Play interactive tour

Edit tour

Windows Analysis Report http___2.56.59.76_alig.jpg

Overview

General Information

Sample Name:	http___2.56.59.76_alig.jpg (renamed file extension from jpg to exe)
Analysis ID:	457978
MD5:	4cb9e2f765041f74d74e4635144ce621
SHA1:	472ee254ad0196a8a80517d19d2d2f3f0df1fdd7
SHA256:	bd068442713d668c544ed7c9b439e27121b33ac1573b12c95c7ff7ca8003d283
Tags:	exejpg
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

http___2.56.59.76_alig.exe (PID: 7152 cmdline: 'C:\Users\user\Desktop\http___2.56.59.76_alig.exe' MD5: 4CB9E2F765041F74D74E4635144CE621)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://onedrive.live.com/download"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download"}

Machine Learning detection for sample

Show sources

Source: http___2.56.59.76_alig.exe

Joe Sandbox ML: detected

Source: http___2.56.59.76_alig.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://onedrive.live.com/download

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Code function: 1_2_0040289C GetAsyncKeyState,

1_2_0040289C

Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157181207.000000000076A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB667C NtAllocateVirtualMemory,	1_2_03CB667C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB67D4 NtAllocateVirtualMemory,	1_2_03CB67D4
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB66A4 NtAllocateVirtualMemory,	1_2_03CB66A4
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB661D NtAllocateVirtualMemory,	1_2_03CB661D

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB667C	1_2_03CB667C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB97C8	1_2_03CB97C8
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB03CC	1_2_03CB03CC
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB11D3	1_2_03CB11D3
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB41D3	1_2_03CB41D3
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4FD3	1_2_03CB4FD3
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBA3EE	1_2_03CBA3EE
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBA3EC	1_2_03CBA3EC
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB53FB	1_2_03CB53FB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB13F6	1_2_03CB13F6
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB6380	1_2_03CB6380
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9580	1_2_03CB9580
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBAD9D	1_2_03CBAD9D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB499D	1_2_03CB499D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2FAB	1_2_03CB2FAB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9FAB	1_2_03CB9FAB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBADAB	1_2_03CBADAB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBA1A8	1_2_03CBA1A8
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2DA1	1_2_03CB2DA1
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB23A7	1_2_03CB23A7
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9DBA	1_2_03CB9DBA
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB49B7	1_2_03CB49B7
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0FB6	1_2_03CB0FB6
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0B47	1_2_03CB0B47
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB596E	1_2_03CB596E
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4D6C	1_2_03CB4D6C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0B63	1_2_03CB0B63
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB3163	1_2_03CB3163
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2379	1_2_03CB2379
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0376	1_2_03CB0376
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB1508	1_2_03CB1508
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB1102	1_2_03CB1102
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5718	1_2_03CB5718
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2B1F	1_2_03CB2B1F
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB511C	1_2_03CB511C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0F17	1_2_03CB0F17
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D29	1_2_03CB9D29
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4128	1_2_03CB4128
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBAF28	1_2_03CBAF28
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0930	1_2_03CB0930
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5534	1_2_03CB5534
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB08D9	1_2_03CB08D9
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9AD4	1_2_03CB9AD4
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB06EB	1_2_03CB06EB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB12F4	1_2_03CB12F4
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2285	1_2_03CB2285
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBA09F	1_2_03CBA09F
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5290	1_2_03CB5290
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9690	1_2_03CB9690
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5AAE	1_2_03CB5AAE
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4EA2	1_2_03CB4EA2
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB8CA1	1_2_03CB8CA1
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB66A4	1_2_03CB66A4
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9EB8	1_2_03CB9EB8
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB8ABF	1_2_03CB8ABF
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9ABD	1_2_03CB9ABD
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB40B1	1_2_03CB40B1
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB584C	1_2_03CB584C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5446	1_2_03CB5446
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB1667	1_2_03CB1667
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB947B	1_2_03CB947B
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9478	1_2_03CB9478
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBAE7E	1_2_03CBAE7E
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBAE1E	1_2_03CBAE1E
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB661D	1_2_03CB661D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4627	1_2_03CB4627
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB1E39	1_2_03CB1E39
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB043C	1_2_03CB043C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB3032	1_2_03CB3032
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4831	1_2_03CB4831
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0836	1_2_03CB0836
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5636	1_2_03CB5636

Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157310262.0000000002280000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs http___2.56.59.76_alig.exe
Source: http___2.56.59.76_alig.exe, 00000001.00000000.634073264.0000000000423000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamealig.exe vs http___2.56.59.76_alig.exe
Source: http___2.56.59.76_alig.exe	Binary or memory string: OriginalFilenamealig.exe vs http___2.56.59.76_alig.exe

Source: http___2.56.59.76_alig.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCEE7CBDD8D96BF04.TMP

Jump to behavior

Source: http___2.56.59.76_alig.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

File read: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_00407B80 push eax; ret	1_2_00407B86
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB711C push esi; ret	1_2_03CB711E
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CBB869 pushad ; ret	1_2_03CBB86A

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4FD3	1_2_03CB4FD3
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB53FB	1_2_03CB53FB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB499D	1_2_03CB499D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2FAB	1_2_03CB2FAB
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4D6C	1_2_03CB4D6C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB3163	1_2_03CB3163
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB511C	1_2_03CB511C
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB0F17	1_2_03CB0F17
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4128	1_2_03CB4128
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB2285	1_2_03CB2285
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB5290	1_2_03CB5290
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4EA2	1_2_03CB4EA2
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB40B1	1_2_03CB40B1
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9478	1_2_03CB9478
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB3032	1_2_03CB3032

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

RDTSC instruction interceptor: First address: 0000000003CB92C9 second address: 0000000003CB92C9 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 7305038Fh 0x00000007 sub eax, 428F9BE4h 0x0000000c xor eax, A94964F8h 0x00000011 add eax, 66C3FCAEh 0x00000016 cpuid 0x00000018 cmp bh, bh 0x0000001a popad 0x0000001b call 00007F7518B710E5h 0x00000020 lfence 0x00000023 mov edx, 89618492h 0x00000028 xor edx, A0F4BA61h 0x0000002e add edx, F6C4231Dh 0x00000034 xor edx, 5FA76204h 0x0000003a mov edx, dword ptr [edx] 0x0000003c lfence 0x0000003f cmp cl, bl 0x00000041 jmp 00007F7518B71104h 0x00000043 cmp edx, ecx 0x00000045 ret 0x00000046 sub edx, esi 0x00000048 ret 0x00000049 add edi, edx 0x0000004b nop 0x0000004c dec dword ptr [ebp+000000F8h] 0x00000052 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000059 jne 00007F7518B710BBh 0x0000005b call 00007F7518B71184h 0x00000060 call 00007F7518B71108h 0x00000065 lfence 0x00000068 mov edx, 89618492h 0x0000006d xor edx, A0F4BA61h 0x00000073 add edx, F6C4231Dh 0x00000079 xor edx, 5FA76204h 0x0000007f mov edx, dword ptr [edx] 0x00000081 lfence 0x00000084 cmp cl, bl 0x00000086 jmp 00007F7518B71104h 0x00000088 cmp edx, ecx 0x0000008a ret 0x0000008b mov esi, edx 0x0000008d pushad 0x0000008e rdtsc

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Code function: 1_2_03CB03CC rdtsc

1_2_03CB03CC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Code function: 1_2_03CB03CC rdtsc

1_2_03CB03CC

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB8DE9 mov eax, dword ptr fs:[00000030h]	1_2_03CB8DE9
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB61AD mov eax, dword ptr fs:[00000030h]	1_2_03CB61AD
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB87BC mov eax, dword ptr fs:[00000030h]	1_2_03CB87BC
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D mov eax, dword ptr fs:[00000030h]	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D4D mov eax, dword ptr fs:[00000030h]	1_2_03CB9D4D
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB9D29 mov eax, dword ptr fs:[00000030h]	1_2_03CB9D29
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB4128 mov eax, dword ptr fs:[00000030h]	1_2_03CB4128
Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe	Code function: 1_2_03CB40B1 mov eax, dword ptr fs:[00000030h]	1_2_03CB40B1

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157257404.0000000000DF0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157257404.0000000000DF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157257404.0000000000DF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: http___2.56.59.76_alig.exe, 00000001.00000002.1157257404.0000000000DF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\http___2.56.59.76_alig.exe

Code function: 1_2_03CB9ABD cpuid

1_2_03CB9ABD

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture21	Security Software Discovery31	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery211	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http___2.56.59.76_alig.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
2.56.59.76	unknown	Netherlands		395800	GBTCLOUDUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	457978
Start date:	02.08.2021
Start time:	16:28:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	http___2.56.59.76_alig.jpg (renamed file extension from jpg to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.2% (good quality ratio 0%) Quality average: 1% Quality standard deviation: 2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
2.56.59.76	ISO certificate.js	Get hash	malicious	Browse	2.56.59.76/efryses.jpg

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GBTCLOUDUS	93ejLcdBh5.exe	Get hash	malicious	Browse	2.56.59.245
	QUOTEGMC 92304882399300PDF.exe	Get hash	malicious	Browse	2.56.59.84
	CLnraL1yNc.exe	Get hash	malicious	Browse	2.56.59.245
	bo45SS7iic.exe	Get hash	malicious	Browse	2.56.59.13
	JXFHx4gRdl.exe	Get hash	malicious	Browse	2.56.59.245
	226wkEc1Jt.exe	Get hash	malicious	Browse	2.56.59.245
	28XiT9IuAd	Get hash	malicious	Browse	5.180.254.80
	2oqbSqXHmw.exe	Get hash	malicious	Browse	2.56.59.245
	RIi1iCfuVK.exe	Get hash	malicious	Browse	2.56.59.245
	oEF7GAiRIg	Get hash	malicious	Browse	45.11.15.116
	GEso3CniSk	Get hash	malicious	Browse	45.11.15.127
	ySZpdJfqMO.exe	Get hash	malicious	Browse	2.56.59.245
	IPVrDRKfYj.exe	Get hash	malicious	Browse	2.56.59.245
	6BeKYZk7bg.exe	Get hash	malicious	Browse	2.56.59.245
	Odeme Plani.exe	Get hash	malicious	Browse	2.56.59.45
	xAC6nZjT3T.exe	Get hash	malicious	Browse	2.56.59.245
	Cx9ER7vYGi.exe	Get hash	malicious	Browse	2.56.59.245
	xBMx9OBP97.exe	Get hash	malicious	Browse	2.56.59.245
	jYzWBKTsxE.exe	Get hash	malicious	Browse	2.56.59.245
	CSyG3zNcwS.exe	Get hash	malicious	Browse	2.56.59.245

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4509405404826605
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	http___2.56.59.76_alig.exe
File size:	143360
MD5:	4cb9e2f765041f74d74e4635144ce621
SHA1:	472ee254ad0196a8a80517d19d2d2f3f0df1fdd7
SHA256:	bd068442713d668c544ed7c9b439e27121b33ac1573b12c95c7ff7ca8003d283
SHA512:	702a46be89a2473b2b7d6fdf0eb639ce8eb62bf349a8b065703e500885bcb14cacf62558fb0f3113e25c78f71adda798b47cdf294da5c1efa69f093f67fc1532
SSDEEP:	3072:71C0Uu0lfu5AIRSJCgwNNNerSeMn5GqY4wNGZ+M:8u0lDIsJCggNNHzL3wc+
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......H.....................0....................@................

File Icon


Icon Hash:	c4e8c8cccce0e8e8

Static PE Info

General
Entrypoint:	0x4014b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x48BAEC05 [Sun Aug 31 19:07:49 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	fef384fc3a66a559dff455f07d497ca0

Entrypoint Preview

Instruction
push 00401EA8h
call 00007F7518B79CD3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
call 00007F752B17EC4Dh
inc edi
pop es
dec eax
pushfd
dec edx
aas
cmp al, 26h
or al, 2Eh
push 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+60h], bl
sti
add al, byte ptr [ecx+6Ch]
add byte ptr fs:[edx+eax+00h], ch
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add byte ptr [ebx-3Ch], cl
adc dh, cl
inc eax
inc ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20794	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23000	0xc08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x190	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1fd8c	0x20000	False	0.388229370117	data	6.74552663874	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x21000	0x11bc	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x23000	0xc08	0x1000	False	0.312255859375	data	3.25895925558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x23360	0x8a8	data
RT_GROUP_ICON	0x2334c	0x14	data
RT_VERSION	0x230f0	0x25c	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaVarForInit, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaR4Str, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaR8Str, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	alig
FileVersion	1.00
CompanyName	Intersection Road
Comments	Intersection Road
ProductName	metapsychism
ProductVersion	1.00
OriginalFilename	alig.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: http___2.56.59.76_alig.exe PID: 7152 Parent PID: 5900

General

Start time:	16:28:52
Start date:	02/08/2021
Path:	C:\Users\user\Desktop\http___2.56.59.76_alig.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\http___2.56.59.76_alig.exe'
Imagebase:	0x400000
File size:	143360 bytes
MD5 hash:	4CB9E2F765041F74D74E4635144CE621
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: http___2.56.59.76_alig.exe PID: 7152 Parent PID: 5900 http___2.56.59.76_alig.exeCOMMON

Executed Functions

Function 03CB66A4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 03CB687B

Strings

nK, xrefs: 03CB670C

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: nK
API String ID: 2167126740-1537854670
Opcode ID: 4a46539230d8396a81d0107a3bdecb32f36484f9539ab8ab4b3a3ff473baad35
Instruction ID: 3b4f37b1bc231cb9d8066e132333a446651868f52e59aae3305ab6b536d76166
Opcode Fuzzy Hash: 4a46539230d8396a81d0107a3bdecb32f36484f9539ab8ab4b3a3ff473baad35
Instruction Fuzzy Hash: F741F675A097158FD7749E3CCC512CAB7E2AF8A360F554629A998C73E0D730894A8F02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB667C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 03CB687B

Strings

nK, xrefs: 03CB670C

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: nK
API String ID: 2167126740-1537854670
Opcode ID: 790e634f295912089f4621d7497791fe3450f7bf8032110863cdea835f442fff
Instruction ID: a4d3b15457500bd4325cd2b070e60b69781b7ec6131274e99a69bbb7018ca5a1
Opcode Fuzzy Hash: 790e634f295912089f4621d7497791fe3450f7bf8032110863cdea835f442fff
Instruction Fuzzy Hash: CD41BDB65083489FDB309E29CC517EEBBE6EF55350F56441EE889DB210D7308A89CF06

Uniqueness

Uniqueness Score: -1.00%

Function 03CB661D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 03CB687B

Strings

nK, xrefs: 03CB670C

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: nK
API String ID: 2167126740-1537854670
Opcode ID: 4011c97fbda5ea701c5d33e31c5622e6d014bc5f1cac417c28049e7ec851d9b4
Instruction ID: 14a8f4c1b0ee79837a501ed6fd108cd40adba1d44bf94081ba6c53da0f60b6de
Opcode Fuzzy Hash: 4011c97fbda5ea701c5d33e31c5622e6d014bc5f1cac417c28049e7ec851d9b4
Instruction Fuzzy Hash: A931BDB55083489FDB74AE29CC517EEBBE2EF55350F56041ED889DB210D7309A85CB06

Uniqueness

Uniqueness Score: -1.00%

Function 03CB67D4, Relevance: 1.6, APIs: 1, Instructions: 100memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 03CB687B

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c86e6517c6c3579776cb2588eef60c3e0605b8e7f6ac005a1cc9a8a956dbd352
Instruction ID: a28defc4b01fc6920acae57c4ef6243c9dae8f2560bd8545e1242eb8b9cf9f66
Opcode Fuzzy Hash: c86e6517c6c3579776cb2588eef60c3e0605b8e7f6ac005a1cc9a8a956dbd352
Instruction Fuzzy Hash: E5316175A56A165BD7748E3DCC502C9B3E39B8E374F544365AA68CB3F0D731CA0A4B02

Uniqueness

Uniqueness Score: -1.00%

Function 0040289C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1156925364.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1156918296.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1156965951.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1156975780.0000000000423000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03ccd294452cba3fe900eba8adf0d31c854dbfa1ae0f69d1d3c02d512e6d4cd
Instruction ID: 550ed69a2d5e404ad6617ad7cd93b1f7d35e9243efbfd02251bac468c9e8ef00
Opcode Fuzzy Hash: c03ccd294452cba3fe900eba8adf0d31c854dbfa1ae0f69d1d3c02d512e6d4cd
Instruction Fuzzy Hash: 12B01226384103BBF624E2544D065382281AA047C03248D37F801F11E0CBBCCC00912D

Uniqueness

Uniqueness Score: -1.00%

Function 004168A0, Relevance: 246.6, APIs: 121, Strings: 19, Instructions: 1564COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00402CD4,00000002), ref: 004169C2
#591.MSVBVM60(00000002), ref: 004169E3
__vbaStrMove.MSVBVM60 ref: 004169F1
__vbaStrCat.MSVBVM60(00402A90,Inte,00000000), ref: 00416A08
__vbaStrMove.MSVBVM60 ref: 00416A12
__vbaStrCat.MSVBVM60(00402A98,00000000), ref: 00416A1E
__vbaStrMove.MSVBVM60 ref: 00416A28
__vbaStrCat.MSVBVM60(00402AA0,00000000), ref: 00416A34
__vbaStrMove.MSVBVM60 ref: 00416A3E
__vbaStrCmp.MSVBVM60(00000000), ref: 00416A45
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00416A73
__vbaFreeVar.MSVBVM60 ref: 00416A82
#535.MSVBVM60 ref: 00416A91
#554.MSVBVM60 ref: 00416A99
#648.MSVBVM60(0000000A), ref: 00416ABA
__vbaFreeVar.MSVBVM60 ref: 00416AC6
_adj_fdiv_m64.MSVBVM60(425C0000), ref: 00416AF6
__vbaFpI4.MSVBVM60(43530000,?,425C0000), ref: 00416B20
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402748,000002C0,?,425C0000), ref: 00416B54
__vbaVarDup.MSVBVM60(?,425C0000), ref: 00416B7A
#645.MSVBVM60(00000002,00000000), ref: 00416B88
__vbaStrMove.MSVBVM60(?,425C0000), ref: 00416B96
__vbaFreeVar.MSVBVM60(?,425C0000), ref: 00416BA8
__vbaSetSystemError.MSVBVM60(00000000), ref: 00416BB6
#554.MSVBVM60(?,425C0000), ref: 00416BCF
#648.MSVBVM60(0000000A), ref: 00416BF0
__vbaFreeVar.MSVBVM60(?,425C0000), ref: 00416BFC
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00416C10
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00416C38
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,0000013C), ref: 00416CA2
__vbaFreeObj.MSVBVM60 ref: 00416CAE
__vbaVarDup.MSVBVM60 ref: 00416D02
#595.MSVBVM60(0000000A,00000000,?,?,?), ref: 00416D25
__vbaFreeVarList.MSVBVM60(00000004,0000000A,?,?,?), ref: 00416D49
__vbaSetSystemError.MSVBVM60 ref: 00416D60
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,000000E3,00000000), ref: 00416D8B
__vbaGenerateBoundsError.MSVBVM60 ref: 00416DAB
__vbaGenerateBoundsError.MSVBVM60 ref: 00416DB8
__vbaGenerateBoundsError.MSVBVM60 ref: 00416DE2
__vbaGenerateBoundsError.MSVBVM60 ref: 00416DEF
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E19
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E26
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E50
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E5D
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E87
__vbaGenerateBoundsError.MSVBVM60 ref: 00416E94
__vbaGenerateBoundsError.MSVBVM60 ref: 00416EBE
__vbaGenerateBoundsError.MSVBVM60 ref: 00416ECB
__vbaGenerateBoundsError.MSVBVM60 ref: 00416EF5
__vbaGenerateBoundsError.MSVBVM60 ref: 00416F02
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00416F24
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00416F4C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000C8), ref: 00416F7C
__vbaFreeObj.MSVBVM60 ref: 00416F88
#705.MSVBVM60(00000002,00000000), ref: 00416FAA
__vbaStrMove.MSVBVM60 ref: 00416FBB
__vbaFreeVar.MSVBVM60 ref: 00416FC3
__vbaVarDup.MSVBVM60 ref: 0041703B
#596.MSVBVM60(00000002,?,?,?,?,?,?), ref: 00417072
__vbaStrMove.MSVBVM60 ref: 00417080
__vbaFreeVarList.MSVBVM60(00000007,00000002,?,?,?,?,?,?), ref: 004170B5
__vbaStrToAnsi.MSVBVM60(?,splurge,00000000), ref: 004170D1
__vbaStrToAnsi.MSVBVM60(?,Udskylningen8,00000000,00000000), ref: 004170E1
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 004170F1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041711B
__vbaOnError.MSVBVM60(00000000), ref: 00417C32
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00417C4A
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00417C72
__vbaHresultCheckObj.MSVBVM60(00000000,00006878,00402B10,00000140), ref: 00417CA2
__vbaFreeObj.MSVBVM60 ref: 00417CAE
#571.MSVBVM60(000000A7), ref: 00417CB9
__vbaSetSystemError.MSVBVM60(00000000), ref: 00417CC5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040277C,000006F8), ref: 00417CFA
__vbaStrCopy.MSVBVM60 ref: 00417D97
__vbaFreeStr.MSVBVM60 ref: 00417DF1
__vbaStrCopy.MSVBVM60 ref: 00417E02
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040277C,000006FC), ref: 00417E69
__vbaFreeStr.MSVBVM60 ref: 00417E75
__vbaStrCopy.MSVBVM60 ref: 00417EAE
__vbaFreeStr.MSVBVM60 ref: 00417F03
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402748,000002B4), ref: 00417F24
__vbaVarForInit.MSVBVM60(?,?,?,?,00000003,00000008), ref: 00417F86
__vbaVarForNext.MSVBVM60(?,?,?), ref: 00417FA8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040277C,00000700), ref: 00417FC5
__vbaStrToAnsi.MSVBVM60(?,Saturnale,007C533E), ref: 00417FDC
__vbaSetSystemError.MSVBVM60(00000000), ref: 00417FEE
__vbaFreeStr.MSVBVM60 ref: 0041800E
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041802F
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00418057
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000C0), ref: 00418087
__vbaFreeObj.MSVBVM60 ref: 00418093
#535.MSVBVM60 ref: 00418099
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 004180B3
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 004180DB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000138), ref: 0041810B
__vbaFreeObj.MSVBVM60 ref: 00418117
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402748,00000254), ref: 0041813D
__vbaStrToAnsi.MSVBVM60(?,tenodynia,00564E24,006E96F2), ref: 00418159
__vbaSetSystemError.MSVBVM60(0020D311,0062033C,00000000), ref: 00418175
__vbaFreeStr.MSVBVM60 ref: 00418195
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 004181B6
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 004181DE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,0000013C), ref: 0041824E
__vbaFreeObj.MSVBVM60 ref: 0041825E
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00418276
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041829E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000078), ref: 004182C4
__vbaFreeObj.MSVBVM60 ref: 004182CC
#702.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004182F5
__vbaStrMove.MSVBVM60 ref: 00418300
__vbaFreeVar.MSVBVM60 ref: 0041830C
__vbaLateMemCall.MSVBVM60(?,O23LzRvYz94dcuxxifrC105,00000003), ref: 004183A5
__vbaFreeVarList.MSVBVM60(00000002,?,?,00418497), ref: 00418439
__vbaFreeVar.MSVBVM60 ref: 00418445
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00418458
__vbaFreeStr.MSVBVM60 ref: 00418463
__vbaAryDestruct.MSVBVM60(00000000,005FFFC2), ref: 00418476
__vbaFreeObj.MSVBVM60 ref: 0041847B
__vbaFreeStr.MSVBVM60 ref: 00418484
__vbaFreeStr.MSVBVM60 ref: 0041848C
__vbaFreeStr.MSVBVM60 ref: 00418494

Strings

SLEEVING, xrefs: 00417DF7
Macromastia, xrefs: 00418224
tenodynia, xrefs: 0041814D
Grnseegnes, xrefs: 00418326
Udskylningen8, xrefs: 004170D5
Hemiageusia, xrefs: 004180ED
Overflyvningens, xrefs: 00417DDF
splurge, xrefs: 004170BF
Betyngedes8, xrefs: 00417EA3
LETTERFORM, xrefs: 00417D62
Refuserende, xrefs: 0041701B
Nubia, xrefs: 00417D86
O23LzRvYz94dcuxxifrC105, xrefs: 0041839C
Paw7, xrefs: 00417ED4
Saturnale, xrefs: 00417FD0
Incarnant, xrefs: 00416CE2
hjlpeklassens, xrefs: 00416C7E
Inte, xrefs: 004169F8
HYPASPIST, xrefs: 00416B5A

Memory Dump Source

Source File: 00000001.00000002.1156925364.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1156918296.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1156965951.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1156975780.0000000000423000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Error$CheckHresult$BoundsGenerate$Move$New2$System$List$Ansi$Copy$#535#554#648Destruct$#571#591#595#596#645#702#705CallConstruct2InitLateNextRedim_adj_fdiv_m64
String ID: Betyngedes8$Grnseegnes$HYPASPIST$Hemiageusia$Incarnant$Inte$LETTERFORM$Macromastia$Nubia$O23LzRvYz94dcuxxifrC105$Overflyvningens$Paw7$Refuserende$SLEEVING$Saturnale$Udskylningen8$hjlpeklassens$splurge$tenodynia
API String ID: 462913989-2394078402
Opcode ID: fd464a6fe5924b47a2b9ef169ee6c5b1b182a3eb977992c4e3c5728d22c2a91f
Instruction ID: 044148fa49d8a33c47ce9e85c62c59f3bf655bb4b53fac71fb7c218004fe0982
Opcode Fuzzy Hash: fd464a6fe5924b47a2b9ef169ee6c5b1b182a3eb977992c4e3c5728d22c2a91f
Instruction Fuzzy Hash: C3F22674E002189BCB14CF54C988BDDFBB5FF48300F1481AAE9196B361DB75A986CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A800, Relevance: 168.6, APIs: 89, Strings: 7, Instructions: 605COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041A885
__vbaAryConstruct2.MSVBVM60(?,00402DD8,00000003), ref: 0041A896
__vbaStrCat.MSVBVM60(00402D44,00402D3C), ref: 0041A8AC
__vbaStrMove.MSVBVM60 ref: 0041A8B9
__vbaStrCat.MSVBVM60(11:1,00000000), ref: 0041A8C1
__vbaStrMove.MSVBVM60 ref: 0041A8CB
__vbaStrCat.MSVBVM60(00402D3C,00000000), ref: 0041A8D3
#547.MSVBVM60(?,?), ref: 0041A8F3
__vbaVarTstNe.MSVBVM60(?,?), ref: 0041A91B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041A931
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041A947
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041A96B
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041A999
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000E8), ref: 0041A9CA
__vbaStrMove.MSVBVM60 ref: 0041A9D5
__vbaFreeObj.MSVBVM60 ref: 0041A9E1
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041A9F9
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041AA21
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000130), ref: 0041AA4A
__vbaStrMove.MSVBVM60 ref: 0041AA55
__vbaFreeObj.MSVBVM60 ref: 0041AA61
#593.MSVBVM60(00000008), ref: 0041AA82
__vbaFreeVar.MSVBVM60 ref: 0041AA90
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041AAA8
__vbaCastObj.MSVBVM60(?,00402D70,cimbrer), ref: 0041AAC4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041AAD2
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000040), ref: 0041AAEC
__vbaFreeObj.MSVBVM60 ref: 0041AAF8
__vbaR4Str.MSVBVM60(00402D3C), ref: 0041AB09
__vbaStrCat.MSVBVM60(00402D3C,19:), ref: 0041AB2A
__vbaStrMove.MSVBVM60 ref: 0041AB37
__vbaStrCat.MSVBVM60(9:19,00000000), ref: 0041AB3F
__vbaStrMove.MSVBVM60 ref: 0041AB49
#541.MSVBVM60(00000008,00000000), ref: 0041AB53
__vbaStrVarMove.MSVBVM60(00000008), ref: 0041AB60
__vbaStrMove.MSVBVM60 ref: 0041AB6B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041AB7A
__vbaFreeVar.MSVBVM60 ref: 0041AB89
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041ABA1
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041ABCF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000068), ref: 0041ABFD
__vbaFreeObj.MSVBVM60 ref: 0041AC05
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041AC1D
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041AC45
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000E0), ref: 0041AC6E
__vbaStrMove.MSVBVM60 ref: 0041AC79
__vbaFreeObj.MSVBVM60 ref: 0041AC85
__vbaVarDup.MSVBVM60 ref: 0041ACAB
#600.MSVBVM60(00000008,00000002), ref: 0041ACBA
__vbaFreeVar.MSVBVM60 ref: 0041ACC8
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041ACE0
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041AD0E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000050), ref: 0041AD39
__vbaStrCmp.MSVBVM60(00000000,?), ref: 0041AD40
__vbaFreeStr.MSVBVM60 ref: 0041AD52
__vbaFreeObj.MSVBVM60 ref: 0041AD5E
#703.MSVBVM60(00000008,000000FF,000000FE,000000FE,000000FE), ref: 0041ADDF
__vbaStrMove.MSVBVM60 ref: 0041ADEA
__vbaFreeVar.MSVBVM60 ref: 0041ADF6
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041AE0E
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041AE36
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000E0), ref: 0041AE5F
__vbaStrMove.MSVBVM60 ref: 0041AE6A
__vbaFreeObj.MSVBVM60 ref: 0041AE76
__vbaFpI4.MSVBVM60 ref: 0041AE87
__vbaHresultCheckObj.MSVBVM60(00000000,001B8FEF,00402748,000002C8), ref: 0041AEC3
#675.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,00000008,?), ref: 0041AF15
__vbaFpR8.MSVBVM60 ref: 0041AF1B
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041AF4C
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0041AF70
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0041AF98
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,000000D0), ref: 0041AFC1
__vbaStrMove.MSVBVM60 ref: 0041AFCC
__vbaFreeObj.MSVBVM60 ref: 0041AFD8
#535.MSVBVM60 ref: 0041AFDE
#546.MSVBVM60(00000008), ref: 0041AFED
__vbaVarMove.MSVBVM60 ref: 0041AFFC
#580.MSVBVM60(Drikkeautomat3,00000001), ref: 0041B009
__vbaFreeStr.MSVBVM60(0041B0C1), ref: 0041B071
__vbaFreeStr.MSVBVM60 ref: 0041B076
__vbaFreeStr.MSVBVM60 ref: 0041B07B
__vbaFreeVar.MSVBVM60 ref: 0041B080
__vbaFreeStr.MSVBVM60 ref: 0041B089
__vbaFreeStr.MSVBVM60 ref: 0041B08E
__vbaFreeStr.MSVBVM60 ref: 0041B093
__vbaFreeStr.MSVBVM60 ref: 0041B098
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041B0AC
__vbaFreeObj.MSVBVM60 ref: 0041B0B5
__vbaFreeStr.MSVBVM60 ref: 0041B0BE

Strings

19:, xrefs: 0041AB20
ibolium, xrefs: 0041AC97
9:19, xrefs: 0041AB3A
Drikkeautomat3, xrefs: 0041B004
11:1, xrefs: 0041A8BC
cimbrer, xrefs: 0041AAB9
H.2, xrefs: 0041AD79

Memory Dump Source

Source File: 00000001.00000002.1156925364.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1156918296.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1156965951.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1156975780.0000000000423000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#535#541#546#547#580#593#600#675#703CastConstruct2CopyDestruct
String ID: 11:1$19:$9:19$Drikkeautomat3$H.2$cimbrer$ibolium
API String ID: 1210936626-4072088996
Opcode ID: 6fde6d890cc7fbe1ad82c70673f09a144a257f94a161cde4ff77839b44d09e58
Instruction ID: 93ba33363bcecb35a734ccbb9a51e5ccbc340e40f12254f5e92af64c480d9491
Opcode Fuzzy Hash: 6fde6d890cc7fbe1ad82c70673f09a144a257f94a161cde4ff77839b44d09e58
Instruction Fuzzy Hash: A9326D71900229AFCB14DF50DD88FAE7B78FB58704F10856AF50AB72A0DB746989CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004014B4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 004014B9

Strings

VB5!6&*, xrefs: 004014B4

Memory Dump Source

Source File: 00000001.00000002.1156925364.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1156918296.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1156965951.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1156975780.0000000000423000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: f32bf0c3d2621d6b9f2536db11882b929c476c29f6f57cc8776abc759c6163a8
Instruction ID: 71d5ab4573c10e0f68d61a55c49136d454e65ea1abfc63d404283a150b4f032c
Opcode Fuzzy Hash: f32bf0c3d2621d6b9f2536db11882b929c476c29f6f57cc8776abc759c6163a8
Instruction Fuzzy Hash: 54F071A694E3C41FD30723305AA12A03F719E17619B2E88EBD4C0CE4B3C21C0C4EC326

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03CB0F17, Relevance: 6.4, Strings: 4, Instructions: 1359COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410
uB60, xrefs: 03CB1A0B
|\%', xrefs: 03CB1B75
o.[, xrefs: 03CB10C4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: jea:$uB60$|\%'$o.[
API String ID: 2167126740-2528622418
Opcode ID: 771c4ed453d1470374b79cf7cf701dcad8fdb4002b61a8b6762767bc046bc45f
Instruction ID: 170f7ba886a8594aac129ae5232ae103730927b4e291089c257d48df741676d8
Opcode Fuzzy Hash: 771c4ed453d1470374b79cf7cf701dcad8fdb4002b61a8b6762767bc046bc45f
Instruction Fuzzy Hash: 70C2FEB26043899FDB74DF39CC947EABBB2BF55310F46412ADD89DB250D7309A818B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9478, Relevance: 6.1, Strings: 4, Instructions: 1069COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410
W, xrefs: 03CB09D2
}, xrefs: 03CB09E4
I, xrefs: 03CB96EC

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: I$jea:$W$}
API String ID: 0-1305186845
Opcode ID: 8530f8f827bc764e30f6c65756fdab345c96d0e6702b801f5394f9af609d0a3b
Instruction ID: 225c197b3fb763a17241e6bb782b0ba11f3dd94d7dafb258dfadd24f5128dd39
Opcode Fuzzy Hash: 8530f8f827bc764e30f6c65756fdab345c96d0e6702b801f5394f9af609d0a3b
Instruction Fuzzy Hash: B9A2EBB26043899FDB74DF39C9957EABBB2FF54310F46412ADD89DB210D3349A818B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB06EB, Relevance: 5.6, Strings: 4, Instructions: 631COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410
W, xrefs: 03CB09D2
}, xrefs: 03CB09E4
^~-H, xrefs: 03CB0D92

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ^~-H$jea:$W$}
API String ID: 0-3821870033
Opcode ID: 4e9b2d231ba36582284999552d14931ac090fb3a33df76296c74df552c70b653
Instruction ID: 21374c768d8bcdfd3bd1564885b67db91ed6308becf6254974634e92130f190b
Opcode Fuzzy Hash: 4e9b2d231ba36582284999552d14931ac090fb3a33df76296c74df552c70b653
Instruction Fuzzy Hash: 29124871A567164BD764CE3CCC512DA73E29F8E320F4547699AA8CB3E4D7308D4A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CBA3EC, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

W, xrefs: 03CB09D2
*i=, xrefs: 03CBA5F2
}, xrefs: 03CB09E4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *i=$W$}
API String ID: 0-5917868
Opcode ID: 90c5acf9a6cbd553ec6e94019f55fe6ec8ac728d25e8c4ebdc7e82868ab5d07e
Instruction ID: 2ba2d67f1bca757b2fb0646be2c3fe259f4e582239b09eae7266c5c6b2a3889c
Opcode Fuzzy Hash: 90c5acf9a6cbd553ec6e94019f55fe6ec8ac728d25e8c4ebdc7e82868ab5d07e
Instruction Fuzzy Hash: 5E914575508395CFCB24EE34C8557EBBBB2AF15310F8A856ADCCACB245D7308A85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9D4D, Relevance: 3.8, Strings: 2, Instructions: 1273COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410
*i=, xrefs: 03CBA5F2

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *i=$jea:
API String ID: 0-1133343379
Opcode ID: 9bfd666258b2254eb1f5a0a8f92b935ffead5d5a4ad164a12cbfc2f3e32ea184
Instruction ID: ac0a9fea35be8fbfc572ab402e233656365bc95ffd950ad36d969617ac3c5133
Opcode Fuzzy Hash: 9bfd666258b2254eb1f5a0a8f92b935ffead5d5a4ad164a12cbfc2f3e32ea184
Instruction Fuzzy Hash: 16C2F0716083858FDB74CF39C894BEABBB2AF55310F49816ADC99CF255C3748A81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB2285, Relevance: 3.2, Strings: 2, Instructions: 727COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410
i, xrefs: 03CB2336

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i$jea:
API String ID: 0-169208589
Opcode ID: 0b6b9d2a4106cd22342357d2d58e4ecd2e97bc4d6da9c426958aeaaea99394ab
Instruction ID: f14b19056a6ff5959e5282989a627675cc313ffdcd6f1b142d393272ae6c68ba
Opcode Fuzzy Hash: 0b6b9d2a4106cd22342357d2d58e4ecd2e97bc4d6da9c426958aeaaea99394ab
Instruction Fuzzy Hash: A962DBB16043899FDB748F39CD85BEABBB2FF59310F458129DD899B210C3749A81CB46

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0836, Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

W, xrefs: 03CB09D2
}, xrefs: 03CB09E4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: W$}
API String ID: 0-1048255054
Opcode ID: e0cf1ac94e9fda59c4572d8a3188ac960d55110a86fdc1e441e420279dd1629a
Instruction ID: 9a767512f6878892827e7350d900993becf4f2aba5ab2065088de324d136dce0
Opcode Fuzzy Hash: e0cf1ac94e9fda59c4572d8a3188ac960d55110a86fdc1e441e420279dd1629a
Instruction Fuzzy Hash: A65167716197628FD7649E78CC502DBB7E2AF0A360F460769ADD5C73E0EB3089498B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0930, Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

W, xrefs: 03CB09D2
}, xrefs: 03CB09E4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: W$}
API String ID: 0-1048255054
Opcode ID: a1cdfe767624ec9a31eae61f6fd91b35bc9a9ff853678d19ec8cba8ea566f859
Instruction ID: 36feb037849be0039818e76d26b6edc99833b6202480da276bed716ede8a29c9
Opcode Fuzzy Hash: a1cdfe767624ec9a31eae61f6fd91b35bc9a9ff853678d19ec8cba8ea566f859
Instruction Fuzzy Hash: BF41477164A7628FD7649E7CCC502DAB7E29F4A274F454768ADE4C73E4E7208C498B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB08D9, Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

W, xrefs: 03CB09D2
}, xrefs: 03CB09E4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: W$}
API String ID: 0-1048255054
Opcode ID: ef9ab3cb22899a7905234aa54a118e5f1806d65c5a143f850b726f66b758c360
Instruction ID: 449986ca26c4e1141d9b1abe83d809efc78b61adf0f976d92a562d83ca5394f8
Opcode Fuzzy Hash: ef9ab3cb22899a7905234aa54a118e5f1806d65c5a143f850b726f66b758c360
Instruction Fuzzy Hash: C34122715083A4DFDB64AE74C8617EBBBB1AF0A350F46091EECC6D7250EB304984CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4D6C, Relevance: 1.9, Strings: 1, Instructions: 694COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 2af1024c6f5510724a921b7bec034c7ec9d29df3ef61547d35319dda7d7247e5
Instruction ID: c6016fca768761d90fccc45f7cc47f80a0346cca21ebee44fce66c5c884c747f
Opcode Fuzzy Hash: 2af1024c6f5510724a921b7bec034c7ec9d29df3ef61547d35319dda7d7247e5
Instruction Fuzzy Hash: F452FEB16043899FDB748F39CC857DABBB2FF99310F458229DD89DB250C3749A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4EA2, Relevance: 1.9, Strings: 1, Instructions: 645COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 245b76f2684b767c04f813b461df7ea549b39697b910d91b9f889c63da37eace
Instruction ID: 76e6a73aff5baae3c3e64147e0fcb9cdb03ed500bff69fc3812b8bfd564aa309
Opcode Fuzzy Hash: 245b76f2684b767c04f813b461df7ea549b39697b910d91b9f889c63da37eace
Instruction Fuzzy Hash: 1242FDB16043899FDB748F39CC857DABBB2FF99310F458229DD89DB250C3748A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4FD3, Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 38d4ef02e546bbb18b51e417cfb7d30789bc7290db92475d4cecd2e2b7bdabab
Instruction ID: 2db73006754169658d49979607782e1c519f702371e4ecf8ec5aed2f9016709f
Opcode Fuzzy Hash: 38d4ef02e546bbb18b51e417cfb7d30789bc7290db92475d4cecd2e2b7bdabab
Instruction Fuzzy Hash: 1342FFB16043899FDB748F39CC857DABBB2FF99310F554229DD89CB250C7748A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB511C, Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 13dfa2d6e53a90581123dfb632ca50a69afc72aaaf1a80bb5afa640bf0644f52
Instruction ID: f094ea7aab2cb2179f53155df520649943629ae5c446d3a4160b5aefd57249d6
Opcode Fuzzy Hash: 13dfa2d6e53a90581123dfb632ca50a69afc72aaaf1a80bb5afa640bf0644f52
Instruction Fuzzy Hash: E632EDB16043899FDB748F39CC81BDABBB2FF59310F554229D989CB260C3749A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5290, Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 9ec1981234476500d8f22ef72ca8502b21f8da615ac148451e3e5c50909c65e5
Instruction ID: d1f0e7814eb15b79693c4ddd2f3fbc166831526b5f8913bb57ac1e8d7dcbe0ed
Opcode Fuzzy Hash: 9ec1981234476500d8f22ef72ca8502b21f8da615ac148451e3e5c50909c65e5
Instruction Fuzzy Hash: 8412EEB16043899FDBB48F39CC857DABBB2FF59310F454229DD99CB260C3749A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0FB6, Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

o.[, xrefs: 03CB10C4

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: o.[
API String ID: 0-2674527291
Opcode ID: 09cb6a81770212ee59ee26fcdb0026c30aab7687f02e53daf37b53023962eaad
Instruction ID: ca0cb3bebcd4f4c46d20be8f24c4e8d9868e30f175beaee9efde228e88146c33
Opcode Fuzzy Hash: 09cb6a81770212ee59ee26fcdb0026c30aab7687f02e53daf37b53023962eaad
Instruction Fuzzy Hash: 7EF12471A083898BDB30DF39CC947EE77B2AF5A360F49425ADD8CDB291D3305A418B52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB53FB, Relevance: 1.6, Strings: 1, Instructions: 376COMMON

Download Yara Rule

Strings

jea:, xrefs: 03CB5410

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: jea:
API String ID: 0-2166964964
Opcode ID: 8285c637f13f35f0175d7dd7352bb4b9abbc02da7bb848b6bfe00d80bf483f3b
Instruction ID: eb3d53840441badbbb8274428a24c0315d3ea3d0c76274e2a0ffb7f5b4a86922
Opcode Fuzzy Hash: 8285c637f13f35f0175d7dd7352bb4b9abbc02da7bb848b6bfe00d80bf483f3b
Instruction Fuzzy Hash: 6A02A9B26043889FDBB48F35CC85BEA7BB2FF55310F464129DD89DB220C3759A818B46

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0B63, Relevance: 1.6, Strings: 1, Instructions: 359COMMON

Download Yara Rule

Strings

^~-H, xrefs: 03CB0D92

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ^~-H
API String ID: 2167126740-215249306
Opcode ID: 038ad0f6289f2d679bef541a55e3649ae15c36c3232415393653ea2579e97087
Instruction ID: 322bc25857f0f0b5b1bfc78f940a26b9987f227eee10f2e7f3985048e62b0b63
Opcode Fuzzy Hash: 038ad0f6289f2d679bef541a55e3649ae15c36c3232415393653ea2579e97087
Instruction Fuzzy Hash: 8AA1E875E56A220BD774CE3CCC511CAA3E39B8E274F4843A46A78CB3F5D721CD4A4A52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0B47, Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

^~-H, xrefs: 03CB0D92

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ^~-H
API String ID: 2167126740-215249306
Opcode ID: f7bdc1edde24888cc8e11691bc6e7caf493d00505b0813e7afeca88581b593c1
Instruction ID: 998ef7d00f978cfe3546003a96910ee6f1defe613629fa2547b0c103ab46506f
Opcode Fuzzy Hash: f7bdc1edde24888cc8e11691bc6e7caf493d00505b0813e7afeca88581b593c1
Instruction Fuzzy Hash: 0CA13A75A56A524BD774CE3CCC902CA73F29F8E230F0443659A68CB3E4C7318D4A4B52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4128, Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

z<>", xrefs: 03CB4167

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: z<>"
API String ID: 0-2618481033
Opcode ID: d147c0ed6de2f0c82959a2764ac417614a78fe6beee22eb2f7ea3834b2e3135f
Instruction ID: ca8b55be8620044676467f2eac3e1145279a0e02833b175dfc4d59dc2a910c1e
Opcode Fuzzy Hash: d147c0ed6de2f0c82959a2764ac417614a78fe6beee22eb2f7ea3834b2e3135f
Instruction Fuzzy Hash: 63B10D765083849FEB74DF75C845BEA7BB5BF41360F56815AE88ADF264C3708A80CB12

Uniqueness

Uniqueness Score: -1.00%

Function 03CB1E39, Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

pJKv, xrefs: 03CB7C8E

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: pJKv
API String ID: 2167126740-2644325713
Opcode ID: 3ef1ddffee65b067caaac06fb96291177ce1e3236d1e212085bdbf5c60cc0c3d
Instruction ID: 36081c38588ef70a99ccab1832407d5b5613985e40c3c54b9cd4a750c8f51678
Opcode Fuzzy Hash: 3ef1ddffee65b067caaac06fb96291177ce1e3236d1e212085bdbf5c60cc0c3d
Instruction Fuzzy Hash: 4B812461508BD25BD722CF3C8C546E6BFA26F8B230F49439D88A4CB2D6D7215506C791

Uniqueness

Uniqueness Score: -1.00%

Function 03CB40B1, Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

z<>", xrefs: 03CB4167

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: z<>"
API String ID: 0-2618481033
Opcode ID: 2686114ac3aa4942d36d1a92fbdd558154a54e1f50ddd32b1f8f50e7cdadff63
Instruction ID: b83b72af3940734197be524298599b96573171bc3f2dde77bda65bca2b247f3a
Opcode Fuzzy Hash: 2686114ac3aa4942d36d1a92fbdd558154a54e1f50ddd32b1f8f50e7cdadff63
Instruction Fuzzy Hash: 638163325097418FEB79CF38CC416DA77F2AF46320F5642ADD999CB2A6C7308A45CB12

Uniqueness

Uniqueness Score: -1.00%

Function 03CB947B, Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

I, xrefs: 03CB96EC

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: b20c6d6c53c497f30693afa75acdb895b1546a6cfec5bd8f46db138827936d52
Instruction ID: 7f30bc1ba5430d154f9fa1aabf39a4f2d9b1039b3f53cfd4fa1f4a009bd40f5b
Opcode Fuzzy Hash: b20c6d6c53c497f30693afa75acdb895b1546a6cfec5bd8f46db138827936d52
Instruction Fuzzy Hash: 32612272A067569FDBB4CE39CD513DAB3B1AF48360F4402299E98DB2D4D7309A498B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CBAD9D, Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

<c], xrefs: 03CBAE05

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <c]
API String ID: 0-1371297356
Opcode ID: 50d81842ebcbd5bab642c382cc77b607a03c590a7c35885d16eebfce0f70ddb7
Instruction ID: 4844da4aa2348cc087a3efa07d856d01d26edd6111981c66c2a1f0e79afd49a3
Opcode Fuzzy Hash: 50d81842ebcbd5bab642c382cc77b607a03c590a7c35885d16eebfce0f70ddb7
Instruction Fuzzy Hash: 8161E3766043498FEF34DE69C9643DA37B6EF99310F55852ACC8DCF254C7309A828B91

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9580, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

I, xrefs: 03CB96EC

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 18eaf009e97c40808a1acc8d3263c29be149fe1a7568dedc788876c3d1e15e94
Instruction ID: 374ac839daf5d58895b699b6e6d6d30798c53f3d225b17af51ee6eda0afee5a1
Opcode Fuzzy Hash: 18eaf009e97c40808a1acc8d3263c29be149fe1a7568dedc788876c3d1e15e94
Instruction Fuzzy Hash: B0510772A0A7569FDBB4CF39CD513DA73F1AF49310F4402699A98CB2D4D7309A458B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9690, Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

I, xrefs: 03CB96EC

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 6d35c4fcb95738a5ed7b1dceed77f5775bbd48f849c44273f92be6d8ad54e2a8
Instruction ID: 8d1d7e5a8f0e2c3ef8f79fd7ce8a32b496ce1f9f1e991018fbf3243ecb54f3a4
Opcode Fuzzy Hash: 6d35c4fcb95738a5ed7b1dceed77f5775bbd48f849c44273f92be6d8ad54e2a8
Instruction Fuzzy Hash: 79512572A0A7569FDBB4CF39CC513DA73F1AF49320F4402699A98CB2D4D3309A498B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB97C8, Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

I, xrefs: 03CB96EC

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 3f81b44770896b71df15a1d7473d43e1f314bd2fd7ad985e880e313465728410
Instruction ID: 13d9eb2aae37fe2a24f0fa0c68b5ae88bb70b42d7973ef748e64df207649d616
Opcode Fuzzy Hash: 3f81b44770896b71df15a1d7473d43e1f314bd2fd7ad985e880e313465728410
Instruction Fuzzy Hash: 7F510272A0A7569FDBB4CE39CD513DAB3B1AF48310F4406299A98CB2D4D7309A498B52

Uniqueness

Uniqueness Score: -1.00%

Function 03CBA3EE, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

*i=, xrefs: 03CBA5F2

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *i=
API String ID: 0-4121253992
Opcode ID: 174b610270f6d761281b4e7f1018c5fc32184a387eb30ad9283060644262c853
Instruction ID: 1eb79fd22dbd3e8cb75a977479093b22384eb58cf0b2fbfd8a02925ae9c4c640
Opcode Fuzzy Hash: 174b610270f6d761281b4e7f1018c5fc32184a387eb30ad9283060644262c853
Instruction Fuzzy Hash: 16515E35905B938EDF35DE3C8C413DAB7B39B59220F4882A58CD8CF2D9D33185068B52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4831, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

VSxn, xrefs: 03CB4953

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: VSxn
API String ID: 0-3962871850
Opcode ID: e3e4c2311cb1235c98d1e0f24d1acc2b7f45a7fecd7edc3759719b3388551c04
Instruction ID: 9e07a5a4ffcec52244fbf8accf712f4f548868a6e864adf349a6afaf4e944273
Opcode Fuzzy Hash: e3e4c2311cb1235c98d1e0f24d1acc2b7f45a7fecd7edc3759719b3388551c04
Instruction Fuzzy Hash: 363173311087C58BDF75CEB8C9D47D97B90AF16324F4882ADCC998E29BE7358242C741

Uniqueness

Uniqueness Score: -1.00%

Function 03CB1102, Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4336976d53a6041c023289967cf9d7827296f85915a9d9295e216e97b094a607
Instruction ID: bd264ac615ddc916f92472fa233278e568860cf7ef485f03ca56173ef4584db5
Opcode Fuzzy Hash: 4336976d53a6041c023289967cf9d7827296f85915a9d9295e216e97b094a607
Instruction Fuzzy Hash: 3DE15571A083858BDB74DF39CC943EE77B2AF99360F49421ADC9DCB290D3309A418B12

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5534, Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a60c32140c91d7742af9869fc437beafabcf983574e8f27dbb93fcc08e0669
Instruction ID: 71c548a9c5bef23d01160f00e28216a29349a6e966e5c8b87627fc9ec4cd277a
Opcode Fuzzy Hash: c7a60c32140c91d7742af9869fc437beafabcf983574e8f27dbb93fcc08e0669
Instruction Fuzzy Hash: 5BF100726043899FDBB48F39CC817DA7BB2FF59310F454229DD99CB2A0C7718A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5446, Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b622db0903b19fb05adab5ca7c482f7be3be581c77fdc396a9b5aaa958e2cd7b
Instruction ID: aebfaa16045e109da898d07b000642de0fdd52d3feb6745b58280ffd3685d0ee
Opcode Fuzzy Hash: b622db0903b19fb05adab5ca7c482f7be3be581c77fdc396a9b5aaa958e2cd7b
Instruction Fuzzy Hash: 61F1ACB26443889FDBB48F35CC85BEA7BB2FF55310F464129DD89DB220C3754A858B46

Uniqueness

Uniqueness Score: -1.00%

Function 03CB11D3, Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71f1341c6641c509764181d7848540703d1b8d8ec57f9cb74374c77c7c088e9
Instruction ID: ff6bcac934fb8d0b71bc42a30a229e78083ea8346e2ae474030bfdad946151a3
Opcode Fuzzy Hash: a71f1341c6641c509764181d7848540703d1b8d8ec57f9cb74374c77c7c088e9
Instruction Fuzzy Hash: 9CD13571A093858BDB74DF3DCC547EEB7B2AF59360F59421ADC99CB294D3309A418B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5636, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d7dc5394885fb3ad6bf18116ad077eb27cf9fe38bbdfb0cb01d828ac1c6b34
Instruction ID: ab59e9e142bdf1e9e3c3cb93614a25d82af57769a41d0b6f0a593a37263e5278
Opcode Fuzzy Hash: 98d7dc5394885fb3ad6bf18116ad077eb27cf9fe38bbdfb0cb01d828ac1c6b34
Instruction Fuzzy Hash: 93E1CC716443899FDBB58F39CC85BDA77B2FF59310F854229DD89CB260C7708A868B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB03CC, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb9f2ba9613cc25e69e37f7b936d2ec938ebabd668799eeeadcdfc1f293018c
Instruction ID: 7852db958159629a29da207517fe4a5e45d48d272c05b8dcebe4830497e18a3b
Opcode Fuzzy Hash: afb9f2ba9613cc25e69e37f7b936d2ec938ebabd668799eeeadcdfc1f293018c
Instruction Fuzzy Hash: D581F965E5BF2357E368CE3C8C511C6A3E34BCE130B4443A46A74CB3F9EB21C80A4952

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9DBA, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3350fd7b8b1cbdf0cce97bdfed22949ef18cafaf44ef48888baeb1d8c3992293
Instruction ID: 462f1a7b08a7408897d6d63cd21a47904618d6a1386329ca836fd251beb9bb09
Opcode Fuzzy Hash: 3350fd7b8b1cbdf0cce97bdfed22949ef18cafaf44ef48888baeb1d8c3992293
Instruction Fuzzy Hash: BEC1B1645487828ADB75CF388C987D6BBE25F47220F49C3E9C9E98F2E6D3358506C712

Uniqueness

Uniqueness Score: -1.00%

Function 03CB0376, Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: aac7589d5c4f7f3b611304f158978e6dc1830feb67b27d2bd5204fed7c1e9c60
Instruction ID: e6ab72da4920e451bbe6ca43e0d57403c3387df97a8d730becf8339c861f1f45
Opcode Fuzzy Hash: aac7589d5c4f7f3b611304f158978e6dc1830feb67b27d2bd5204fed7c1e9c60
Instruction Fuzzy Hash: 50916D75E5AB125BE768CE3C8C411D6B3E35FCE130F4543A46EA5DB3E5D720C80A4A52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB12F4, Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51840b34b85669f9f591e61da285cd76192fe005509241ffd6581ae997be2f2f
Instruction ID: faa5ec56afad75a6bdf04305d5e94ee92dfc3bf7d79f19a2513869f66af07de3
Opcode Fuzzy Hash: 51840b34b85669f9f591e61da285cd76192fe005509241ffd6581ae997be2f2f
Instruction Fuzzy Hash: 93B14871A083868BDB74DF3D8C543EEB7B2AF99360F59425EDD98CB294D3304A458B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5718, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807fa86ca78942ef968c7e7b948ddf70668eeed9ce1d7a018621a0cf8aef1168
Instruction ID: 36f8a286e64eb8da2b6d6b21f1580aa3a7a0fe737500125ed51e06eeedbe4106
Opcode Fuzzy Hash: 807fa86ca78942ef968c7e7b948ddf70668eeed9ce1d7a018621a0cf8aef1168
Instruction Fuzzy Hash: 3CD1CAB16447899FDBB58F39CC81BDA77B2FF59310F454229DD59CB2A0C7708A868B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9D29, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70afc87de5f48261f87b840dc1061857c6d2ccc42fd3e74f53992414fd6ef56
Instruction ID: 325c8433bff2497326ea5362b89b1fedcc418848752095b880b0dc7170c4b783
Opcode Fuzzy Hash: e70afc87de5f48261f87b840dc1061857c6d2ccc42fd3e74f53992414fd6ef56
Instruction Fuzzy Hash: BAD1A3745083C58EDB26CF388898BD6BFA16F52320F4982D9C8E98F2E7D3359545C712

Uniqueness

Uniqueness Score: -1.00%

Function 03CB043C, Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b601dace6aaee2afdbc0164cf592406660d7f040096216f9b72a58a519070d
Instruction ID: d013e0152215e80dd35f1bcae410d74c61917f6081f73ee579d6e087627ab4c7
Opcode Fuzzy Hash: e1b601dace6aaee2afdbc0164cf592406660d7f040096216f9b72a58a519070d
Instruction Fuzzy Hash: 8A712965A5AB125BE769CB7C8C411C6B3A39BCE130B0543A46AA4DB3F5D720C90B4A52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9EB8, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5b1ff4952281584ee28ce87912c93b4ac39be0b215fda13bc96dfdb7064d0f
Instruction ID: 1791bb21d32da736c0fe2a33293a3cc05c9bb5485c433304c71682bb63930fdf
Opcode Fuzzy Hash: 4a5b1ff4952281584ee28ce87912c93b4ac39be0b215fda13bc96dfdb7064d0f
Instruction Fuzzy Hash: 9AB1B0245487C28ADB75CF388C987D6BBA25F47220F49C3E9C9E98F2E6D7354606C712

Uniqueness

Uniqueness Score: -1.00%

Function 03CB13F6, Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766fdf1665fec7a5b9766d25a45bf6785c3c2fb83a4fff794b7ba7bbc81f3916
Instruction ID: f60596a625b4dcd6b13db4340c7b8d6fea2828da2e8d5ae883d70b702f886655
Opcode Fuzzy Hash: 766fdf1665fec7a5b9766d25a45bf6785c3c2fb83a4fff794b7ba7bbc81f3916
Instruction Fuzzy Hash: BDA15A719093868BDB35DF3DCC543EEBBB2AF56360F59425EC898CB2A5D3304A458B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB584C, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910e292fb5c2a9151442453801310357224a7369df492e21b75e82ab7e7982fd
Instruction ID: 0e564e6d3ea0b39a098c7400e5821dd88cf87236bd8ca1aa61814dba20097d15
Opcode Fuzzy Hash: 910e292fb5c2a9151442453801310357224a7369df492e21b75e82ab7e7982fd
Instruction Fuzzy Hash: E9B1B7B16446899BDFB48F39CC81BDA77B2BF59310F440229DD5DCB2A0D7318A858B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9FAB, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176c1d9fd21a9a922e61969dca7f1192a225bce8ab0a5f8cfddc7fbfe82bee56
Instruction ID: d560ae934111dfa4520c50924805b70aef805df51f908ad4967f9a447cd91df5
Opcode Fuzzy Hash: 176c1d9fd21a9a922e61969dca7f1192a225bce8ab0a5f8cfddc7fbfe82bee56
Instruction Fuzzy Hash: 2281F6745487868ACF35CF388CA47E77BA29F46220F4882A9CDE9CF2D6D7354606C712

Uniqueness

Uniqueness Score: -1.00%

Function 03CB596E, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5074cf715264bdace31500d30685f802dabc1a3bcd1ff74fd688cd60484a207f
Instruction ID: 2bcad2ef3c5e616ee8ae1568c97e138c948e67820a34dd4c66478aebdbff1040
Opcode Fuzzy Hash: 5074cf715264bdace31500d30685f802dabc1a3bcd1ff74fd688cd60484a207f
Instruction Fuzzy Hash: 4591D9B16447899FDB758F39CC85BDA77B2BF5A320F444228DD6DCB2A0D7308A858B41

Uniqueness

Uniqueness Score: -1.00%

Function 03CBADAB, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e530e4e4d73df710ee3e2b60977b5b62a36a5bd3474777136ecf6c32d374c740
Instruction ID: 1991e86ddc59eaf8dba9175f9b006e2010bddde2328df6a3d51e55ac66a3b9ad
Opcode Fuzzy Hash: e530e4e4d73df710ee3e2b60977b5b62a36a5bd3474777136ecf6c32d374c740
Instruction Fuzzy Hash: 9F8104766457458FEB74CE39CC503DA33A2AF8A320F598266CC59CF2E4C7309A468B41

Uniqueness

Uniqueness Score: -1.00%

Function 03CBAE1E, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebc7b26ec2cb710b4840b49ce9e78fda4248672fdf497ab92e893edf8f2cf42
Instruction ID: 6ee36fcef24bd7ded3d115ae377216f62a51a29b3eace0bbecd6bfb23a0476f0
Opcode Fuzzy Hash: 5ebc7b26ec2cb710b4840b49ce9e78fda4248672fdf497ab92e893edf8f2cf42
Instruction Fuzzy Hash: 367103766456468FEB74CE39CC503CA73B3AF8A320F598266CD58CB2E4C730DA468A41

Uniqueness

Uniqueness Score: -1.00%

Function 03CB1508, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eae22693ea6e5e370fdf83b8a9586948b4baf5c69b7f1c7a53684042a25b501
Instruction ID: 0e76bdaca5694943b01622a8432ab942b65718bb7bb86bb113581b0646278ce3
Opcode Fuzzy Hash: 4eae22693ea6e5e370fdf83b8a9586948b4baf5c69b7f1c7a53684042a25b501
Instruction Fuzzy Hash: 4E8166319097868BDB35DF3DCC443EEBBB2AF56360F59425AC898CB2E4D33046858B02

Uniqueness

Uniqueness Score: -1.00%

Function 03CBAE7E, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527ebad38daa300bce0c06d19394954bbff512da7af20a75c02c1dd6836b3eca
Instruction ID: 881b71b7a83ee57cf6bdd520f15879c2b090fd8cc325d65cfac63c3304060450
Opcode Fuzzy Hash: 527ebad38daa300bce0c06d19394954bbff512da7af20a75c02c1dd6836b3eca
Instruction Fuzzy Hash: EE71F4766456468FEB34CE398C503DA77B3AF8A320F598266C958CF2E4D730DA468B41

Uniqueness

Uniqueness Score: -1.00%

Function 03CB3032, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c1a34e41b4aa3dd22716e9b1ea67395ac2db95189da33579d665a0b635550c
Instruction ID: 177938241ee9be65e16bcf8cf4aab4f38249f5cde69673ff77d3bc33d22c9734
Opcode Fuzzy Hash: 08c1a34e41b4aa3dd22716e9b1ea67395ac2db95189da33579d665a0b635550c
Instruction Fuzzy Hash: DF712472A452999FDB74CF38CC447EE77E2AF99360F554269AC88CB290D7308E458B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB2FAB, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7aef32afc95c406fd665e90b687eb0807712c943d1508fd213c84e09a19d86
Instruction ID: da922a87789bc33e306ae9a2ecaa68aed4d8d444d929e5def44388252eb43907
Opcode Fuzzy Hash: 3d7aef32afc95c406fd665e90b687eb0807712c943d1508fd213c84e09a19d86
Instruction Fuzzy Hash: 2E81F176A452899FDB74CF28CD487EF77B2AF98350F55452EAC89DB200D3709E418B42

Uniqueness

Uniqueness Score: -1.00%

Function 03CBAF28, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9299b6fe31043a5ec7e29f5bdfe9f447052ccb2e72de31325d26a6b3d602dfd6
Instruction ID: 2b24ca0d1cf0d9b3720452c0186ef55c9de283327ca7cfa157b8b90cedfe35d9
Opcode Fuzzy Hash: 9299b6fe31043a5ec7e29f5bdfe9f447052ccb2e72de31325d26a6b3d602dfd6
Instruction Fuzzy Hash: 6E61D4716457058FEB34DE38CD503DA37B3AF8A320F598666C958CB2E4D730DA468B82

Uniqueness

Uniqueness Score: -1.00%

Function 03CBA09F, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4754700cedf0992b9ef50ae168119f3fa70d1073377f4e597b07925ceba06169
Instruction ID: 84b630fefc2aca1dd76f21bec84b82fc6008cd1fb6d8a43f981826012a0ee5e5
Opcode Fuzzy Hash: 4754700cedf0992b9ef50ae168119f3fa70d1073377f4e597b07925ceba06169
Instruction Fuzzy Hash: 96610774A447928ADF75CF3C8C953D77BE35F8A220F4883A989A9CF2D9D73145068722

Uniqueness

Uniqueness Score: -1.00%

Function 03CB23A7, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d45cb6a8f0bd63e340b015896b82c44d75a0b4163cff2fe0d938bba1ccb6c33
Instruction ID: bbd727038943f418c8ff5b06027fe0ee71ba589297a3cec731114c8526e1ad94
Opcode Fuzzy Hash: 2d45cb6a8f0bd63e340b015896b82c44d75a0b4163cff2fe0d938bba1ccb6c33
Instruction Fuzzy Hash: 0E51EFB2A056599BDB74CF3DCC446CE77A3AF8A320F158229AD58DB3E4D7344A068B41

Uniqueness

Uniqueness Score: -1.00%

Function 03CB5AAE, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7aa9af0a302fcc3a526f0638a273813fa63cd7d7b22530d8f43bf6bdaff45c7
Instruction ID: f86f5e67838d21588d2a20d83709d9ecf916d8c01006e9b3c3b69dc8ad5b12e3
Opcode Fuzzy Hash: e7aa9af0a302fcc3a526f0638a273813fa63cd7d7b22530d8f43bf6bdaff45c7
Instruction Fuzzy Hash: D071D071641A8A9FDF75CF38CC85BDA77B2AF49310F444228DD6CCB2A1D7314A498B41

Uniqueness

Uniqueness Score: -1.00%

Function 03CB41D3, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed918c9b8c0c1a8a8825bc96fe427f63d64b88143319e2c07364750d90f501cc
Instruction ID: 20c27b6d46822abb1bda7dc9285fa784b05ba2d9c8248a0fee6a5241503ab41a
Opcode Fuzzy Hash: ed918c9b8c0c1a8a8825bc96fe427f63d64b88143319e2c07364750d90f501cc
Instruction Fuzzy Hash: 385178325097429FDB78DF39CC012DA77F2AF89320F56425D99A5DB2E4C7308A498B12

Uniqueness

Uniqueness Score: -1.00%

Function 03CB3163, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123572753361362c26ee8d293aff4547220411a2d7f5dac00aa60e328f6c98f6
Instruction ID: 8230942acbcf932b7286bf8af5aae90085982b1b324885fccba3324683b91e49
Opcode Fuzzy Hash: 123572753361362c26ee8d293aff4547220411a2d7f5dac00aa60e328f6c98f6
Instruction Fuzzy Hash: C351E27264268A5BDB74CF3DCC447DE77E2AF9D260F544369A958CB2E0D730CA068A42

Uniqueness

Uniqueness Score: -1.00%

Function 03CB2379, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0977edd377c97f66843490ebfccbf4a36af7ffa26acb5e6abf51fe05dc29e90
Instruction ID: d3944c81c037724bfcc3088081313db6ce674f9ab1b414f4160293cc834f9db9
Opcode Fuzzy Hash: b0977edd377c97f66843490ebfccbf4a36af7ffa26acb5e6abf51fe05dc29e90
Instruction Fuzzy Hash: AF51FFB2A042889FDB34CF29CD84BDE77B6BF89350F05812AEC49EB254C7345E428B10

Uniqueness

Uniqueness Score: -1.00%

Function 03CB1667, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f364084b39e665d996a1faaaa85124f713df985407654ee34b096b3ee8015f
Instruction ID: 4fc69fe68884199a1c83e0ef25b9d5e91a5d361e36c37f8d35d2ba56ebe6e4a3
Opcode Fuzzy Hash: d9f364084b39e665d996a1faaaa85124f713df985407654ee34b096b3ee8015f
Instruction Fuzzy Hash: 97515771A097869BD771CF3DCC543DABBF2AF96320F49439A8C98CB2E5D33156458A02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB4627, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f94ca5f6e990744d37b4a913d3d9c5cc44a5c7badb739295cd5b764430dffe2
Instruction ID: 4bd26f85c371b4fc8cb705d3371a58c18beced264aa997e361a741f83a222257
Opcode Fuzzy Hash: 4f94ca5f6e990744d37b4a913d3d9c5cc44a5c7badb739295cd5b764430dffe2
Instruction Fuzzy Hash: 2351FE716043019FDB68DF69C895BEABBB0BF15320F51816AD88ACB221DB74DD81CF52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB49B7, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475a74eb5be3a5d2c7a231b8ebd085870443386ef2db78cdc0174dc333ddda33
Instruction ID: ed85b5ae41ccd7648f2da15d681176efb3a081cce6ebe426fa2ddd280e18d7d1
Opcode Fuzzy Hash: 475a74eb5be3a5d2c7a231b8ebd085870443386ef2db78cdc0174dc333ddda33
Instruction Fuzzy Hash: D551C471A05B499BD774CE3BCDC03CAB3F3ABCDA10F5486248A58DF295D335AA458B50

Uniqueness

Uniqueness Score: -1.00%

Function 03CBA1A8, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5670a0a2939ed7eda33c7315a1fa5ca62e3d298fce4e3a14298758136572255
Instruction ID: 9b7b4736ac662dd43abd24670d49abd46a6c1bfecaef312d7a403ffe4a89eefc
Opcode Fuzzy Hash: c5670a0a2939ed7eda33c7315a1fa5ca62e3d298fce4e3a14298758136572255
Instruction Fuzzy Hash: 08514974A557428ADF74CF3C8C553D777A39F8A220F4883A98DA9CF2D8D73185068722

Uniqueness

Uniqueness Score: -1.00%

Function 03CB499D, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251a17ecc072fd6e31f5e6d32b57c969e3f2ef74eb3ce1638eba3f5bb675d992
Instruction ID: f4532ecbe8d8c457e2cf7b6029b7f11855c022b7475be4d39344d71d358741aa
Opcode Fuzzy Hash: 251a17ecc072fd6e31f5e6d32b57c969e3f2ef74eb3ce1638eba3f5bb675d992
Instruction Fuzzy Hash: C751C1726087888FD774CE2BCAD47DAB7F3AF89A00F548119894DDF205D234AB418B90

Uniqueness

Uniqueness Score: -1.00%

Function 03CB6380, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e0f0fb5200a3db25762bc8d31c63cf0d6582a7d1cc3387c56791803c9ab241
Instruction ID: f8cb4e3f8336512a4c091be89778fd8f7f1cb808bada59f1c7a8ddb21d37d5ff
Opcode Fuzzy Hash: 20e0f0fb5200a3db25762bc8d31c63cf0d6582a7d1cc3387c56791803c9ab241
Instruction Fuzzy Hash: CD41FF72A043A98FDB74DE748C55BEB3AB9AF54750F06801AEC89EB210C7305A418B92

Uniqueness

Uniqueness Score: -1.00%

Function 03CB2DA1, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2cec8ce8a7217702f8ff9efd8404bb6e09bf52c4ae9eb191a129a5e650038fe2
Instruction ID: 9052718f6facfe1273533fe58c4bca3d0b468e914dded1af36b99826e496be43
Opcode Fuzzy Hash: 2cec8ce8a7217702f8ff9efd8404bb6e09bf52c4ae9eb191a129a5e650038fe2
Instruction Fuzzy Hash: E5412076A103988FEB70CE69CD947EB37A6BF99350F968029DC88DF210C7319E458B01

Uniqueness

Uniqueness Score: -1.00%

Function 03CB8ABF, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a10b8c6a25e745812a688224104f06ad8d5ba3b95c7e3f025a239bdb21c264
Instruction ID: e250404df59dff9fa00e97861ced028850344bc802e099eec1795b6b563d9c1f
Opcode Fuzzy Hash: c6a10b8c6a25e745812a688224104f06ad8d5ba3b95c7e3f025a239bdb21c264
Instruction Fuzzy Hash: 7E4115B66053998FEF31DE388C907EB3AF9AF55350F59406ADC89CF200C3308A418B52

Uniqueness

Uniqueness Score: -1.00%

Function 03CB2B1F, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b14d297a6c41cd74e8164897dfd110d9bf71288e4f45e272f48380f4279902fa
Instruction ID: 5e620dc7ef2003577c63d8776bf6d45f1c7926b4c15bf8013f6175da9cff6d22
Opcode Fuzzy Hash: b14d297a6c41cd74e8164897dfd110d9bf71288e4f45e272f48380f4279902fa
Instruction Fuzzy Hash: 1A41C0B6A043899BDB349F69CC98BEE77A6FF98300F8500199C89DB250D7348A81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9AD4, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48315c72a3812d3d71b962e32328151566f0583e9c1b52944b41ef8e460070d
Instruction ID: ab5b0f8eb9522bdda979f9335c85a3707d6de44eafe99793e12552058828b978
Opcode Fuzzy Hash: f48315c72a3812d3d71b962e32328151566f0583e9c1b52944b41ef8e460070d
Instruction Fuzzy Hash: 64310831A5AA024FD76C4F3CCC511DAB3E39FDA270F4547AD5AA5C72F4DB21854A4A02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB8CA1, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337303ed29ff82997a7da28b0c34aa2fec95268bea0b92c8c997bf2320fc2276
Instruction ID: 9f278e4318f211bdf7290abe1dd9dd204ff1bcdc19dc5c51c635c44a26a625eb
Opcode Fuzzy Hash: 337303ed29ff82997a7da28b0c34aa2fec95268bea0b92c8c997bf2320fc2276
Instruction Fuzzy Hash: 4F2105362043868FDB31CF69C9C47D673B2AFAA740F558269DE89CF246E3348946CB01

Uniqueness

Uniqueness Score: -1.00%

Function 03CB9ABD, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627ee0272fa1570b9bc749b68421f0f5156c68f562d193214ebdc9307c3490d0
Instruction ID: 4587d3a30c894448daf54182a0fb380c0c98fb8a55e0455ce78ccb3f3288e447
Opcode Fuzzy Hash: 627ee0272fa1570b9bc749b68421f0f5156c68f562d193214ebdc9307c3490d0
Instruction Fuzzy Hash: A011BF710083408FCB6C6E35D6663FEB6E2EF91354F52056EDCCBDA6A4CB354681CA02

Uniqueness

Uniqueness Score: -1.00%

Function 03CB8DE9, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773f7c7c1e6c6544b4cfb5c69077cbc17ae65181b77ab619ff0e60638bf4344c
Instruction ID: 8f3dd5b45b9b529768d550ed5a1df9a9e56cfbcd20d53a49c75be8ca49882f35
Opcode Fuzzy Hash: 773f7c7c1e6c6544b4cfb5c69077cbc17ae65181b77ab619ff0e60638bf4344c
Instruction Fuzzy Hash: A701C479A157E8CFCF64CF69C988AD973B8BF58211F0644AAD909CF211C230AE40DB65

Uniqueness

Uniqueness Score: -1.00%

Function 03CB61AD, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 03CB87BC, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1158179562.0000000003CB0000.00000040.00000001.sdmp, Offset: 03CB0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754f1281158072209f64df265c40f281e1bb41fb4d7ab610526a7228df4a9058
Instruction ID: d6708d2eab667c2082d5d26882077adb99b2cd2419255854e4109b64cf07c1da
Opcode Fuzzy Hash: 754f1281158072209f64df265c40f281e1bb41fb4d7ab610526a7228df4a9058
Instruction Fuzzy Hash: 5DB002356515408FCA56CA59C194F4173A5BB54650F825494E4118BA51C264E940CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00420160, Relevance: 101.9, APIs: 56, Strings: 2, Instructions: 417COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004201C1
__vbaStrCat.MSVBVM60(0040421C,00404214), ref: 004201D1
__vbaStrMove.MSVBVM60 ref: 004201E2
__vbaI4Str.MSVBVM60(00000000), ref: 004201E5
#537.MSVBVM60(00000000), ref: 004201EC
__vbaStrMove.MSVBVM60 ref: 004201F7
__vbaStrCmp.MSVBVM60(00402D00,00000000), ref: 004201FF
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00420219
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0042023D
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00420268
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000108), ref: 00420296
__vbaFreeObj.MSVBVM60 ref: 0042029B
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 004202B3
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 004202D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000130), ref: 004202FE
__vbaStrMove.MSVBVM60 ref: 00420309
__vbaFreeObj.MSVBVM60 ref: 00420312
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 0042032A
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 0042034F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000118), ref: 00420375
__vbaFreeObj.MSVBVM60 ref: 0042037A
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00420392
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,0000001C), ref: 004203B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402D04,00000064), ref: 004203D9
__vbaFreeObj.MSVBVM60 ref: 004203DE
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 004203FE
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 00420423
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,00000070), ref: 00420443
__vbaFreeObj.MSVBVM60 ref: 00420448
__vbaStrCat.MSVBVM60(0040422C,00404224), ref: 00420458
__vbaStrMove.MSVBVM60 ref: 00420469
#514.MSVBVM60(?,00000002), ref: 00420471
__vbaStrMove.MSVBVM60 ref: 0042047C
__vbaStrCmp.MSVBVM60(00402AA0,00000000), ref: 00420484
__vbaFreeStr.MSVBVM60 ref: 00420497
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 004204B8
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000014), ref: 004204DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B10,0000013C), ref: 00420524
__vbaFreeObj.MSVBVM60 ref: 0042052D
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 0042053D
__vbaStrVarMove.MSVBVM60(?), ref: 00420547
__vbaStrMove.MSVBVM60 ref: 00420558
__vbaFreeVar.MSVBVM60 ref: 0042055D
#706.MSVBVM60(00000001,00000000,00000000), ref: 00420569
__vbaStrMove.MSVBVM60 ref: 00420574
__vbaNew2.MSVBVM60(00402B00,00421390), ref: 00420589
__vbaHresultCheckObj.MSVBVM60(00000000,0075ED94,00402AF0,00000038,?,?,?,?,?,?,?,?), ref: 004205F3
__vbaVar2Vec.MSVBVM60(?,?,?,?,?,?,?,?,?,?), ref: 00420601
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?), ref: 0042060F
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?), ref: 00420618
__vbaFreeStr.MSVBVM60(00420683), ref: 00420660
__vbaFreeStr.MSVBVM60 ref: 00420665
__vbaFreeStr.MSVBVM60 ref: 0042066A
__vbaFreeStr.MSVBVM60 ref: 0042066F
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00420677
__vbaFreeStr.MSVBVM60 ref: 00420680

Strings

Lovndringen3, xrefs: 004205AD
UNANTAGONISINGS, xrefs: 00420501

Memory Dump Source

Source File: 00000001.00000002.1156925364.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1156918296.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1156965951.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1156975780.0000000000423000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$#514#537#539#706CopyDestructListVar2
String ID: Lovndringen3$UNANTAGONISINGS
API String ID: 3105435306-1607536084
Opcode ID: af743b27250c210e0bdd2a75b120bac0a95b812e9cba47d8561142abc3a4bacc
Instruction ID: d3e51d728860a3a77be26d831dd4045668f10970b85b4c5feb9aa17730c94075
Opcode Fuzzy Hash: af743b27250c210e0bdd2a75b120bac0a95b812e9cba47d8561142abc3a4bacc
Instruction Fuzzy Hash: B6E19271E40214ABCB14DFA4DD89E9DBBB8FF58300F60442AF905F72A1DBB4A945CB58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report http___2.56.59.76_alig.jpg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: http___2.56.59.76_alig.exe PID: 7152 Parent PID: 5900

General

Chronological Activities

Disassembly