Play interactive tour

Edit tour

Windows Analysis Report loKmeabs9V.exe

Overview

General Information

Sample Name:	loKmeabs9V.exe
Analysis ID:	457916
MD5:	e0d74762f123eb6603898d1482eb9752
SHA1:	ee63af5c34a027ba8b8331dd678b15e7a87d26a6
SHA256:	f06e4c96e86c0f36c82d38de0627c0b81995656c4dcbc136c0fedda868ed8ea0
Tags:	exeRAT
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loKmeabs9V.exe (PID: 6084 cmdline: 'C:\Users\user\Desktop\loKmeabs9V.exe' MD5: E0D74762F123EB6603898D1482EB9752)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://101.99.94.119/WEALTH_PRUuqVZw139.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "http://101.99.94.119/WEALTH_PRUuqVZw139.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: loKmeabs9V.exe

Virustotal: Detection: 20%

Perma Link

Machine Learning detection for sample

Show sources

Source: loKmeabs9V.exe

Joe Sandbox ML: detected

Source: loKmeabs9V.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://101.99.94.119/WEALTH_PRUuqVZw139.bin

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Code function: 1_2_02175971 NtAllocateVirtualMemory,

1_2_02175971

Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02175971	1_2_02175971
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02177C19	1_2_02177C19
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178030	1_2_02178030
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02174230	1_2_02174230
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02173A2E	1_2_02173A2E
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217962D	1_2_0217962D
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02171654	1_2_02171654
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02179653	1_2_02179653
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217245A	1_2_0217245A
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02175844	1_2_02175844
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178294	1_2_02178294
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02172C93	1_2_02172C93
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02173C9E	1_2_02173C9E
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217629C	1_2_0217629C
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217149C	1_2_0217149C
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178098	1_2_02178098
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178687	1_2_02178687
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02172889	1_2_02172889
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021730BC	1_2_021730BC
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02170CAC	1_2_02170CAC
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02174CD0	1_2_02174CD0
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021782DC	1_2_021782DC
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021736C3	1_2_021736C3
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021746C8	1_2_021746C8
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02173EE1	1_2_02173EE1
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217151C	1_2_0217151C
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178324	1_2_02178324
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178923	1_2_02178923
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02177921	1_2_02177921
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02174352	1_2_02174352
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02171D5A	1_2_02171D5A
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02171940	1_2_02171940
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02170571	1_2_02170571
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02174B96	1_2_02174B96
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021711B4	1_2_021711B4
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02175DAE	1_2_02175DAE
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02170BC7	1_2_02170BC7
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021719F4	1_2_021719F4
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02175BF3	1_2_02175BF3
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021741E6	1_2_021741E6
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021787E3	1_2_021787E3

Source: loKmeabs9V.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: loKmeabs9V.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: loKmeabs9V.exe, 00000001.00000002.725664691.0000000002090000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs loKmeabs9V.exe
Source: loKmeabs9V.exe, 00000001.00000002.724408573.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTROSSKIFTERNES.exe vs loKmeabs9V.exe
Source: loKmeabs9V.exe	Binary or memory string: OriginalFilenameTROSSKIFTERNES.exe vs loKmeabs9V.exe

Source: loKmeabs9V.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\loKmeabs9V.exe

File created: C:\Users\user\AppData\Local\Temp\~DF1F7CA1E2F5818567.TMP

Jump to behavior

Source: loKmeabs9V.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: loKmeabs9V.exe

Virustotal: Detection: 20%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_00404DCC push edx; iretd		1_2_00404DD6
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_004059BD push F32E5D69h; retf		1_2_004059D0

Source: initial sample

Static PE information: section name: .text entropy: 7.07623900315

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217629C	1_2_0217629C
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021736C3	1_2_021736C3
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02178923	1_2_02178923
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02175DAE	1_2_02175DAE
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02170BC7	1_2_02170BC7
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021787E3	1_2_021787E3

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\loKmeabs9V.exe

RDTSC instruction interceptor: First address: 0000000002177F30 second address: 0000000002177F30 instructions: 0x00000000 rdtsc 0x00000002 mov eax, A494EE6Bh 0x00000007 xor eax, 6C4D1677h 0x0000000c xor eax, 6E4EF001h 0x00000011 xor eax, A697081Ch 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FF014CB631Ah 0x0000001e lfence 0x00000021 mov edx, 2EA7C992h 0x00000026 xor edx, 079D8C51h 0x0000002c xor edx, 2142E10Eh 0x00000032 xor edx, 7786A4D9h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d cmp dx, ax 0x00000040 ret 0x00000041 sub edx, esi 0x00000043 ret 0x00000044 cmp cl, dl 0x00000046 add edi, edx 0x00000048 dec dword ptr [ebp+000000F8h] 0x0000004e cmp dword ptr [ebp+000000F8h], 00000000h 0x00000055 jne 00007FF014CB62F8h 0x00000057 test eax, ebx 0x00000059 call 00007FF014CB635Fh 0x0000005e call 00007FF014CB633Bh 0x00000063 lfence 0x00000066 mov edx, 2EA7C992h 0x0000006b xor edx, 079D8C51h 0x00000071 xor edx, 2142E10Eh 0x00000077 xor edx, 7786A4D9h 0x0000007d mov edx, dword ptr [edx] 0x0000007f lfence 0x00000082 cmp dx, ax 0x00000085 ret 0x00000086 mov esi, edx 0x00000088 pushad 0x00000089 rdtsc

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Code function: 1_2_02177C19 rdtsc

1_2_02177C19

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Code function: 1_2_02177C19 rdtsc

1_2_02177C19

Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02172C93 mov eax, dword ptr fs:[00000030h]	1_2_02172C93
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_0217548E mov eax, dword ptr fs:[00000030h]	1_2_0217548E
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021736C3 mov eax, dword ptr fs:[00000030h]	1_2_021736C3
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_02177B16 mov eax, dword ptr fs:[00000030h]	1_2_02177B16
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021773F1 mov eax, dword ptr fs:[00000030h]	1_2_021773F1
Source: C:\Users\user\Desktop\loKmeabs9V.exe	Code function: 1_2_021787E3 mov eax, dword ptr fs:[00000030h]	1_2_021787E3

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: loKmeabs9V.exe, 00000001.00000002.725388156.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loKmeabs9V.exe, 00000001.00000002.725388156.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loKmeabs9V.exe, 00000001.00000002.725388156.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loKmeabs9V.exe, 00000001.00000002.725388156.0000000000C50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\loKmeabs9V.exe

Code function: 1_2_021773AF cpuid

1_2_021773AF

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery31	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery211	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
loKmeabs9V.exe	20%	Virustotal		Browse
loKmeabs9V.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://101.99.94.119/WEALTH_PRUuqVZw139.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://101.99.94.119/WEALTH_PRUuqVZw139.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457916
Start date:	02.08.2021
Start time:	14:51:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	loKmeabs9V.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 18.8% (good quality ratio 4.9%) Quality average: 12.9% Quality standard deviation: 25.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.65828072595929
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	loKmeabs9V.exe
File size:	114688
MD5:	e0d74762f123eb6603898d1482eb9752
SHA1:	ee63af5c34a027ba8b8331dd678b15e7a87d26a6
SHA256:	f06e4c96e86c0f36c82d38de0627c0b81995656c4dcbc136c0fedda868ed8ea0
SHA512:	0f1daec7056919c4c7662da12f99dc5300243b039ec98f162f1f6eb391dd9905b240abfbc63af3d662c0ba4ae6515fa11a3352b72354ee0c7a1b4147d2c2313a
SSDEEP:	1536:hSGTBAAP0gRQhGuloEWu6Y9yaipBhHaWQmiPYDqulcgRQhWSGTBAAP:hSGTBxChTlHWu6jbfFtDXlKhWSGTBx
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......J.................@..........D........P....@................

File Icon


Icon Hash:	6a6a2a6a2a2a2a2a

Static PE Info

General
Entrypoint:	0x401144
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4A04FEB2 [Sat May 9 03:55:30 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5565993a5a9f2bfb76f28ab304be6bc1

Entrypoint Preview

Instruction
push 00406C04h
call 00007FF014736FC5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+ebp*2], al
cdq
shl byte ptr [ebp-4Ah], cl
cmp al, 4Eh
mov eax, 39F14AE7h
xchg eax, ecx
jnle 00007FF014736F58h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc edx
add byte ptr [esi], al
push eax
add dword ptr [ecx], 41h
dec esi
dec esi
dec edi
dec esi
inc ebx
inc ebp
push edx
dec ecx
dec esi
inc edi
inc ebp
dec esi
push ebx
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
pop es
test al, 83h
in eax, dx
rol ecx, 21h
pushfd
inc eax
mov edx, CE82C659h
inc esp
fidivr word ptr [eax+1A7833A9h]
xor ecx, edi
mov ch, 4Eh
cwde
adc eax, 5544968Fh
adc edi, dword ptr [edx]
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jne 00007FF01473702Bh
add byte ptr [eax], al
cmp bl, byte ptr [eax+00h]
add byte ptr [eax], al
str word ptr [esi+4Fh]
dec esi
inc esp
inc ebp
inc esi
dec ecx
inc ebx
dec ecx
inc ebp
dec esi
inc ebx
dec ecx
inc ebp
push ebx
add byte ptr [00000E01h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14b94	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x5baa	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x7c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13e14	0x14000	False	0.648217773437	data	7.07623900315	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0x115c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x5baa	0x6000	False	0.545979817708	data	6.0375627219	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1bd02	0xea8	data
RT_ICON	0x1b45a	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 3507421495, next used block 3509654332
RT_ICON	0x1aef2	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x1894a	0x25a8	data
RT_ICON	0x178a2	0x10a8	data
RT_ICON	0x1743a	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x173e0	0x5a	data
RT_VERSION	0x171e0	0x200	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, _allmul, _CItan, _CIexp

Version Infos

Description	Data
Translation	0x0404 0x04b0
ProductVersion	1.00
InternalName	TROSSKIFTERNES
FileVersion	1.00
OriginalFilename	TROSSKIFTERNES.exe
ProductName	COUNTERPART

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: loKmeabs9V.exe PID: 6084 Parent PID: 5572

General

Start time:	14:51:59
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\loKmeabs9V.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\loKmeabs9V.exe'
Imagebase:	0x400000
File size:	114688 bytes
MD5 hash:	E0D74762F123EB6603898D1482EB9752
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loKmeabs9V.exe PID: 6084 Parent PID: 5572 loKmeabs9V.exeCOMMON

Executed Functions

Function 02175971, Relevance: 1.6, APIs: 1, Instructions: 102memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02175AC2

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 9a34077ba48acb3fd026c6e2647e8f5572c006ca468281b0462f393782833d75
Instruction ID: 25aebfa689d74a8a5dde203451567eb96ee210f4e6cd569531cdd695077b4e0a
Opcode Fuzzy Hash: 9a34077ba48acb3fd026c6e2647e8f5572c006ca468281b0462f393782833d75
Instruction Fuzzy Hash: E141BAB25083899FCB709F24DC557EEBBA2EF85350F45011EEC8AAB250D3359A85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00401144, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401149

Strings

VB5!6&*, xrefs: 00401144

Memory Dump Source

Source File: 00000001.00000002.724374027.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.724365568.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.724399334.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.724408573.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 42e5da2b8ea787eb35509ad5e65856a32169b05f1711deb830332ea8f6e0291f
Instruction ID: 753f51a2eaeaf820ac68413a20b2ccc286010b2bbf1855bbf3e3370ecb8a4347
Opcode Fuzzy Hash: 42e5da2b8ea787eb35509ad5e65856a32169b05f1711deb830332ea8f6e0291f
Instruction Fuzzy Hash: 835195A108E7D16FC30747B49C656A23FB8AE5326874B45EBD4C2DF4B3D2580C4AC7A2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02179653, Relevance: 8.5, Strings: 6, Instructions: 974COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
z22[, xrefs: 0217963D
Z[h], xrefs: 0217482D
\T, xrefs: 02179758
D5cI, xrefs: 02174A95
;e=w, xrefs: 0217997C

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ;e=w$D5cI$Z[h]$\T$h%U$z22[
API String ID: 0-530423058
Opcode ID: e090c0f73e55ad957473eea371ca271352b7cae8df276878fdaf6c5db397bb54
Instruction ID: 52ca6b0450db1c3e9b5cdc24981cf27ac6ece43cf6e288028d27b195ddf584fe
Opcode Fuzzy Hash: e090c0f73e55ad957473eea371ca271352b7cae8df276878fdaf6c5db397bb54
Instruction Fuzzy Hash: 098231716453899FDB748F38CD947CA7BB2EF99300F95822ADD499B314D3309A85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02177C19, Relevance: 7.0, Strings: 5, Instructions: 731COMMON

Download Yara Rule

Strings

@USf, xrefs: 02177C8C
h%U, xrefs: 02174381
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95
`, xrefs: 02177CFB

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: @USf$D5cI$Z[h]$`$h%U
API String ID: 0-3812957336
Opcode ID: 75b9b416bb256cf9bab1f4feb94e3cdfeffb0282cbeaab90d9f63f4c7e162c18
Instruction ID: 99d0db860afd779529ece7e6072a786fac14ebe5f326f44416af169c3b416e25
Opcode Fuzzy Hash: 75b9b416bb256cf9bab1f4feb94e3cdfeffb0282cbeaab90d9f63f4c7e162c18
Instruction Fuzzy Hash: 5F621F726443899FDB748F38CD857DABBB2BF99310F55822ADC499B250C3349A85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0217962D, Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

z22[, xrefs: 0217963D
Z[h], xrefs: 0217482D
\T, xrefs: 02179758
D5cI, xrefs: 02174A95
;e=w, xrefs: 0217997C

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ;e=w$D5cI$Z[h]$\T$z22[
API String ID: 0-2234792939
Opcode ID: c44d1cc4750c5ca65015e0e99e1a5963d21243403ac7421022aff7fe2b344e71
Instruction ID: 624f82e06e251a54940586eedaa51ebf42a96d233532106c839a57bc81029d1b
Opcode Fuzzy Hash: c44d1cc4750c5ca65015e0e99e1a5963d21243403ac7421022aff7fe2b344e71
Instruction Fuzzy Hash: 45A1FF716803888FEF39DF69C9A47DD3BB2BF88350F95412ADC498B254D7309A41CB16

Uniqueness

Uniqueness Score: -1.00%

Function 021787E3, Relevance: 6.2, Strings: 4, Instructions: 1176COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
wsc, xrefs: 021790F4
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]$h%U$wsc
API String ID: 0-2987000970
Opcode ID: ab2a7828298e48ae2f29a88a133af66a19cb7a7debb8d77f935c0906f2aa40db
Instruction ID: cad5aa4b2b52864f0a8855b629b5b0a026f131ffea2443d7e640e642ae17c116
Opcode Fuzzy Hash: ab2a7828298e48ae2f29a88a133af66a19cb7a7debb8d77f935c0906f2aa40db
Instruction Fuzzy Hash: 4FB235716083898FDB75CF38CC987DABBB2AF96310F45825ADC899F295D3308645CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0217629C, Relevance: 4.6, Strings: 3, Instructions: 896COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]$h%U
API String ID: 0-4128129217
Opcode ID: 22991104d5ea2da5df5098f9e6e38f8a4a14bbcb2dd859c0f1af4364f9740b6a
Instruction ID: be171121ec02fa70ea0f7fbebde876aca430dd3c775ad6357f27e840e94723bc
Opcode Fuzzy Hash: 22991104d5ea2da5df5098f9e6e38f8a4a14bbcb2dd859c0f1af4364f9740b6a
Instruction Fuzzy Hash: CA82F0B16403899FDB759F38CD847DA7BB2BF98310F55822AEC499B254D7309A82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02174230, Relevance: 4.5, Strings: 3, Instructions: 787COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]$h%U
API String ID: 0-4128129217
Opcode ID: 1678671fc028e8461833f27f99b8d760b7953612371e9387e10293aa410bebb4
Instruction ID: c8fff922d5f20fce8649611d26b9101e62e5114ea6cc0d750aba383d346e6772
Opcode Fuzzy Hash: 1678671fc028e8461833f27f99b8d760b7953612371e9387e10293aa410bebb4
Instruction Fuzzy Hash: C16241716453899FDB708F28CC84BCA7BB2FFA9300F958219DD499B715D3709A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02175844, Relevance: 4.4, Strings: 3, Instructions: 672COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]$h%U
API String ID: 0-4128129217
Opcode ID: 43db95b7f4491f411ae4dca739b58bb45f26f0e2d0631b632ea2e68af2ed60ad
Instruction ID: a6cbcb40edea69cfea73c788e7f2d5d686bf298fffe03c78de9e088ded768773
Opcode Fuzzy Hash: 43db95b7f4491f411ae4dca739b58bb45f26f0e2d0631b632ea2e68af2ed60ad
Instruction Fuzzy Hash: 2352FFB26043899FDB748F39CD447DABBB2BF99310F55821ADC899B250D3349A85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02174352, Relevance: 4.4, Strings: 3, Instructions: 640COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381
Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]$h%U
API String ID: 0-4128129217
Opcode ID: dede62516f2cb084a876dfb5edb4ffba13bdef29a06c598fb734577de4f13638
Instruction ID: 40f558f70d5d314450c49c0861e93aaa03b861e1b09fc36c9fb890622166398d
Opcode Fuzzy Hash: dede62516f2cb084a876dfb5edb4ffba13bdef29a06c598fb734577de4f13638
Instruction Fuzzy Hash: 1E52EFB26043899FDB748F39CD447CABBB2BF99310F55822ADC499B250D3749A85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02170BC7, Relevance: 3.3, Strings: 2, Instructions: 769COMMON

Download Yara Rule

Strings

Qp a, xrefs: 02171925
SBTI, xrefs: 0217127A

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: Qp a$SBTI
API String ID: 2167126740-1817519146
Opcode ID: d3b46504785cd684502e985ab4d98e96392b7c331ab4bb5e4d337aa1c0a685d7
Instruction ID: 6a02338f8b35db1c5dae8dcb20129f149fa69d857762ff1c5bdcba73b8666bdc
Opcode Fuzzy Hash: d3b46504785cd684502e985ab4d98e96392b7c331ab4bb5e4d337aa1c0a685d7
Instruction Fuzzy Hash: 4F6245716443899FDB749F38CC987EE7BB2AF95340F56412DDC8A9B250C7318A82CB16

Uniqueness

Uniqueness Score: -1.00%

Function 021746C8, Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

Z[h], xrefs: 0217482D
D5cI, xrefs: 02174A95

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D5cI$Z[h]
API String ID: 0-1924496853
Opcode ID: 06f8dcfd16cbe7fbc5c01ac17a4841849c94b3483891891e062c189f5278e202
Instruction ID: 850b46410001503bd1af226f913324c8c9255afcacb14f00738bf72284cc5c6f
Opcode Fuzzy Hash: 06f8dcfd16cbe7fbc5c01ac17a4841849c94b3483891891e062c189f5278e202
Instruction Fuzzy Hash: 353255B16452899FDB748F28CC80BCA7BB6FF9A300F958219DD498B715D3709645CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02172C93, Relevance: 3.1, Strings: 2, Instructions: 559COMMON

Download Yara Rule

Strings

gL=", xrefs: 02172D1F
8fd, xrefs: 021731A1

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8fd$gL="
API String ID: 0-859432238
Opcode ID: b2c1b5db5870e2bfd76e05645806a9eb5e133c70b7393a78c689f74d7cb148a7
Instruction ID: ebf728db3fefd5b1351fafd07da04a50c7e8cace5f0bcab44370f22ae11a0fca
Opcode Fuzzy Hash: b2c1b5db5870e2bfd76e05645806a9eb5e133c70b7393a78c689f74d7cb148a7
Instruction Fuzzy Hash: CA328C71A446499FDB28DF29CC94BDAB7F2FF88310F55822AEC5D9B350D730A9418B84

Uniqueness

Uniqueness Score: -1.00%

Function 02172889, Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

~nh, xrefs: 02172C73
r*4, xrefs: 02172A3F

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: r*4$~nh
API String ID: 0-3726668126
Opcode ID: 6a71fc3b939dc425db6e6d837f571730bbe6b85183f2856e2873a6e0d24934eb
Instruction ID: 4e6a1652c34c94c2fbc694b0d35aa35364d5621849885030efffc028542c85b7
Opcode Fuzzy Hash: 6a71fc3b939dc425db6e6d837f571730bbe6b85183f2856e2873a6e0d24934eb
Instruction Fuzzy Hash: E171AC766083489FDB74DE39C888BDABBE2FF98340F55841DEC8D9B614D3309A418B42

Uniqueness

Uniqueness Score: -1.00%

Function 02170CAC, Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

SBTI, xrefs: 0217127A

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: SBTI
API String ID: 0-1513441178
Opcode ID: 746f6a1952cab439fbcf0b1d298dddff19dce977b6c352c0acad4898da294cbf
Instruction ID: f2a914e3b2f4ff6a8f1213e56db21ae7e250c9f4a7c7b9af2ac06a8f2dbe5b91
Opcode Fuzzy Hash: 746f6a1952cab439fbcf0b1d298dddff19dce977b6c352c0acad4898da294cbf
Instruction Fuzzy Hash: DD1286706893859FDB349F288898BDE3BB3AF96300FA5416DCC4A8F342D3365646CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02178030, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

&bX, xrefs: 02178411

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: &bX
API String ID: 0-1885336810
Opcode ID: 85fa75ccfb4b9bb3e2d31ced8547a88da9825e2370356f247e7d4f3e00829e4a
Instruction ID: 6315ba8d2be34ba0d6cd9d6ce7e41e40828cd73c37c61bc7dd16af9a700ba77b
Opcode Fuzzy Hash: 85fa75ccfb4b9bb3e2d31ced8547a88da9825e2370356f247e7d4f3e00829e4a
Instruction Fuzzy Hash: 8AB1EB75A443889FDB34DF28C894BDE77B2BF88350F95812ADC4E9B240E7709A42CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0217245A, Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

^M0, xrefs: 0217250B

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ^M0
API String ID: 2167126740-1678713791
Opcode ID: 7820624a8d764d7cc3ea27c27d99cd114a4459680f27248ac4c6102b381e0f61
Instruction ID: 96922edc6480714421e098183cbd0e4d868098a180bc348bf31c5af2bcb581a8
Opcode Fuzzy Hash: 7820624a8d764d7cc3ea27c27d99cd114a4459680f27248ac4c6102b381e0f61
Instruction Fuzzy Hash: 0B913672A403488FDB749F68CC947DA77B6BF89350F55412DDC889B244D3308A82CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0217149C, Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

Qp a, xrefs: 02171925

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qp a
API String ID: 0-2838866663
Opcode ID: d144fc08afc28a9b6f3639555700dc7b9b1cb18a67e608cc144923423771fe14
Instruction ID: 19217a7f28be6c22f01629c8856dde3b76fb926393ec189f3bbd8ab5c9618584
Opcode Fuzzy Hash: d144fc08afc28a9b6f3639555700dc7b9b1cb18a67e608cc144923423771fe14
Instruction Fuzzy Hash: B681F2726443488FCB249E38CC59BEA7BB2AF95350F1A412DDC8A9B655C3719682CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0217151C, Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

Qp a, xrefs: 02171925

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qp a
API String ID: 0-2838866663
Opcode ID: 04b7b69afdb98262e54dd29dfc595b13807d4c71a9a54e7c835b77a7fa3d19fc
Instruction ID: c34dacf5c0ccfe4dd780f0ec8cf9d6a8033a47837503fb8a0174869badbc2bd3
Opcode Fuzzy Hash: 04b7b69afdb98262e54dd29dfc595b13807d4c71a9a54e7c835b77a7fa3d19fc
Instruction Fuzzy Hash: 007114726443448FCB349F38CC59BEA3BB2BF95390F1A422DDC899B655C3759582CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021736C3, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

lue, xrefs: 02173729

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: lue
API String ID: 0-2265836759
Opcode ID: 86586550857f9cd0c4f4274755212964a2be99cdb15954fa5a16eaa5aaf4d111
Instruction ID: bbd1387ef5dc407f88f5bfa95a21e910040fa205670bfcb29fc19473723caf0b
Opcode Fuzzy Hash: 86586550857f9cd0c4f4274755212964a2be99cdb15954fa5a16eaa5aaf4d111
Instruction Fuzzy Hash: E071DD71A483849FDB649F34C989BDAB7B1BF05320F56458DAC599B261C3709A80CF92

Uniqueness

Uniqueness Score: -1.00%

Function 021711B4, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

SBTI, xrefs: 0217127A

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: SBTI
API String ID: 0-1513441178
Opcode ID: 526abfc25bc71d12d2d32b4356bfac5955fe2d45010c650d13cf1a8ee37b5f15
Instruction ID: f6f3a0a537c9695ed47e5f9b3704cb1095faeaf869716a24760e8e4bae1b6cf3
Opcode Fuzzy Hash: 526abfc25bc71d12d2d32b4356bfac5955fe2d45010c650d13cf1a8ee37b5f15
Instruction Fuzzy Hash: 507138715483899FDF389F78988C7DE7BB2AF91300F95425ECC4AAB240C3758686CB15

Uniqueness

Uniqueness Score: -1.00%

Function 021730BC, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

8fd, xrefs: 021731A1

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8fd
API String ID: 0-256658910
Opcode ID: 4950660b68f7d93c96224b03294a42b6b866fb38b07ef0aead162236f6dec4ad
Instruction ID: 967da23a6c3b3e4aa1d4b6a825445539b4281d972520e207e957b89057912cf3
Opcode Fuzzy Hash: 4950660b68f7d93c96224b03294a42b6b866fb38b07ef0aead162236f6dec4ad
Instruction Fuzzy Hash: 1D619D72A40649CFDB34CF28C9847DAB7F2BF99310F59422AEC5997350DB70AA50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02171654, Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

Qp a, xrefs: 02171925

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Qp a
API String ID: 0-2838866663
Opcode ID: 490c9ddf7db84f876874a0aecb36c931925483a16838878dfa9f911ff01d31b5
Instruction ID: 8259ce4e20b1a27818be627fa91a5589ba2225f7f02a795594d2cd7d759a7d99
Opcode Fuzzy Hash: 490c9ddf7db84f876874a0aecb36c931925483a16838878dfa9f911ff01d31b5
Instruction Fuzzy Hash: 0A5136726443888FCB309E38CD597EE77F2AF99394F1A021DDC899B655C3719A428B42

Uniqueness

Uniqueness Score: -1.00%

Function 02171D5A, Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Da, xrefs: 02171F10

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Da
API String ID: 0-3380597304
Opcode ID: 1807164b41f7efe86fa08a90ae49029a08da702a0b381605a4bf2a1efd395393
Instruction ID: e5920e5291810105432b622da582f69814c012dd0a408f1618922247325e603f
Opcode Fuzzy Hash: 1807164b41f7efe86fa08a90ae49029a08da702a0b381605a4bf2a1efd395393
Instruction Fuzzy Hash: 6C51C1766006899FCF30CF2ACD58BDB7BE6AFD9710F45822AEC4C9B214D3304A858B41

Uniqueness

Uniqueness Score: -1.00%

Function 02173A2E, Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

DPy, xrefs: 02173A89

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: DPy
API String ID: 0-2132550623
Opcode ID: 1093df66b315300588ab63aa6032053f9c9a8ecef687cc6172675307b68e886f
Instruction ID: e5b371334c0f2066de24a37ae7982aee928e565fdd1194f161219c5176cc2bc3
Opcode Fuzzy Hash: 1093df66b315300588ab63aa6032053f9c9a8ecef687cc6172675307b68e886f
Instruction Fuzzy Hash: 9F11C835946264CFDBB0CE799E847DB7767FFD4740F52811A9D886B208C3305A868B86

Uniqueness

Uniqueness Score: -1.00%

Function 021741E6, Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

h%U, xrefs: 02174381

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: h%U
API String ID: 0-603279075
Opcode ID: 654165b74f45372d1c94e04486d41755ebe3260eb2a76bf08f88dce2fac565bd
Instruction ID: 8dbd909396e88f509834dab239dd0f777ab82242e34a221fb1febb7006a1d11c
Opcode Fuzzy Hash: 654165b74f45372d1c94e04486d41755ebe3260eb2a76bf08f88dce2fac565bd
Instruction Fuzzy Hash: 1C110872508358AFD7608EB99C44BDBB7F6AF98350F07051AAC58E7514D335DA84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02174B96, Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4e997ca2e66b1e5ad051a7ea08564d034f496d07792580f81ddcbccc8e6873
Instruction ID: b1020556f94b83d26b9c20ab9399562c8a1dce429b85740b13efbd1960a62ba9
Opcode Fuzzy Hash: bd4e997ca2e66b1e5ad051a7ea08564d034f496d07792580f81ddcbccc8e6873
Instruction Fuzzy Hash: A5E1467558A2899FDB708F28CC80BCA37B7EFAA304FA44219DD498F346E3715645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02178923, Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3230d5fdf736ab2c4859bd1efff2a7ade097951f4292161bb36609ba2b431eda
Instruction ID: c3e59386e4578321e5e44ab4d9680036f1989c097f79db8bfda59209bd9b7b67
Opcode Fuzzy Hash: 3230d5fdf736ab2c4859bd1efff2a7ade097951f4292161bb36609ba2b431eda
Instruction Fuzzy Hash: 87D1E43054D3C18EDB318F38888CBDA6FA29B53314FA9C2A9C5994F79BE3754106D792

Uniqueness

Uniqueness Score: -1.00%

Function 02175DAE, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c75cf1a59b4f533458f803b7103c6af6fb12a249f1f35a00741d65a21924e93b
Instruction ID: a5462a16b872438f3b519b041ee1f2c344ecd5290e418ff49921125b95549140
Opcode Fuzzy Hash: c75cf1a59b4f533458f803b7103c6af6fb12a249f1f35a00741d65a21924e93b
Instruction Fuzzy Hash: 20E1FF7194438A9FDB749F64CC557EE7BB2AF95350F42852DDC8A9B210D3308A81CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02178098, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265b33fcc02bb4eda5e86b4eb97456cbd0bed7bc7feffe628b4f29d47d98e11b
Instruction ID: 1f1fa0a14ab3d027d90628d7cda76d59a0a43ab9a3aa48a72f4c3e97fd22a294
Opcode Fuzzy Hash: 265b33fcc02bb4eda5e86b4eb97456cbd0bed7bc7feffe628b4f29d47d98e11b
Instruction Fuzzy Hash: 4B81243468A2869FD7308E2C8894BCB27B7EB5A304FEA4219CD058F707E372A545D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02174CD0, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c20ce1bf690f0898c90920ff23a43b5eb8104875dfb4d231677d051a0b8c07
Instruction ID: 3b19b97a4355bd9c2d65c85f984baac767c316f6f799a050be0f815bb7455837
Opcode Fuzzy Hash: f6c20ce1bf690f0898c90920ff23a43b5eb8104875dfb4d231677d051a0b8c07
Instruction Fuzzy Hash: FCA1CCB26452889FDF718F28CD847CE3BB6BF98310F45822ADD4D9B250C3719A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021719F4, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3c8345f2ebb02002316c9586312f9d35d5341635ce00bd1b6f155fb289de3d
Instruction ID: 45cc0513101e9fe5e450a97aa07a7559eb0bc0aac55e5ef4e2ab980620326911
Opcode Fuzzy Hash: cc3c8345f2ebb02002316c9586312f9d35d5341635ce00bd1b6f155fb289de3d
Instruction Fuzzy Hash: 7971E37048B5C26FD3218F2C8845BC76B679B57324BE9838DDA584F78BE3666506C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 02173C9E, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bece44d5bf867811accee7572e16d52075aa197f64c7ef114d927732b5c068ef
Instruction ID: fc179eb4c852adbfae963a5b84e1bd047e7e96fb5836993d85b3e5910d376f78
Opcode Fuzzy Hash: bece44d5bf867811accee7572e16d52075aa197f64c7ef114d927732b5c068ef
Instruction Fuzzy Hash: E57179715443888FDB75CF78C8947EABBE1AF4A310F55816DCCD99B246E3308982CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02178687, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f4cdacc88bca2f7c625434078033ec775a34bea28ef0ae62758a6f8387816b
Instruction ID: 8f0b90a102a542fc5246762760e98bfb6d8a31ffa19a6fbf32190cb79cba2264
Opcode Fuzzy Hash: c6f4cdacc88bca2f7c625434078033ec775a34bea28ef0ae62758a6f8387816b
Instruction Fuzzy Hash: 3D6132716443489FDB64DF78C9953EABBB2EF85200F95412DDC8A9B204D3309A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02175BF3, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 011b771ef13a84f528cef82bf0b947ce7d6e462ea3d0cbe3b4894a75846d49bd
Instruction ID: 84c0fc7e0d41295b8801d741a6f63448f55402fcfeb7c1f4c80f75437a904b2e
Opcode Fuzzy Hash: 011b771ef13a84f528cef82bf0b947ce7d6e462ea3d0cbe3b4894a75846d49bd
Instruction Fuzzy Hash: 866104715443488FDB659F7488553EEBBB2BF85350F96412EDC8A9B240D7308A82CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02170571, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c54810ed9045168aeaa0147e386659637b30552420c9f76acf2747e42fd705
Instruction ID: cd80c51de3009b73e7dfda5c622f41e07f1314fda85ae93fa855c3fde545535a
Opcode Fuzzy Hash: 87c54810ed9045168aeaa0147e386659637b30552420c9f76acf2747e42fd705
Instruction Fuzzy Hash: 3F61FE719443899FCB649F34C8557EEBBF2AF89350F56452DDC898B210D3309A82CF96

Uniqueness

Uniqueness Score: -1.00%

Function 021782DC, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f11d9956a5a3959d4f52597242589e3b266a6103083b263185666f8bb0432dd
Instruction ID: 5bace844c8ef180d9ab81834daf00b485f4ebcc5e5f73750a00762aa3d007485
Opcode Fuzzy Hash: 3f11d9956a5a3959d4f52597242589e3b266a6103083b263185666f8bb0432dd
Instruction Fuzzy Hash: DD510536988385CFCB30CF3988957DA7BB2FF49344F5A846ACC899B205D3309945DB55

Uniqueness

Uniqueness Score: -1.00%

Function 02173EE1, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a5ae5d6cd18b300ef2bcb010f693b1507227049fe71e898e24e97960e6cb3c
Instruction ID: ae917006b4aa02aedc16d2cace00de26bb5c50c4e54477f7287754511544edad
Opcode Fuzzy Hash: 83a5ae5d6cd18b300ef2bcb010f693b1507227049fe71e898e24e97960e6cb3c
Instruction Fuzzy Hash: 77510372A85344EFDB74DE29C9A53DA77F2AFA9300F16452EC84EAB644D730BA418701

Uniqueness

Uniqueness Score: -1.00%

Function 02178324, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f75a37939ab88ffb55ac4fba7b958fb42d930ac9ec9678f0c7baa06069211e6
Instruction ID: b79c64e12a0c361c72f63c8e6265efc4ebce19abac7a076971dada9fcb92e8bd
Opcode Fuzzy Hash: 9f75a37939ab88ffb55ac4fba7b958fb42d930ac9ec9678f0c7baa06069211e6
Instruction Fuzzy Hash: CA41C235A94389DFCB74CF2988947DA77B2BF48340F8A451ADC8DEB200D3309985CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02178294, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe9b38e11e07c8c1843ffe7d16384f77f469b086364a2a835b7cc47736b0c5e
Instruction ID: db5907283886775a79224cda15612858efa43374e1c379bed921a8326a2795a8
Opcode Fuzzy Hash: cfe9b38e11e07c8c1843ffe7d16384f77f469b086364a2a835b7cc47736b0c5e
Instruction Fuzzy Hash: 9841B276A54289DFCB74CE2988947DA37B2FF48340F8A452ADC5DEB204D3309A85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02171940, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e976512adf42a38eeafe88a3d9c0bc0b9b2d92210c409638c58be359c6d3839c
Instruction ID: 1feb3d609e2c1d0463eb52ff488306f06d6778a2345e03a1f65c63dc08183147
Opcode Fuzzy Hash: e976512adf42a38eeafe88a3d9c0bc0b9b2d92210c409638c58be359c6d3839c
Instruction Fuzzy Hash: EE51C6314096D65BC7328F3C8C05BEABF656F86330F49838EC8999B2D2C3712511C795

Uniqueness

Uniqueness Score: -1.00%

Function 02177921, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddb5f4544a898af7abeacbddb87c23466c3654345383bba92b87ae9fe36aff7
Instruction ID: eb28f1af4a5476d19e0f4bd3a6aa82ac389ef0b332424a674068cafbb2a71f8f
Opcode Fuzzy Hash: bddb5f4544a898af7abeacbddb87c23466c3654345383bba92b87ae9fe36aff7
Instruction Fuzzy Hash: 1B21A135A0538A8FCB30DF28D9817EAB7B2FFAA754F494058DC888B241E3349956C604

Uniqueness

Uniqueness Score: -1.00%

Function 02177B16, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76725b2ff9a5b77ec050a76e7a1396c4d2353ee1fe1f70c6b6ba6d27bcd71d19
Instruction ID: f49696791d13c68354544f00eea11470c1b2e88a6b6d6a68c7f612b0c3af4de6
Opcode Fuzzy Hash: 76725b2ff9a5b77ec050a76e7a1396c4d2353ee1fe1f70c6b6ba6d27bcd71d19
Instruction Fuzzy Hash: 23014B72255258CFCB34DF18C9D8AE9B3B5BF98720F26456AEC568B350D370AE42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 021773AF, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e146614609d2ba9d0f5d83db80296ef6a2fcb1ad9bef9cd0baed55dfc7c8e3d6
Instruction ID: a62b2317af4a74a0c45c0e41d1483f7d89cab885a11812f67940336ce3850b43
Opcode Fuzzy Hash: e146614609d2ba9d0f5d83db80296ef6a2fcb1ad9bef9cd0baed55dfc7c8e3d6
Instruction Fuzzy Hash: A4C02B341402000BDB364740C541797F260EF59320F00C02D85074A1C1E3FC4CC14011

Uniqueness

Uniqueness Score: -1.00%

Function 0217548E, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204b9d85454be2230e613514e098da5b6522b06d8ca01098c84f97446119f7ad
Instruction ID: b0cbafd48e1b2eadc20650bf8cd2163a3d804b71ca913fb9173c33f0e4a5ddc2
Opcode Fuzzy Hash: 204b9d85454be2230e613514e098da5b6522b06d8ca01098c84f97446119f7ad
Instruction Fuzzy Hash: C8C048F6282581DFEB15DA48C4A1B5173B6EB64648FC50490E813CBB12C228ED00CA00

Uniqueness

Uniqueness Score: -1.00%

Function 021773F1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.725863057.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bcaf993096cd6c3b7342c14149681abad214693972ad1ae3544e5900d590c3
Instruction ID: c241b3f5efd54cf35cf40e27ad961033f2e5d5d87e17bf41ba57d53856cd5df8
Opcode Fuzzy Hash: 13bcaf993096cd6c3b7342c14149681abad214693972ad1ae3544e5900d590c3
Instruction Fuzzy Hash: 37B002753526408FD655CE1AC190F5573A4BB44A51F415494E81187B15D764E9009910

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report loKmeabs9V.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: loKmeabs9V.exe PID: 6084 Parent PID: 5572

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: loKmeabs9V.exe PID: 6084 Parent PID: 5572 loKmeabs9V.exeCOMMON

Executed Functions

Function 02175971, Relevance: 1.6, APIs: 1, Instructions: 102memorynativeCOMMON