ACFDF20AE3489553EA3BA2BF56390F95461EDCC6C7294D734C986EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F012C5, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7569a0436b086cf044d5f235e7b0be80f7d0e1b716d44b88933db8347db52665
Instruction ID: 4ad38b969b70d20ebed58be3c78aaafcded9da4558a5328888cfd711dbf75945
Opcode Fuzzy Hash: 7569a0436b086cf044d5f235e7b0be80f7d0e1b716d44b88933db8347db52665
Instruction Fuzzy Hash: FD512971A0430ACFEF246E348D553EB3BA2BF56390F95461ADCC5C7194D335C986AB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F013D6, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 88ebd68b15449031ba2a757067d6fc41d830fdb8bdeab52cce9770a65c7097c5
Instruction ID: c89589a6f1f5e37bc8509803714d86c57a4c4ab3fee000a8102fb16aa944385c
Opcode Fuzzy Hash: 88ebd68b15449031ba2a757067d6fc41d830fdb8bdeab52cce9770a65c7097c5
Instruction Fuzzy Hash: CB513D7290430ACFEB209E348D553EB7BB2BF56390F96462EDCC597194D3318986A742

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EB21, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

8, xrefs: 00F0EAE8

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: 8
API String ID: 1029625771-4194326291
Opcode ID: 28fc9951545268c93fb872fc8ca52ae5472a8860df475e4c54737ec6db9a9381
Instruction ID: 895658636b56b0b92f6801bc0ea667aa5c8f13c4b85e1422d1c97261916bd929
Opcode Fuzzy Hash: 28fc9951545268c93fb872fc8ca52ae5472a8860df475e4c54737ec6db9a9381
Instruction Fuzzy Hash: 3C11E6B9909100CDCE3CDF79547674637A2BFC0364F86487ADC438A4B1E57A4895B9C2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EA99, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

8, xrefs: 00F0EAE8

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: 8
API String ID: 1029625771-4194326291
Opcode ID: 7cf0fceec003c88099ea520848d9c4343df829f0d7aa9afebef8f9f76ed7fd03
Instruction ID: bad66f06ad7e7846683b0e7cd15f906f5a66463af5780024ab97d427cf63039c
Opcode Fuzzy Hash: 7cf0fceec003c88099ea520848d9c4343df829f0d7aa9afebef8f9f76ed7fd03
Instruction Fuzzy Hash: 3D11E1B9A051009DCF3CEF79547774B73A1AFC0368F96883ADC038A4A0E56A4C94B9C2

Uniqueness

Uniqueness Score: -1.00%

Function 00F101B8, Relevance: 1.7, APIs: 1, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3a7b27d1dd733a7c7fd15cd3ef17720f1492b9d60f130d92de4c4f95db5412b3
Instruction ID: 76cc5bf5e96c56b2f9faa4e1a3d33cea6c938cb496c7d8e134d178b6c6595c03
Opcode Fuzzy Hash: 3a7b27d1dd733a7c7fd15cd3ef17720f1492b9d60f130d92de4c4f95db5412b3
Instruction Fuzzy Hash: BC4139747043069BDB209E7D99A07EB73E2AF86760F94863DEC8AC7295D73088C5B701

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B60B, Relevance: 1.6, APIs: 1, Instructions: 122networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,-F65E72D2,-8298B25A,518CFD8B,-5FFF4C64,?,?), ref: 00F0B66C

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: db1a38383f8460c024cd94a2897209aa60500f1aa0d65a91af2ac172f9bccca8
Instruction ID: 27c3ee83757d856438b1dcf4ed7465995fe8ea4f7145fc475bd793832877b344
Opcode Fuzzy Hash: db1a38383f8460c024cd94a2897209aa60500f1aa0d65a91af2ac172f9bccca8
Instruction Fuzzy Hash: 9A41D236909346CFDF34CE748D65BEA37A1EF51360F5A416ACC469B0A1E3328981FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F010F8, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00F01247,?,00000000,?,00F0AA11,?,?), ref: 00F01123

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 5182704c7a36eb0c4710baf0cfe39ef5a5894e2a322d20dd3fbc267baa047ab7
Instruction ID: 74e5247e15e0fd7d2b1b0b7482e8c2dcc041a362a23fdab72b3307f61beb7e00
Opcode Fuzzy Hash: 5182704c7a36eb0c4710baf0cfe39ef5a5894e2a322d20dd3fbc267baa047ab7
Instruction Fuzzy Hash: 7D11043120424ACBDB64AF38D8947AE37F5BF4A3A0F50402DEC8ACB281DB349585A702

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E9FE, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5216d6efcf3444afd559e7b787fe01fdbc0d94172401f2cc5cca16dd5f872380
Instruction ID: 17a7c2aa8ee30325910441b025ac6da2305d53baba668516b442e055e3ec1048
Opcode Fuzzy Hash: 5216d6efcf3444afd559e7b787fe01fdbc0d94172401f2cc5cca16dd5f872380
Instruction Fuzzy Hash: 1301D2B4B04209AAEF346E389C517EE73A6AFC4310F948439BC4AC2681C734C984B601

Uniqueness

Uniqueness Score: -1.00%

Function 00F02FD2, Relevance: 1.4, APIs: 1, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(-E1A31BC1,00000000,?), ref: 00F03291

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3c65f901c55f1db0e3b3d8ac15f4a808ed02398ad5e31167bc915cf2d650e431
Instruction ID: 52f64bf36a1418c9f0506515d9819bb68c8b02a0ad9f8d4e40fde3c30e83d34f
Opcode Fuzzy Hash: 3c65f901c55f1db0e3b3d8ac15f4a808ed02398ad5e31167bc915cf2d650e431
Instruction Fuzzy Hash: 47411332904300DFDF388F389DA77D337A7AF41394F55421ADC859A0E0E77A4A45EA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F02F1E, Relevance: 1.4, APIs: 1, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(-E1A31BC1,00000000,?), ref: 00F03291

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8a4fdc4f048321642751c553d365e9b4accd13f749cd4eb92e801e957064af54
Instruction ID: b0abd8d62fabcf9a04f9f9a10b76b6a69fece7190be86b7611c5343d51b9785e
Opcode Fuzzy Hash: 8a4fdc4f048321642751c553d365e9b4accd13f749cd4eb92e801e957064af54
Instruction Fuzzy Hash: 30312631604349AFDF305E28CE967DA37A7AF06790F54020A9D99571C1D73A4789FB03

Uniqueness

Uniqueness Score: -1.00%

Function 00F03116, Relevance: 1.3, APIs: 1, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(-E1A31BC1,00000000,?), ref: 00F03291

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cd7482e99e2ac9787d10c8520881b6e5735bf9f28d6002cb25afcf8d6f40938a
Instruction ID: 39efa12f0fa60f7b0815159c0750e76dee39c613e59c76a42ecf6b546dc62877
Opcode Fuzzy Hash: cd7482e99e2ac9787d10c8520881b6e5735bf9f28d6002cb25afcf8d6f40938a
Instruction Fuzzy Hash: FB3137359047009FCF388E388DB67C337ABAF45391F65421ADC569A1E0E7764A45FA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F03054, Relevance: 1.3, APIs: 1, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(-E1A31BC1,00000000,?), ref: 00F03291

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 19e7e79d225b645d3075a4a7741f1971fb015177e66d05e66acfaf8b93ccc874
Instruction ID: c3c507aa9ff502151b6cad5d144652f8989d45dcdf03f79130f005ea64834505
Opcode Fuzzy Hash: 19e7e79d225b645d3075a4a7741f1971fb015177e66d05e66acfaf8b93ccc874
Instruction Fuzzy Hash: 3F214531504348AFDF305F28DED67D63767AF02790F64030AACA95A1C1E73A4685FB02

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F0F293, Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

vNE@, xrefs: 00F0F3C7
D,Uq, xrefs: 00F0F339

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: D,Uq$vNE@
API String ID: 1029625771-2180908374
Opcode ID: 301e1a65dc5c6d87734c065b64114a703893c2a6ddd1bee8d4a093271eaa6b9c
Instruction ID: a9d98f9d8180d3dc94082f90ca909970463e91abe1e616e5e241854601092351
Opcode Fuzzy Hash: 301e1a65dc5c6d87734c065b64114a703893c2a6ddd1bee8d4a093271eaa6b9c
Instruction Fuzzy Hash: BF814876A047069FDB345D288DE43E73396AF95350FA4813ECC8687684D73588CEF682

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F3E5, Relevance: 2.7, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

o, xrefs: 00F0F4BF
vNE@, xrefs: 00F0F3C7

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: o$vNE@
API String ID: 0-3013816498
Opcode ID: 66dee773efdf56038cb3eb9caaed5193beb78144a034ba12c5bc34e9bb77a6d4
Instruction ID: 40265be74b72c77074b0d69c15573797ecefa3313ff3a7a15f7f86b52eb784c0
Opcode Fuzzy Hash: 66dee773efdf56038cb3eb9caaed5193beb78144a034ba12c5bc34e9bb77a6d4
Instruction Fuzzy Hash: AA51287AD04741CECF38CE38947539336A2BF81354F96423ACC429B464E3764D8AEAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F29B, Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

vNE@, xrefs: 00F0F3C7
D,Uq, xrefs: 00F0F339

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: D,Uq$vNE@
API String ID: 1029625771-2180908374
Opcode ID: 3b55ae6924ae1ff21f4745ea4abc4a0d5e05315b23c5063422a3542ddc116b70
Instruction ID: a583f6fe873f5ca8b1818aae96ed71ae20846cc3f44d1fb5afdbf7d86c360d65
Opcode Fuzzy Hash: 3b55ae6924ae1ff21f4745ea4abc4a0d5e05315b23c5063422a3542ddc116b70
Instruction Fuzzy Hash: C9514B76E00306CFDB348E6889B53D73362BF50364FA54139CC829B5A4D735898AFAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F04E55, Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: f6660211ed4f1492433e0de51848e0238107bf58cf3d650e7860ee0843938b90
Instruction ID: 6e64b80d05410364e6ef385047ce8a54fd089ff6c00caf12f66816b99d7a53f9
Opcode Fuzzy Hash: f6660211ed4f1492433e0de51848e0238107bf58cf3d650e7860ee0843938b90
Instruction Fuzzy Hash: 54121276604706DFDB28CE28C8A07DB77A2FF54750F55422DDC898B290E3B5A981EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F04F55, Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: 2b69614e1e30af933a9eb14d8a7b162a98d21c244729069976afb8857a6ad4cf
Instruction ID: d13673db0edfc152edb06036f63232e8a9e92bcb26b0971529070303e137ada7
Opcode Fuzzy Hash: 2b69614e1e30af933a9eb14d8a7b162a98d21c244729069976afb8857a6ad4cf
Instruction Fuzzy Hash: 89022476604B06DFDB28CE28C8A07DBB7A2FF54750F85422DDC8987290D7B19981EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F0507D, Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: c57f9988910a2384c6efc90ab7e5ef7e1d428c50db2fb4e3be771934df9b3420
Instruction ID: 4a3153c95e9eec9de8d25b4149cb9b0bae93982a1044945199ce2aea2d2728ce
Opcode Fuzzy Hash: c57f9988910a2384c6efc90ab7e5ef7e1d428c50db2fb4e3be771934df9b3420
Instruction Fuzzy Hash: A2F10271704B06DFDB24CE28C8A47DAB7A2FF58750F85422DDC8987280D7B1A981EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F06055, Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

.C1K, xrefs: 00F064A3

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: .C1K
API String ID: 0-874949410
Opcode ID: a71790f5d320d9b08b06520d9334845152856b2f48e3cc59b5fbb96e8190060c
Instruction ID: 18570682f10510cf38ab61ee1a98b130c19816f830e4130397fa096cd0b0e77b
Opcode Fuzzy Hash: a71790f5d320d9b08b06520d9334845152856b2f48e3cc59b5fbb96e8190060c
Instruction Fuzzy Hash: 3EE1327A604201CFCF38CF7988757D777A2BF50364F96412ED842DF060E7768896AA82

Uniqueness

Uniqueness Score: -1.00%

Function 00F050F1, Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: 276a89e92d184a5c1f423a180d123da3f345c1204d2f08733ebf5d8fb7fffc29
Instruction ID: 32e29156c6a591fea2e069f51c376ee2ceebacf9692fe5cb5013612e8b28b36b
Opcode Fuzzy Hash: 276a89e92d184a5c1f423a180d123da3f345c1204d2f08733ebf5d8fb7fffc29
Instruction Fuzzy Hash: C4F1F175704B06DFDB28CE28C9A47DBB7A2FF54790F55422DDC8987280D7B0A981AF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F051D4, Relevance: 1.6, Strings: 1, Instructions: 374libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: 931937bfdb1546f12b5c98d938cb718cccb4fcedd1ecd3a573422a90f8c154df
Instruction ID: 1405bc123224d0d7178b334273ca7013c00735b616a006ef2210826c5a077f4d
Opcode Fuzzy Hash: 931937bfdb1546f12b5c98d938cb718cccb4fcedd1ecd3a573422a90f8c154df
Instruction Fuzzy Hash: 61D10471704B06DFDB24DE28CDA47DBB7A2FF49750F58422DDC8987280D770A981AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F05297, Relevance: 1.6, Strings: 1, Instructions: 349libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: 5e03c22cb7a45848349b378203f328b2302df0343bbbfbad090fcf1a547388de
Instruction ID: 2615b05a228e13caa296434ec108af2801e7e58b6423b75377875d637193ca0d
Opcode Fuzzy Hash: 5e03c22cb7a45848349b378203f328b2302df0343bbbfbad090fcf1a547388de
Instruction Fuzzy Hash: EBC1137170470A9FDB24DE28CD947EB73E2FF497A0F59422DDC8987280D7B09985AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F05325, Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: 9d4dcfd5d305d5387a6b08b91e01058eb45efeb78b053c01017272a39d27b189
Instruction ID: 3274ea43c9805a7ad29427668f0550bf909498d7219844fc2120c9c7a79f90ba
Opcode Fuzzy Hash: 9d4dcfd5d305d5387a6b08b91e01058eb45efeb78b053c01017272a39d27b189
Instruction Fuzzy Hash: 10C1027270470A9FDB24DE28CC947EB73A2FF45760F59422EDC8987280D7B09985EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F05455, Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: 20f2e66dd51098db6225de683ffcd1334b6e3285951899bace47ece80d4ce4e2
Instruction ID: e834028affb85ba699b7a9b02bc1ae563d680f203ac35f75228618ff0c430eaf
Opcode Fuzzy Hash: 20f2e66dd51098db6225de683ffcd1334b6e3285951899bace47ece80d4ce4e2
Instruction Fuzzy Hash: 30C12375604B069FDB24CE28CCA47DB73E2FF44760F59422ADC8987290E7B19981EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F05360, Relevance: 1.6, Strings: 1, Instructions: 317libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: 40add18c557ba412a96a7b2b4d72f93a4e9e946d4fb7b704277ef275eed0b37b
Instruction ID: b067bc0dbbdc9fdceecde9083223fa3a10069cb68aead659702d5a535fbc72d8
Opcode Fuzzy Hash: 40add18c557ba412a96a7b2b4d72f93a4e9e946d4fb7b704277ef275eed0b37b
Instruction Fuzzy Hash: 7FB1337170470A9FDB249E28CC947EB73E2FF45760F59422EDC8987280D7B09985EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F053D5, Relevance: 1.6, Strings: 1, Instructions: 306libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: c19f23c0ce5594ce3f5905dd03859ffb58f8cbd3a3dc72227dc16a96d2c168a0
Instruction ID: f8ff296bb5bd4928224813960c5093bd1c9eab6771ad9e03071ddacbe2916298
Opcode Fuzzy Hash: c19f23c0ce5594ce3f5905dd03859ffb58f8cbd3a3dc72227dc16a96d2c168a0
Instruction Fuzzy Hash: 1BB1227260474A9FDB24DE28CC947EB73E2FF45760F59422EDC8987280D7B19981EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F0555D, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: 4374d83f36e6cb4ee52cfc150e603b6fa32904ac8f9136aaf6146c7cc1895267
Instruction ID: a5accbcc611a384cdd7b589ae10c3fdbdeb834d094cd78fd6640ec6426f2d561
Opcode Fuzzy Hash: 4374d83f36e6cb4ee52cfc150e603b6fa32904ac8f9136aaf6146c7cc1895267
Instruction Fuzzy Hash: 19A12471604B0ADFDB249E28CC947EB77E2FF05750F494229DC8987280E7B59985EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F054F5, Relevance: 1.5, Strings: 1, Instructions: 267libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: cE*
API String ID: 1029625771-336441071
Opcode ID: e144a1af78e5d71ac869455abd9bd7edb20db0fb3beaca275cc66ffedcd984b3
Instruction ID: 48b9ce8a6a8888036d7d374b5f28136a2d8a2c738031d168519e282cf387d7df
Opcode Fuzzy Hash: e144a1af78e5d71ac869455abd9bd7edb20db0fb3beaca275cc66ffedcd984b3
Instruction Fuzzy Hash: 5DA12171604B0ADFDB249E28CD947EB73E2FF05760F49422DDC8987280D7B59985EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F055C6, Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: e2eb81d105e8764c58fb9b2423d144ed05ef0ad66a42f05660813062e4e90059
Instruction ID: a92cede499843af65e902f335929eda3bad59eaa33d5128acfd3e8709128ab55
Opcode Fuzzy Hash: e2eb81d105e8764c58fb9b2423d144ed05ef0ad66a42f05660813062e4e90059
Instruction Fuzzy Hash: D8913372604B06DFDB28CE28C8A47DB73E1FF05750F45422ADC8987290E7B59955EF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F047A1, Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

CO3j, xrefs: 00F04BAF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: CO3j
API String ID: 0-2318339908
Opcode ID: b4ee0ae3815478616ff6aa44a23d3bb9cef7705571ad6487e9ceb58def5a64cc
Instruction ID: 2667385ceeecfefd92fcea0e2c03f270ebb08bc7cae42d1bc845324da57605e8
Opcode Fuzzy Hash: b4ee0ae3815478616ff6aa44a23d3bb9cef7705571ad6487e9ceb58def5a64cc
Instruction Fuzzy Hash: A49147B1A04345CFCF388E3888657EB77A2BF90350F92451EDD8697290D7315986EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F063A1, Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

.C1K, xrefs: 00F064A3

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: .C1K
API String ID: 0-874949410
Opcode ID: 63db04e08c9795f7d30e96715d441d4f7a8b64d1eecb7f1e065bb3e566689e0e
Instruction ID: f3d5571df0af217102e24422e9fe803ccf84746bd8a0c2f109ffbcc50144726b
Opcode Fuzzy Hash: 63db04e08c9795f7d30e96715d441d4f7a8b64d1eecb7f1e065bb3e566689e0e
Instruction Fuzzy Hash: CC714876508301CFCF38DF7488A57EA36E2EF54360FA6802DDC86DB051D3758891EA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F06443, Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

.C1K, xrefs: 00F064A3

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: .C1K
API String ID: 0-874949410
Opcode ID: ab338033a141e233bb223be4cbc042765491b927a73a9414b6812885bf1d18b0
Instruction ID: 41cbee85edaf0a95abfba46b0e6eb3f1c186c4662b6cb1fcea503d72857a37ed
Opcode Fuzzy Hash: ab338033a141e233bb223be4cbc042765491b927a73a9414b6812885bf1d18b0
Instruction Fuzzy Hash: 1A712576604305CFCF389F7588A47EA76E2AF54360FA6802EDC86DB055D7718891EA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F047E6, Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

CO3j, xrefs: 00F04BAF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: CO3j
API String ID: 0-2318339908
Opcode ID: 8918662803fcb1fa7929cff2c95a813312214f7c96629e0d4af014052d080429
Instruction ID: 212d667dcff0d475b16193380bd49783eee689290af2a028cdf4749498d0dffc
Opcode Fuzzy Hash: 8918662803fcb1fa7929cff2c95a813312214f7c96629e0d4af014052d080429
Instruction Fuzzy Hash: 1C8175B16083468FDB385E38CC957EB77A2AF94790F91450EDDCA87280D7305986EB03

Uniqueness

Uniqueness Score: -1.00%

Function 00F049BE, Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

CO3j, xrefs: 00F04BAF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: CO3j
API String ID: 0-2318339908
Opcode ID: dceb232ddaa92d0e9da5b3d46ef96fa99891ee7ca778f7e1ced61d7dd05631c3
Instruction ID: 149ceb11d8c407ce5738a58112189f081d8788b4541999ec63a9a77c07fb2f07
Opcode Fuzzy Hash: dceb232ddaa92d0e9da5b3d46ef96fa99891ee7ca778f7e1ced61d7dd05631c3
Instruction Fuzzy Hash: 847178B1A04345CFCF38CE688CA53D777A2BF90354F52412EDD468B190E7755986EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F05869, Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

cE*, xrefs: 00F058AF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: cE*
API String ID: 0-336441071
Opcode ID: f29449c5824bb1435e36f24f5861e5208c313c37c8e655b5dab5997a63eff11e
Instruction ID: 341d7072e4b211f37c2bbb46ff21d19a2a6e763d8c76dc79bf1efa5cb59ccf0f
Opcode Fuzzy Hash: f29449c5824bb1435e36f24f5861e5208c313c37c8e655b5dab5997a63eff11e
Instruction Fuzzy Hash: E171EAB5600B06CFDB28CF2988A47C777E1BF44750F46422ACC468B290E7B59952EEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F04929, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

CO3j, xrefs: 00F04BAF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: CO3j
API String ID: 0-2318339908
Opcode ID: f5b059cc9ca571e6faca4865d42c3f1d949daf87a82ffbfcf8405c9e8c24d0fc
Instruction ID: 1ab10ea084c2408d46bea2008f706eb18956f0208b8ac10da539fe0d0d220e05
Opcode Fuzzy Hash: f5b059cc9ca571e6faca4865d42c3f1d949daf87a82ffbfcf8405c9e8c24d0fc
Instruction Fuzzy Hash: 09616CB1504345CFCF388E28CCA53EB77A2BF95350F91412EDD8A87290D7315986EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F04ACA, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

CO3j, xrefs: 00F04BAF

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: CO3j
API String ID: 0-2318339908
Opcode ID: e19d2f019ad4af53c990c48e57c09d4eb962e835e2e19f7efab442ae9b46b3d2
Instruction ID: e46365b49e0591b4c48ff2c7decf5e9911735f4350c619282f39d4fa8fb07e2b
Opcode Fuzzy Hash: e19d2f019ad4af53c990c48e57c09d4eb962e835e2e19f7efab442ae9b46b3d2
Instruction Fuzzy Hash: 346168B6A04244CFDF38CF3898B57D737A2BF90344F51402EC9468B190E7729986EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F372, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

vNE@, xrefs: 00F0F3C7

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID: vNE@
API String ID: 0-4005984838
Opcode ID: 13e2e605c1d207b130bad1fab4a9b4be25cbfcde1d65f30a9510b218e3591536
Instruction ID: 7a7783d23b69f4f8435e94f8c96a61398698630c43736afafeeb45ee92c1a4d5
Opcode Fuzzy Hash: 13e2e605c1d207b130bad1fab4a9b4be25cbfcde1d65f30a9510b218e3591536
Instruction Fuzzy Hash: 96413976D00302CECF388D7899A53D33266BF91354F96423ACC8297554D3364D8EEAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F01D8D, Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869dca8b90f0aa852f142cbeafcfc070684514c4268adf9b2a9ab0a54a7423b6
Instruction ID: 82fff63506d7b307f5ff18374e2c91afa3fd8491778712519b9a574f684b5dae
Opcode Fuzzy Hash: 869dca8b90f0aa852f142cbeafcfc070684514c4268adf9b2a9ab0a54a7423b6
Instruction Fuzzy Hash: 83E1CC39A003059FDF345EB489A93EB37A3AF52360FA5402EDC8697181D3748DC5FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F01DF5, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91d3022d383d5f4598ad74b9eeb16e906eae2be63387c194fd062fc5623cc51
Instruction ID: 9a5facd85997aecbfb232fc594e66408585a65dc311d175c894f8624bc029017
Opcode Fuzzy Hash: f91d3022d383d5f4598ad74b9eeb16e906eae2be63387c194fd062fc5623cc51
Instruction Fuzzy Hash: A1E1CB36A043059FDF345EB489A93EB37A3AF52360FA5402EDC8697181D3748DC6FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F01F39, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce985251c67f5148a8d8edafb1c8636a5c3982e5689d8a4c60649d8dc78ea227
Instruction ID: 84df8116a13b8c38a6238ee0aa71ed8d7dd26f71782ab0a9cd1ba7fcb032767d
Opcode Fuzzy Hash: ce985251c67f5148a8d8edafb1c8636a5c3982e5689d8a4c60649d8dc78ea227
Instruction Fuzzy Hash: CDD1C836A043059FDF345E7489A93EB33A7AF92360FA5402EDC8697181D3748DC5FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F02086, Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9430e4d7a97d43518d864e4600406c971910585268e8463e264176acd33a3f9f
Instruction ID: 8a79c7b7d9749d7e3741fe2802fc55f1a88505c75382ff28ae6785d26b208a86
Opcode Fuzzy Hash: 9430e4d7a97d43518d864e4600406c971910585268e8463e264176acd33a3f9f
Instruction Fuzzy Hash: ADC19936A043059FDF348E748DA93EB33A7AF56360FA9402EDC8697181D3348985FB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F10435, Relevance: .4, Instructions: 365libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: acadd648af0f09bb79539356eaf0d2b61798764d3728d63a2be54d14e76dd218
Instruction ID: c038fe91da96ffc9cf3c00dc617dd5a67a0c7b5fe6fa3a65a5987df08ea722ca
Opcode Fuzzy Hash: acadd648af0f09bb79539356eaf0d2b61798764d3728d63a2be54d14e76dd218
Instruction Fuzzy Hash: 64C127115083828EDB218B7889987D67BD25F13370F59C3EACC954F1E7E7A588C6E712

Uniqueness

Uniqueness Score: -1.00%

Function 00F103F4, Relevance: .4, Instructions: 358libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Part of subcall function 00F10C21: NtProtectVirtualMemory.NTDLL(-E1512D40,0000003A,0000003A), ref: 00F1147F

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: c55a36f9d860e3af0df3f1f5849f82f5649aca944200e54e661202848660dceb
Instruction ID: b64da06c4b403625883112d2febc3adf54ebac3d08228b724761a2f6d66691e2
Opcode Fuzzy Hash: c55a36f9d860e3af0df3f1f5849f82f5649aca944200e54e661202848660dceb
Instruction Fuzzy Hash: 5CC128115083828EDB218B7889987D67BD25F13370F59C3E9CC954B1E7E7A584C6E712

Uniqueness

Uniqueness Score: -1.00%

Function 00F0212D, Relevance: .4, Instructions: 352libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b2d8108b784c907cf980d601d4eb463c5269657a3f3d35a59e3a6aa496563754
Instruction ID: 5fe1fadf1f7cde8b5f5e24f7e06cd09851840b29317cfb628e2e9c60de18a2a4
Opcode Fuzzy Hash: b2d8108b784c907cf980d601d4eb463c5269657a3f3d35a59e3a6aa496563754
Instruction Fuzzy Hash: C2B1B935A043059FDF749E788DA93EB32A7AF52360FA5402EDC86D7181D3348D85FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F104F9, Relevance: .3, Instructions: 324libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F10C21: NtProtectVirtualMemory.NTDLL(-E1512D40,0000003A,0000003A), ref: 00F1147F

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 484b0ae342086da24d8efa33e8cbed98594d696a998a2c2e386eef556684107e
Instruction ID: 4163b727f907762251c397af18a2e11c1cbacdec54afb03c1b6f505b099d560a
Opcode Fuzzy Hash: 484b0ae342086da24d8efa33e8cbed98594d696a998a2c2e386eef556684107e
Instruction Fuzzy Hash: 2DB115115083828EDB228A7889997D67FD25F133B0F59C3EACC950F0E7E7A584CAD712

Uniqueness

Uniqueness Score: -1.00%

Function 00F02204, Relevance: .3, Instructions: 308libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b48483ad69cbc8d2d8c8f45d07beb43909e0fd46a887bd659f6c49932b29582
Instruction ID: 3c7c3bb37a0876a554c94b5f33576f72a555a10b18fab5dcba7bb0b770da0869
Opcode Fuzzy Hash: 4b48483ad69cbc8d2d8c8f45d07beb43909e0fd46a887bd659f6c49932b29582
Instruction Fuzzy Hash: 06919935A043069FEB345E748DA93EB32A7AF56360FA4442EDC86D3182D734C9C5FA12

Uniqueness

Uniqueness Score: -1.00%

Function 00F1058A, Relevance: .3, Instructions: 301libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F10C21: NtProtectVirtualMemory.NTDLL(-E1512D40,0000003A,0000003A), ref: 00F1147F

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: f759c3e074be2521dce9f82d2c123049faaa64f1a025260b9ca91b46b8e58679
Instruction ID: b99e8973dcefe869d37c5083f99fb8caa07fe28a0b0a66cac0efb82c211c1934
Opcode Fuzzy Hash: f759c3e074be2521dce9f82d2c123049faaa64f1a025260b9ca91b46b8e58679
Instruction Fuzzy Hash: 54A116115083829EDB228A78899C7D66F925F133B0F5AC3E9CCD51F0E7E7A544CAD712

Uniqueness

Uniqueness Score: -1.00%

Function 00F10605, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e725b5d6a5086d76e368bb88dcd1c70ddbf37ccd02101657df3b71240b0e3055
Instruction ID: feca06037ac5ce22543dc56206e6904f9f17bd3c8782a851b71bfde3819d496f
Opcode Fuzzy Hash: e725b5d6a5086d76e368bb88dcd1c70ddbf37ccd02101657df3b71240b0e3055
Instruction Fuzzy Hash: 8AA1F3115083828EDB228A3889997D27FD25F133B4F5AC3EACCD50B0E7E7A5448AD712

Uniqueness

Uniqueness Score: -1.00%

Function 00F023CA, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2e2826ec16c3dc5cca264d9b64170460b0e450cc5aa361ecf5eea499ecfb57
Instruction ID: 06221ea1a0cafb239cd050512b0791d85e1bfa659a08020c4e9b76c1cc3db04d
Opcode Fuzzy Hash: 8e2e2826ec16c3dc5cca264d9b64170460b0e450cc5aa361ecf5eea499ecfb57
Instruction Fuzzy Hash: 4E91CD39A043019FDF789E7489B93E732A6AF52360F95402ECC86C7091E3758C85FA92

Uniqueness

Uniqueness Score: -1.00%

Function 00F02299, Relevance: .3, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dd1898a33935af7e3c0344ff757ae1520bd41c2b2ea913ec509b8bb64a38271e
Instruction ID: c6d5c296d1ef440aa4dbeb1409d453f29a12fe6210f530c4fc3bc907386a2c61
Opcode Fuzzy Hash: dd1898a33935af7e3c0344ff757ae1520bd41c2b2ea913ec509b8bb64a38271e
Instruction Fuzzy Hash: B891A935A043069FDB355E748DA93EA3796AF22360FA5442EDC8693182D734C9C5F612

Uniqueness

Uniqueness Score: -1.00%

Function 00F10685, Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc9b7b99e3dbe3338dd6eab1dee3c3c4a9c09ebfc45531ffe46224e1c011073
Instruction ID: f5dd7acc8158badf2b0e30f1649374eb9b530d527327bd3113f918633a55082a
Opcode Fuzzy Hash: 0cc9b7b99e3dbe3338dd6eab1dee3c3c4a9c09ebfc45531ffe46224e1c011073
Instruction Fuzzy Hash: 76A1E3115083828DDB228A78899D7D67E925F133B4F59C3E9CCD50F0E7E7A684CAE712

Uniqueness

Uniqueness Score: -1.00%

Function 00F0ACA3, Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c37d2eb33136278127595149f2d2522e42eb9e19a6fe507beff0efb3e5f5a7c
Instruction ID: 47ea7c27fe332a45dab56c1bb5ceee90845a446a8873c7589b376d14054beb96
Opcode Fuzzy Hash: 9c37d2eb33136278127595149f2d2522e42eb9e19a6fe507beff0efb3e5f5a7c
Instruction Fuzzy Hash: DF81793A505201CECF29DFB558706C67BB2FF80354B56436AC8429B1A2D7768887FBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00F0DDF1, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f010e2640ebe46a730e324757a4344110d5b4282c9348fecad4431f407f1523f
Instruction ID: 74ac7711c34f9d7ad2d414d477ebc28a45fc116d81c9cd9aef34009c781a757e
Opcode Fuzzy Hash: f010e2640ebe46a730e324757a4344110d5b4282c9348fecad4431f407f1523f
Instruction Fuzzy Hash: C181A27A915101CECE3CCFB9947668277A1FB90369756856AC403CF0B0E6B64C97BEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F02382, Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f904cda7ca1816b148f1c7578e5b414e12df48a0dbb6532af032fd089931d2
Instruction ID: e4c1662b21fdb5ee173d06fd148544c8d7e97ce99f2a3e5035d9a49f339f47d6
Opcode Fuzzy Hash: b5f904cda7ca1816b148f1c7578e5b414e12df48a0dbb6532af032fd089931d2
Instruction Fuzzy Hash: 5981BB35A043069FDF389E748DB93EB32A6AF52360F95402EDC86C7181E73589C5FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F106D0, Relevance: .3, Instructions: 260libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 42d8d007102cf0fe858a463b7a92fb0e80183018b90f6243091ae6ee99456456
Instruction ID: 2cf054557162140fa98318eb3c7938b93056d2c08ac2e6011015949fa7352f7c
Opcode Fuzzy Hash: 42d8d007102cf0fe858a463b7a92fb0e80183018b90f6243091ae6ee99456456
Instruction Fuzzy Hash: 0191D3115083828DDB218B78899D7D6AF925F133B4F5DC3E9CC950F0EBE7A6448AE712

Uniqueness

Uniqueness Score: -1.00%

Function 00F0D5F1, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530eb998cdd367840c2da9852dcfb2f10d55791bc6da023c3d992fff9bba74d8
Instruction ID: c6b19e727ce437e9e3e9a42c6cc6a4e2334bf40c1daa1358ab389425f115ed97
Opcode Fuzzy Hash: 530eb998cdd367840c2da9852dcfb2f10d55791bc6da023c3d992fff9bba74d8
Instruction Fuzzy Hash: 8B81647A915500CECE3DCFF9587625273A1FB503687AA516AC806CF0B4E26B4897FDC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E496, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f031342861bcdacfb0b687aa99ce0c01d82f1e9dc77d63bfeb517ae821c1f6
Instruction ID: 2fb6a6c241c608beb7ab839226b029baa95bac8a3f93804f59e4969839dca4f7
Opcode Fuzzy Hash: b3f031342861bcdacfb0b687aa99ce0c01d82f1e9dc77d63bfeb517ae821c1f6
Instruction Fuzzy Hash: 5871707A926500CECE3CCF79687625273A1FBA035C79A4D6AC042DF0B0F5A65897BDC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F10741, Relevance: .2, Instructions: 248libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,00003847,00000000,00F008F8), ref: 00F0EB85

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 890d7fbf7309fa15a018b6cd2551c618f35b60b3df451e91277961d5a884c5bc
Instruction ID: 38d49852da363ed49d40293b3d9f292c48a20443056daca12f44fe099c437289
Opcode Fuzzy Hash: 890d7fbf7309fa15a018b6cd2551c618f35b60b3df451e91277961d5a884c5bc
Instruction Fuzzy Hash: C181E5115083828DDB218A78899D7D6BBD25F133B4F59C3E9CC950F0DBE7A684C6E712

Uniqueness

Uniqueness Score: -1.00%

Function 00F0D4F5, Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877a4673418df60856c080fa7ebdaba610add38d70243886454190f456433dbb
Instruction ID: d9348f9b115bafb44125af7a3a028201810d0bbe083544f12e9a302e2e335db4
Opcode Fuzzy Hash: 877a4673418df60856c080fa7ebdaba610add38d70243886454190f456433dbb
Instruction Fuzzy Hash: E5819F3A915600CECF3DCEFA547635377A1BB90368B66416AC806CF0B0E6A64D96FDC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F024A5, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a1b54456070afe23887386d92b82c642058446d72bcfdea3995cb4d4d717a0
Instruction ID: 98c15d170fd448b5ed62743973af06d8a4e9c91bbd43e0482e9cab3a6f2e3df1
Opcode Fuzzy Hash: b3a1b54456070afe23887386d92b82c642058446d72bcfdea3995cb4d4d717a0
Instruction Fuzzy Hash: BC71DE35A043019FDF749E744DB93EB7296AF52360F99842ECC82C7091E36588C6FA92

Uniqueness

Uniqueness Score: -1.00%

Function 00F023F8, Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d2530f06eb1ed98327f349ad9dca7a62dba53f56a616de820809c348656cac
Instruction ID: 4a1240824a4971eb2f42ea5838d14f933a0df9f4fa6111e161457dc4f80224ed
Opcode Fuzzy Hash: 72d2530f06eb1ed98327f349ad9dca7a62dba53f56a616de820809c348656cac
Instruction Fuzzy Hash: EF71AC35B043169FEB346D648DA93EB3296AF66360F98442EDC86C3181D734C9C5FA12

Uniqueness

Uniqueness Score: -1.00%

Function 00F05E76, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de497ef6ce17d5b45fac099229c0518b68f5828082e9347cf353c8cd421c4de
Instruction ID: 352fac2491eaf6076b87e87b7cf82008b9c4808d01627cb7ff8b51d2125471eb
Opcode Fuzzy Hash: 5de497ef6ce17d5b45fac099229c0518b68f5828082e9347cf353c8cd421c4de
Instruction Fuzzy Hash: E3716776604605CFCF38CF288865BD737A6BF91350F55412EDC45CB280E7769D4AAB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F045A5, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f791a9afcd4ed52ccf7ef966910553184ab52c288f62e81ef839d7b6197ae50
Instruction ID: 8d12934e2bc64dc857ba7a68eab4d088d8a1f40211eae09a84666c353fb87324
Opcode Fuzzy Hash: 4f791a9afcd4ed52ccf7ef966910553184ab52c288f62e81ef839d7b6197ae50
Instruction Fuzzy Hash: BF7136BA904240CFCF38CF389C253D233A2BF41358F96416ACD469B1A0E7365996BEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F05D8A, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6ac5420e6cf5f2e7f926895b405c1b0bb49083fea631ab6fb36846c70d0bf1
Instruction ID: 2a95197ff575a4bfad5cef2a7c6ad01d70268dfbb18731dfbcfeb64952ee9a1d
Opcode Fuzzy Hash: 8c6ac5420e6cf5f2e7f926895b405c1b0bb49083fea631ab6fb36846c70d0bf1
Instruction Fuzzy Hash: 7D715A72704605DFDF388E28C8A57DB37A6BF56350F61422EDC89CB280D7759D86AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F0335D, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef22c17908979c879a244ad71da6119560df52ae835492394d136a6046ee1e3
Instruction ID: 973dd3a1403ae6cb9f977a79285884dd758d8eb08caa45f1fdd806203610e5c9
Opcode Fuzzy Hash: 9ef22c17908979c879a244ad71da6119560df52ae835492394d136a6046ee1e3
Instruction Fuzzy Hash: 53610175B08741CFDB24DE3989A47EBB7F6BF94380F56802DDC8987164D7314A82AB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F108E1, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755e8b3713733f6a7993596c68db29107b26f2779bc4d8e33c20a726e73c3eeb
Instruction ID: a6457561d0ffbaa41ca6cb242e861a76cd308e2353f14e0870c010ce034857aa
Opcode Fuzzy Hash: 755e8b3713733f6a7993596c68db29107b26f2779bc4d8e33c20a726e73c3eeb
Instruction Fuzzy Hash: 4E5159118083824ADF258E7889997D7BB925F133B0F59C3A9CC925F0DBD7A644C6E613

Uniqueness

Uniqueness Score: -1.00%

Function 00F0656F, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc865055286b2daa7af5e85cfc62dfa34137b81a5362a11184755e4206f54c4c
Instruction ID: 822838518fb99f8716ae4d502c34ea2060c3292621cc68bcfd4e76927653ca47
Opcode Fuzzy Hash: bc865055286b2daa7af5e85cfc62dfa34137b81a5362a11184755e4206f54c4c
Instruction Fuzzy Hash: B7511776604306CFCF349E758CA43EB37E2AF55360FA5402EDC86DB055E7718991EA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F064CD, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5733f14f5279e7a72b79332832db126a10a39dae201faf69176d9e38516d2716
Instruction ID: 3978edd4c216aee5dc2184742f9a95e00f9bf3b60cd3aa95f6dff79f2fb091fc
Opcode Fuzzy Hash: 5733f14f5279e7a72b79332832db126a10a39dae201faf69176d9e38516d2716
Instruction Fuzzy Hash: 26511576604305CFCF389E7588A47EB36E2BF55360FA6802EDC86DB154D7718891BA42

Uniqueness

Uniqueness Score: -1.00%

Function 00F025F9, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1266a25510d019b565e2b954f75ae6cd6ec0700fe09158c2cd0d07d597d1e17a
Instruction ID: f44168b052810e784cd5a8212537e18213310b11f56b6b613885c8ec25152e9c
Opcode Fuzzy Hash: 1266a25510d019b565e2b954f75ae6cd6ec0700fe09158c2cd0d07d597d1e17a
Instruction Fuzzy Hash: 0251DA35A04302CFDF34AE7189B93EB32A6AF52360F55842EDC8287191E7758985FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EBAA, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dcb81a5eb4f80d18b5c7b77d67d7fd373e8e952fe3c58b9f4aee2dc9965baa
Instruction ID: d836a71fcaca0155c94bf812619116f1e0fb64862272477b6c5951c14145318d
Opcode Fuzzy Hash: 66dcb81a5eb4f80d18b5c7b77d67d7fd373e8e952fe3c58b9f4aee2dc9965baa
Instruction Fuzzy Hash: 1A51C17AA05600CFCF2CCF3994B578377A2FF90354B97896AC8469F160E2729D55EAC0

Uniqueness

Uniqueness Score: -1.00%

Function 00F0FE35, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001d15c9716934398e00f5f3f0f580a5037226ae0e1fb63ff1a40684b88f0e6d
Instruction ID: a6ce6a39a40ebc45ed8c16b8fd9158cce8db08fb8790a889647aefd5d893b859
Opcode Fuzzy Hash: 001d15c9716934398e00f5f3f0f580a5037226ae0e1fb63ff1a40684b88f0e6d
Instruction Fuzzy Hash: EB41D37E914501CECE3CCEBA507675332A5BB81369B97863AC8029F470F5A64C8ABDC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F044A3, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0097aa57170223a1e910ced985d25625ec6ed3ab1e76098664e92eedb8e14f69
Instruction ID: f112045d9edad1c7c4a6e0567f04d76c932edd273ce756acee18d7959f6ba4aa
Opcode Fuzzy Hash: 0097aa57170223a1e910ced985d25625ec6ed3ab1e76098664e92eedb8e14f69
Instruction Fuzzy Hash: D15149BA904245DFCF38CF788C653E637B2BF40354F96412ACC8A9B1A4C7351986AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F033A9, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77329613ab56e7db98ba3aa6204f2de11ad38a22bf988eea43f5bf898b6129e5
Instruction ID: ad91c85909047004ad5e88289d80ac24171d47337145ee9fa097a9425bc6f22f
Opcode Fuzzy Hash: 77329613ab56e7db98ba3aa6204f2de11ad38a22bf988eea43f5bf898b6129e5
Instruction Fuzzy Hash: 5451CE35B08745DFDB24EE798D947EEB7E2AF99380F55802DDCC993158D7304A81AB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F109E1, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b5575256d14f49fb40e3cbaecf395ca8fd4e673aac89f2dc9fbbc2811978e3
Instruction ID: 1b927e0699cbec7b1405f99bb1317cd66a870c3a2117f7b6b9606109c6480bb5
Opcode Fuzzy Hash: d1b5575256d14f49fb40e3cbaecf395ca8fd4e673aac89f2dc9fbbc2811978e3
Instruction Fuzzy Hash: 2C4147218083824ADF258E7889997D7BBD29F533B4F55C3A9CC924F08FD7AA44C6D613

Uniqueness

Uniqueness Score: -1.00%

Function 00F0DEF9, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc85da8976e03820a1162af974577fd350c3c843361685b07bf9adeea49a7c9
Instruction ID: 1ab8946526e4e70f56ca72efc56ad43b85ec83d14599d6fad8b164b91dfb00d4
Opcode Fuzzy Hash: 8fc85da8976e03820a1162af974577fd350c3c843361685b07bf9adeea49a7c9
Instruction Fuzzy Hash: 8351A07A915101CECF3CCE76547674377A5BB80359B57C96AC8039F0B0E2B25D46BAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0DCE9, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f491dc3d26e31b8380322ab9e16da33fd995e083e869e37e0314f0ff92f6db7f
Instruction ID: 1faefb0c6fc0b269f029c6f34ba7cae1d083711ee456450087744e48079bd57d
Opcode Fuzzy Hash: f491dc3d26e31b8380322ab9e16da33fd995e083e869e37e0314f0ff92f6db7f
Instruction Fuzzy Hash: 8F41B67AA09200CFCF3DCFA594B579377A5BF90358B66446BC8028F1A0E6755D42FAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0ECB5, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695432de90b10b4d9b4d56a944366779a0d9d8807c9cce74a8e500cc9375b7b4
Instruction ID: 8ca3462f20e6def50873c797e3a959de79877490306e6c36003c2e4b6a1355ca
Opcode Fuzzy Hash: 695432de90b10b4d9b4d56a944366779a0d9d8807c9cce74a8e500cc9375b7b4
Instruction Fuzzy Hash: 6941DF7A902500CFCF2CCF3994B274377A1FF90358B574D6AC8429F1A0E2629C96BAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E699, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f006b02b2950102b3432c162b662890a8dfce8eddd1a18234feb5e4a3846415c
Instruction ID: 4c3e20315cb35163ac5a9da45165a8b5a11142c80f32561aee58701bfd6b6314
Opcode Fuzzy Hash: f006b02b2950102b3432c162b662890a8dfce8eddd1a18234feb5e4a3846415c
Instruction Fuzzy Hash: DC41B07AA15200CECF3DCF76947674332A2BF90358B57496EC4128F0B0E6B65956FAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0FE19, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b366cbf57cac6d8e22a33915099952634955291ff75eef5040ba17fd9d305f
Instruction ID: 7343b0d10cb640d3af6a122c2381de3899ac907ad18994bdb8d7c4c37d4a081c
Opcode Fuzzy Hash: d3b366cbf57cac6d8e22a33915099952634955291ff75eef5040ba17fd9d305f
Instruction Fuzzy Hash: 3C31FB6E914102DECE3CC9B904763A732956F81365FA6823BCC429B474F59688CABCC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F4F9, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b64331861e51d9c7a21b879f852602c4aaafcd660fa11deaf07e6905c4f4e4
Instruction ID: 01b9970064f8c8c2140d9b180838e01ad9de8c9fa88133e8feb5ef03b6db5230
Opcode Fuzzy Hash: a2b64331861e51d9c7a21b879f852602c4aaafcd660fa11deaf07e6905c4f4e4
Instruction Fuzzy Hash: A341F976D00305CECB398E2899A53D333A6BF55324F56423ACC814B5A4D7764D8EEAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F10A75, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac2bc62d25b157e9bffa0bc5cd0c0fa14cbc35278737ac308056a4a3d8730af
Instruction ID: 3da9985c3de8529a3c021df5595bc3a471b4918552bba6d91aefa74579897202
Opcode Fuzzy Hash: 6ac2bc62d25b157e9bffa0bc5cd0c0fa14cbc35278737ac308056a4a3d8730af
Instruction Fuzzy Hash: 154114658083828ADF259E7888997D7BAD25F533B0F19C2A9CC924E0CFD7B644C6D613

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EED5, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2222e0b6f47d0846e55273db6ab7611a6b94abcd5aee9b6d74c99a7859511ba6
Instruction ID: 81f783f9fbc528279466fa7561af5b0532741200fa35907504663aabcfa41a62
Opcode Fuzzy Hash: 2222e0b6f47d0846e55273db6ab7611a6b94abcd5aee9b6d74c99a7859511ba6
Instruction Fuzzy Hash: 9131D27A911502CECF3DCF7A507674376A5FB8035A793887AC843CE071E6A64C86B9C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F621, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8430a4f13a5dd75eb9d001ee3bc60e6e67b18c52dc5aced57b68c70893c269f
Instruction ID: 13980f79b93d0fb51df45e813ddd2d994dce9fa9c527417b5a16f9a927b55759
Opcode Fuzzy Hash: c8430a4f13a5dd75eb9d001ee3bc60e6e67b18c52dc5aced57b68c70893c269f
Instruction Fuzzy Hash: 7541F876D00301CEDF388D2899A53D33266BF55314F96423ACC824B5A4D3764DCAEAC3

Uniqueness

Uniqueness Score: -1.00%

Function 00F0FC11, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8155cda4584ab7a21a6138d8d4630592fe39b9bc830b60461a6cc39cab33b7c1
Instruction ID: 4e581f0bc87b97b143f25c4219e43698476fca973848ae1fa45a507880c14eb6
Opcode Fuzzy Hash: 8155cda4584ab7a21a6138d8d4630592fe39b9bc830b60461a6cc39cab33b7c1
Instruction Fuzzy Hash: E641B67B905100CFCE3DCF76547674336A6BB90258B97457AC802DF470E2B69D8AAEC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0979E, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2875a3208a8d61c26f820cb0542d11ca6ca07345653a7088e8c0fbb6961dfea
Instruction ID: 3536bc1cceb456067bc0f645116f5f9642fad99082c006a57068eb0c1e5a4d79
Opcode Fuzzy Hash: a2875a3208a8d61c26f820cb0542d11ca6ca07345653a7088e8c0fbb6961dfea
Instruction Fuzzy Hash: 2E31B27691D600CECF2DCE7A507634336E6BB91364B97816AC4028F1B2F6E68D46B9C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F03EA1, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dbc98df862289728a6e88bef0a1d3aa4fcff1f1319f00c1ef68d49543ec428
Instruction ID: ef88fa70f0ce833dd5ac6457c3e52c53d7b31a862aeb22a69c34cc888c96706b
Opcode Fuzzy Hash: 49dbc98df862289728a6e88bef0a1d3aa4fcff1f1319f00c1ef68d49543ec428
Instruction Fuzzy Hash: 3D315D3AC14101CECF2CCEB5503539337BAAF81355B92415BC8438F0B5E6A64E87B9C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F04CCD, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1dabf2648704c1e683461ed484f0c1008963f7402a347e2457416f60594196
Instruction ID: 482df9d366ba075b0b664bb324723a183f9bcfe149a9b03adf2f9b1cdea63d9d
Opcode Fuzzy Hash: 5a1dabf2648704c1e683461ed484f0c1008963f7402a347e2457416f60594196
Instruction Fuzzy Hash: 203168B6A012048FDF388E3988B53C73766BF91350F62452EC9428B1A0E3765985DAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E6EE, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ddaa60304823de3cd492ca425c40fb68cf86fdabcb31cd146da73c78d722d0
Instruction ID: 688b644a78aab2b046286b9eb725f73fc28f2712df6dfd31e7f94a3ea3d72b2d
Opcode Fuzzy Hash: d2ddaa60304823de3cd492ca425c40fb68cf86fdabcb31cd146da73c78d722d0
Instruction Fuzzy Hash: E0318F7AA05200CFCF7DCF7684B278376A6BF90314F56496EC8128F0B0E6B65945AAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F10F6A, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98803264e8ab3a888513ce1860d95bfb4bea91ce7932a1da6fa1eb5968f9cc6
Instruction ID: 47e821097f703dff27a10c601468a9511e4b5a8673ac9a1cba2053e7bf2bcbc9
Opcode Fuzzy Hash: b98803264e8ab3a888513ce1860d95bfb4bea91ce7932a1da6fa1eb5968f9cc6
Instruction Fuzzy Hash: E1310B36C14380CECF3DCF3450BA787BA61BF45358F0682AEC5428E065E6A608C6DAC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F04C4F, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b99623a60262c584be6f1757659946d655acd755ebbce556166e9d97c88655
Instruction ID: dc7f8842660a52cc305efd2fcf12b8ce77391ff60884f807ed6c847a41249a0d
Opcode Fuzzy Hash: f3b99623a60262c584be6f1757659946d655acd755ebbce556166e9d97c88655
Instruction Fuzzy Hash: 8A2168B260038A8FEB340E28CCE53DB3667AF52750FA1051FDD8B97680D3358585D702

Uniqueness

Uniqueness Score: -1.00%

Function 00F04DB7, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2ec009bd53841cb92886c7aa0f4dc9a4f8d7c4d09c38c6b4bb22a8d135029c
Instruction ID: ad51e3e9cef01e8f7006fcc1f22aec337a1234e55581b5829e2e21c8aa2e8af5
Opcode Fuzzy Hash: 3f2ec009bd53841cb92886c7aa0f4dc9a4f8d7c4d09c38c6b4bb22a8d135029c
Instruction Fuzzy Hash: D12127B6901201CECF38CF79D8B17C33666BF80354F62412EC9469F1A0E7B65985EAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F10EE9, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bda9f90d7229026127aa7cda84d5c5653af538560fc67a9c13bf13895d1b5aa
Instruction ID: 6bbb336a2d4f293d1018f615cdcff39ebba63733af5aa136d623e9c4bc9d7a27
Opcode Fuzzy Hash: 1bda9f90d7229026127aa7cda84d5c5653af538560fc67a9c13bf13895d1b5aa
Instruction Fuzzy Hash: 48214079C143018ECF38CA34407B3877651FF91394F02C67DC8438A069E5A108C395C2

Uniqueness

Uniqueness Score: -1.00%

Function 00F10FDD, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38df9a9213e027559d2bedecd3c7d118fb0ce17c735a93971b521164d9d17ee
Instruction ID: 31ba20293b1e1cd6f3b397f421e4ef4d3b4f58e58c27ac9e58936cc9e4204a6d
Opcode Fuzzy Hash: a38df9a9213e027559d2bedecd3c7d118fb0ce17c735a93971b521164d9d17ee
Instruction Fuzzy Hash: 2321F93AC14340CECF3DCE3550BA797B665BB55368B06826EC5928A075E6A609C29AC2

Uniqueness

Uniqueness Score: -1.00%

Function 00F06ED3, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ca2e1530ea6f0480005cbad0f510a6eb1cffdcce1476472ebc6d775923afa8
Instruction ID: 4e4d633c16b58c2a8f78e5857fe3fb1896901b669905119e12b5e2646c218b09
Opcode Fuzzy Hash: 42ca2e1530ea6f0480005cbad0f510a6eb1cffdcce1476472ebc6d775923afa8
Instruction Fuzzy Hash: 65212931659305DFEF642E3489617FBBBE2AF423A4F97092ECDC396450E72188859B03

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F1C6, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23233d7b0efc2c23addb09fb04198846cf37ec248697273262d74c93111440ec
Instruction ID: c744729639dc4ba4a74af094acfb7630a32af056a540722d796f909e8acbd5da
Opcode Fuzzy Hash: 23233d7b0efc2c23addb09fb04198846cf37ec248697273262d74c93111440ec
Instruction Fuzzy Hash: 13119F3A905600CECF3DCE36947230377A2BB90269797867EC4429E4B4E2B60C5AA9C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0D645, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce8086fc373080357a1120c3d2f07317dec77043de4679a1837c8c830a318dd
Instruction ID: acab0ec8818f423a94e0b31308276efe873dbb0f0d161540ff0f2768046f9c7e
Opcode Fuzzy Hash: 7ce8086fc373080357a1120c3d2f07317dec77043de4679a1837c8c830a318dd
Instruction Fuzzy Hash: BF11937AA05600CFCE3DCFFA507660336A5BA80358793416AC402CE0B0B6AB0DA6FDC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F090, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8adbda0bc4359cb6dfffd71b496ab3296117a145a8ec3d0cbbe552511316964
Instruction ID: bf782ffec98065b4353be97200cf90d80e4a82b51dd95af7f614f76a2095da3f
Opcode Fuzzy Hash: e8adbda0bc4359cb6dfffd71b496ab3296117a145a8ec3d0cbbe552511316964
Instruction Fuzzy Hash: A5F09076710200CFDB30CE28CAD0B9973A2AF58790F514439E84ACBAA1D330DC49FA10

Uniqueness

Uniqueness Score: -1.00%

Function 00F095C2, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f67303aa29363061933f8f70203a5489b5739b2c7195129706f6592e8591633
Instruction ID: 6d2acfcdd9c4cdd606b5a8e9d514316f1967baf927ccd7da21d9071205148cf4
Opcode Fuzzy Hash: 5f67303aa29363061933f8f70203a5489b5739b2c7195129706f6592e8591633
Instruction Fuzzy Hash: 08E0EDB1611381DFD714CA38C4C0B1577A0BF467A4B608168E845CF7A2C222E844AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E9E3, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.465559603.0000000000F00000.00000040.00000001.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b56d7fce6a1fa36ba05ec4c6bc2688cff152389919c73e78ffa06673968d15
Instruction ID: 786e6ffa97e74926978100051f5918d4af56b6f0c3086d0e5ef4286e4a8b7f02
Opcode Fuzzy Hash: 91b56d7fce6a1fa36ba05ec4c6bc2688cff152389919c73e78ffa06673968d15
Instruction Fuzzy Hash: 1AB00975665A858FCA96DA09D2A0E81B3A5FB58B60F825890E456CBA62C268E940CA10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Invoice-NBM01557.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Function 0042AA40, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 158
COMMON

Function 00401944, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 169
COMMON

Function 0042AC90, Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 209
COMMON

Function 0042B1B0, Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 208
COMMON

Function 004237C0, Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 253
COMMON

Function 00429B60, Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 203
COMMON

Function 00423B60, Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 236
COMMON

Function 00424310, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 199
COMMON

Function 00429880, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 196
COMMON

Function 00423EA0, Relevance: 40.8, APIs: 27, Instructions: 260
COMMON

Function 00429E40, Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 183
COMMON

Function 00423390, Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 173
COMMON

Function 0042A2F0, Relevance: 39.2, APIs: 26, Instructions: 231
COMMON

Function 0042C0C0, Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 162
COMMON

Function 00423150, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 148
COMMON