Play interactive tour

Edit tour

Windows Analysis Report Fec9qUX4at.exe

Overview

General Information

Sample Name:	Fec9qUX4at.exe
Analysis ID:	458355
MD5:	2046b941817392e3815535fccb1f39dc
SHA1:	843d243a71131baf9fbe0fcf4ba129f51ee74c8f
SHA256:	c0d3da1cefd1a979c8b8ce102fd5d3ff090779f72f4d1098eb383cbbb3480bee
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Fec9qUX4at.exe (PID: 6536 cmdline: 'C:\Users\user\Desktop\Fec9qUX4at.exe' MD5: 2046B941817392E3815535FCCB1F39DC)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://101.99.94.119/WEALTH_fkWglQyCXO188.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "http://101.99.94.119/WEALTH_fkWglQyCXO188.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: Fec9qUX4at.exe	Virustotal: Detection: 28%			Perma Link
Source: Fec9qUX4at.exe	ReversingLabs: Detection: 13%

Machine Learning detection for sample

Show sources

Source: Fec9qUX4at.exe

Joe Sandbox ML: detected

Source: Fec9qUX4at.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://101.99.94.119/WEALTH_fkWglQyCXO188.bin

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B25867 NtAllocateVirtualMemory,	0_2_02B25867
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2586A NtAllocateVirtualMemory,	0_2_02B2586A
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B258D5 NtAllocateVirtualMemory,	0_2_02B258D5
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2586A NtAllocateVirtualMemory,	0_2_02B2586A

Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_00401144	0_2_00401144
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B25867	0_2_02B25867
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2586A	0_2_02B2586A
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B238B9	0_2_02B238B9
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B27AA5	0_2_02B27AA5
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B22AAE	0_2_02B22AAE
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B27EAD	0_2_02B27EAD
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B24292	0_2_02B24292
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B24693	0_2_02B24693
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28C9D	0_2_02B28C9D
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B242D5	0_2_02B242D5
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B206D9	0_2_02B206D9
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B23424	0_2_02B23424
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B25E11	0_2_02B25E11
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B24C15	0_2_02B24C15
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2380C	0_2_02B2380C
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B25661	0_2_02B25661
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2586A	0_2_02B2586A
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B23051	0_2_02B23051
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B25C5C	0_2_02B25C5C
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B24A41	0_2_02B24A41
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2864F	0_2_02B2864F
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B23996	0_2_02B23996
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28181	0_2_02B28181
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B21D86	0_2_02B21D86
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B21D8F	0_2_02B21D8F
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B285F7	0_2_02B285F7
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B213FC	0_2_02B213FC
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B205E0	0_2_02B205E0
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B23FDB	0_2_02B23FDB
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B209C7	0_2_02B209C7
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B277CC	0_2_02B277CC
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2293E	0_2_02B2293E
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28500	0_2_02B28500
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B29577	0_2_02B29577
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B22D7C	0_2_02B22D7C
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B27F61	0_2_02B27F61
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28355	0_2_02B28355
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2475A	0_2_02B2475A
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B22559	0_2_02B22559
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28759	0_2_02B28759

Source: Fec9qUX4at.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Fec9qUX4at.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Fec9qUX4at.exe, 00000000.00000000.650669230.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCLUBWOMAN.exe vs Fec9qUX4at.exe
Source: Fec9qUX4at.exe, 00000000.00000002.1173603407.0000000002090000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Fec9qUX4at.exe
Source: Fec9qUX4at.exe	Binary or memory string: OriginalFilenameCLUBWOMAN.exe vs Fec9qUX4at.exe

Source: Fec9qUX4at.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal88.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCB9C324FCAA7B61E.TMP

Jump to behavior

Source: Fec9qUX4at.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fec9qUX4at.exe	Virustotal: Detection: 28%
Source: Fec9qUX4at.exe	ReversingLabs: Detection: 13%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Code function: 0_2_00407CF7 push eax; ret

0_2_00407CF8

Source: initial sample

Static PE information: section name: .text entropy: 7.05513425915

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B24693	0_2_02B24693
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B242D5	0_2_02B242D5
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B205E0	0_2_02B205E0

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

RDTSC instruction interceptor: First address: 0000000002B27394 second address: 0000000002B27394 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov byte ptr [ebx], al 0x0000000c pushad 0x0000000d mov ah, 58h 0x0000000f cmp ah, 00000058h 0x00000012 jne 00007F5630B1DC8Ch 0x00000018 popad 0x00000019 inc ebx 0x0000001a inc edx 0x0000001b dec ecx 0x0000001c test ecx, ecx 0x0000001e jne 00007F5630B20D7Fh 0x00000020 mov al, byte ptr [edx] 0x00000022 pushad 0x00000023 rdtsc

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Fec9qUX4at.exe	RDTSC instruction interceptor: First address: 0000000002B27394 second address: 0000000002B27394 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov byte ptr [ebx], al 0x0000000c pushad 0x0000000d mov ah, 58h 0x0000000f cmp ah, 00000058h 0x00000012 jne 00007F5630B1DC8Ch 0x00000018 popad 0x00000019 inc ebx 0x0000001a inc edx 0x0000001b dec ecx 0x0000001c test ecx, ecx 0x0000001e jne 00007F5630B20D7Fh 0x00000020 mov al, byte ptr [edx] 0x00000022 pushad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	RDTSC instruction interceptor: First address: 0000000002B27DB5 second address: 0000000002B27DB5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, A7105D73h 0x00000007 xor eax, 87E90EABh 0x0000000c xor eax, 91654CB2h 0x00000011 xor eax, B19C1F6Bh 0x00000016 cpuid 0x00000018 test ecx, eax 0x0000001a popad 0x0000001b call 00007F563036823Bh 0x00000020 lfence 0x00000023 mov edx, 2543AA54h 0x00000028 xor edx, 8D843AA0h 0x0000002e xor edx, CC85E3A5h 0x00000034 xor edx, 1BBC7345h 0x0000003a mov edx, dword ptr [edx] 0x0000003c lfence 0x0000003f test bx, bx 0x00000042 cmp ch, dh 0x00000044 ret 0x00000045 sub edx, esi 0x00000047 ret 0x00000048 add edi, edx 0x0000004a dec dword ptr [ebp+000000F8h] 0x00000050 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000057 jne 00007F563036821Ch 0x00000059 call 00007F563036827Ch 0x0000005e call 00007F563036825Eh 0x00000063 lfence 0x00000066 mov edx, 2543AA54h 0x0000006b xor edx, 8D843AA0h 0x00000071 xor edx, CC85E3A5h 0x00000077 xor edx, 1BBC7345h 0x0000007d mov edx, dword ptr [edx] 0x0000007f lfence 0x00000082 test bx, bx 0x00000085 cmp ch, dh 0x00000087 ret 0x00000088 mov esi, edx 0x0000008a pushad 0x0000008b rdtsc

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Code function: 0_2_02B238B9 rdtsc

0_2_02B238B9

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Fec9qUX4at.exe

Code function: 0_2_02B238B9 rdtsc

0_2_02B238B9

Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2380C mov eax, dword ptr fs:[00000030h]	0_2_02B2380C
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2546D mov eax, dword ptr fs:[00000030h]	0_2_02B2546D
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B2864F mov eax, dword ptr fs:[00000030h]	0_2_02B2864F
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B273B7 mov eax, dword ptr fs:[00000030h]	0_2_02B273B7
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B285F7 mov eax, dword ptr fs:[00000030h]	0_2_02B285F7
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B279C6 mov eax, dword ptr fs:[00000030h]	0_2_02B279C6
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28500 mov eax, dword ptr fs:[00000030h]	0_2_02B28500
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B22D7C mov eax, dword ptr fs:[00000030h]	0_2_02B22D7C
Source: C:\Users\user\Desktop\Fec9qUX4at.exe	Code function: 0_2_02B28355 mov eax, dword ptr fs:[00000030h]	0_2_02B28355

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Fec9qUX4at.exe, 00000000.00000002.1173482148.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Fec9qUX4at.exe, 00000000.00000002.1173482148.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Fec9qUX4at.exe, 00000000.00000002.1173482148.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Fec9qUX4at.exe, 00000000.00000002.1173482148.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fec9qUX4at.exe	29%	Virustotal		Browse
Fec9qUX4at.exe	13%	ReversingLabs	Win32.Trojan.Vebzenpak
Fec9qUX4at.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://101.99.94.119/WEALTH_fkWglQyCXO188.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://101.99.94.119/WEALTH_fkWglQyCXO188.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458355
Start date:	03.08.2021
Start time:	09:40:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Fec9qUX4at.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 26% (good quality ratio 9.9%) Quality average: 22.4% Quality standard deviation: 33.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.638949072783339
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fec9qUX4at.exe
File size:	114688
MD5:	2046b941817392e3815535fccb1f39dc
SHA1:	843d243a71131baf9fbe0fcf4ba129f51ee74c8f
SHA256:	c0d3da1cefd1a979c8b8ce102fd5d3ff090779f72f4d1098eb383cbbb3480bee
SHA512:	ecf0b711c41619dcf9073f1cd4c769cc106b04aaec40881fc11cbf8686989da512a9c2ee2683a90b99dddb1f4a762cf4df512663519bc9035bbc6d0fd90f9571
SSDEEP:	1536:BUS3/zw2m3c39SYeXvmgU2sIMflWub4cL51tY4SQmiPYElZ943ckw2mUS3/:BT/zM3c3bcBsIMfQuDaSZS3ckYT/
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....(.U.................@..........D........P....@................

File Icon


Icon Hash:	d5d5959595959595

Static PE Info

General
Entrypoint:	0x401144
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x558D28E4 [Fri Jun 26 10:26:44 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5565993a5a9f2bfb76f28ab304be6bc1

Entrypoint Preview

Instruction
push 00406B44h
call 00007F5630B090F5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ch, dh
pop ss
clc
pop edx
push B944FDC7h
mov ebx, 52105E67h
cmp edx, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc edx
add byte ptr [esi], al
push eax
add dword ptr [ecx], 53h
inc ebp
inc ebx
inc ebp
push ebx
push ebx
dec ecx
dec edi
dec esi
inc ecx
dec esp
dec ecx
push ebx
push esp
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
pop es
jo 00007F5630B09134h
inc edx
sub cl, ah
imul eax, dword ptr [eax+41h], 81h
or bl, byte ptr [ebx-03CA9598h]
mov esi, 05B7FAFFh
or dl, byte ptr [ebp-48h]
inc esi
mov cl, 74h
and dword ptr [ecx], ecx
jbe 00007F5630B0908Ah
jnle 00007F5630B09111h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push esp
pop ecx
add byte ptr [eax], al
sub al, 58h
add byte ptr [eax], al
add byte ptr [ecx], dl
add byte ptr [ebx+4Bh], dl
push edx
dec ebp
dec ecx
dec esi
inc esp
inc esp
inc ebp
dec esp
dec ecx
dec esi
inc edi
inc ebp
push edx
dec esi
inc ebp
add byte ptr [00000001h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14b64	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x5b92	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x7c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13de4	0x14000	False	0.648803710938	data	7.05513425915	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0x115c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x5b92	0x6000	False	0.545776367188	data	6.0293757353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1bcea	0xea8	data
RT_ICON	0x1b442	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 532795385, next used block 536862194
RT_ICON	0x1aeda	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x18932	0x25a8	data
RT_ICON	0x1788a	0x10a8	data
RT_ICON	0x17422	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x173c8	0x5a	data
RT_VERSION	0x171e0	0x1e8	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, _allmul, _CItan, _CIexp

Version Infos

Description	Data
Translation	0x0404 0x04b0
ProductVersion	1.00
InternalName	CLUBWOMAN
FileVersion	1.00
OriginalFilename	CLUBWOMAN.exe
ProductName	REFOUNDING

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Fec9qUX4at.exe PID: 6536 Parent PID: 5808

General

Start time:	09:40:59
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Fec9qUX4at.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Fec9qUX4at.exe'
Imagebase:	0x400000
File size:	114688 bytes
MD5 hash:	2046B941817392E3815535FCCB1F39DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Fec9qUX4at.exe PID: 6536 Parent PID: 5808 Fec9qUX4at.exeCOMMON

Executed Functions

Function 02B25867, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 372memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(46C45625,0000013C,-18D0B40B,0000013C), ref: 02B25ACC

Strings

z, xrefs: 02B25BE9
_o7, xrefs: 02B206BB

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: z$_o7
API String ID: 2167126740-3303363713
Opcode ID: 9f67f88318d16692c71471b378a258de2e78bedb408ece18ea05bb53a4a48190
Instruction ID: f5acbf1aee07507c47664874c078b4e8319c9bbbdf3490df96b492328b7ab9ff
Opcode Fuzzy Hash: 9f67f88318d16692c71471b378a258de2e78bedb408ece18ea05bb53a4a48190
Instruction Fuzzy Hash: 37D136B2A403998FDB309F38CC947DE7BA6AF99300F55455ADC88AB254E7308A49CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00401144, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401149

Strings

VB5!6&*, xrefs: 00401144

Memory Dump Source

Source File: 00000000.00000002.1173218367.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1173207634.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1173231941.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1173238846.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 4364e3a55836ec16bba9f0515c66cc419118134ac052a344b99a89ba62e43f8c
Instruction ID: b6900d38e8993300d692d9b191046ab008b8127973ee6a80ff405c4235bb8dc0
Opcode Fuzzy Hash: 4364e3a55836ec16bba9f0515c66cc419118134ac052a344b99a89ba62e43f8c
Instruction Fuzzy Hash: 64F1E22604E3D14FDF175634A8921E6BF70EE5333471A61EBC581AF5B3C2380986C76A

Uniqueness

Uniqueness Score: -1.00%

Function 02B258D5, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 211memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(46C45625,0000013C,-18D0B40B,0000013C), ref: 02B25ACC

Strings

z, xrefs: 02B25BE9

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: z
API String ID: 2167126740-1657960367
Opcode ID: 09acada83d19d335776ce7c0d01b451ee9d59c12068e91fc5e7019b2d4cb24a7
Instruction ID: 34d60f0cd54fd1aa48a45418c829d35bf3340390d1dc6a7743ee24e33a45ebe3
Opcode Fuzzy Hash: 09acada83d19d335776ce7c0d01b451ee9d59c12068e91fc5e7019b2d4cb24a7
Instruction Fuzzy Hash: 577127725487DA5FE7308F748D653CABF929F07335F481248DEAD2B2A1E7709A148B80

Uniqueness

Uniqueness Score: -1.00%

Function 02B2586A, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(46C45625,0000013C,-18D0B40B,0000013C), ref: 02B25ACC

Strings

z, xrefs: 02B25BE9

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: z
API String ID: 2167126740-1657960367
Opcode ID: c9f9e806a5d25ff32c9e5e0fc248d867028b6aea02a46253ee35db9628748386
Instruction ID: 8308554f7fc861e4549c5bfb8a7a806587482c6dcd8b8daa3dc5d3c953932bc1
Opcode Fuzzy Hash: c9f9e806a5d25ff32c9e5e0fc248d867028b6aea02a46253ee35db9628748386
Instruction Fuzzy Hash: EB5116B29407A99FDB348F28CC947CB7BA6EF8A710F45415ADC4CAB314D7708A49CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B205E0, Relevance: 7.1, Strings: 5, Instructions: 804COMMON

Download Yara Rule

Strings

oi~, xrefs: 02B248A6
H}e>, xrefs: 02B24EBE
_o7, xrefs: 02B206BB
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$_o7$oi~$pB
API String ID: 0-3019485797
Opcode ID: 4d5f9101b7c68e2ea673beb43ccf43c51b92bbd1e4e1e8018fc2f61f67cacb9b
Instruction ID: ff47032bf70788d4d637059124486bc2976f64b1c00e89644883d3bfb331fecf
Opcode Fuzzy Hash: 4d5f9101b7c68e2ea673beb43ccf43c51b92bbd1e4e1e8018fc2f61f67cacb9b
Instruction Fuzzy Hash: 4872FBB26043899FDB789F38CD857DABBA2FF58300F55852DDD899B210D7309A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02B22D7C, Relevance: 7.0, Strings: 5, Instructions: 757COMMON

Download Yara Rule

Strings

_o7, xrefs: 02B206BB
), xrefs: 02B22FDB
rp}, xrefs: 02B23270
:V9v, xrefs: 02B2302D
6=lL, xrefs: 02B233F2

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )$6=lL$:V9v$rp}$_o7
API String ID: 0-398544117
Opcode ID: 1fd6f139449c9a88417ba2ce7d451ac06c8c31710d1ea0714e03f333e94dd6fa
Instruction ID: 1a61c5dd1d54d6cf8d3524f9881e9db6ece6b7039b14d23a680dca7727fbc6ab
Opcode Fuzzy Hash: 1fd6f139449c9a88417ba2ce7d451ac06c8c31710d1ea0714e03f333e94dd6fa
Instruction Fuzzy Hash: E362CCB1A047599FDB24DF28CD84BDAB7E6FF49350F458269EC8C9B240D730AA45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02B242D5, Relevance: 5.7, Strings: 4, Instructions: 692COMMON

Download Yara Rule

Strings

oi~, xrefs: 02B248A6
H}e>, xrefs: 02B24EBE
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$oi~$pB
API String ID: 0-3551811396
Opcode ID: e1d80208e2d3f4bc6fc902a0c9f377c33293c564851c06d407856526d3ba29ac
Instruction ID: cbe7292dd04f57149154838a4a5f8b234f099eaa2bea59467bd64eb7258b0b5f
Opcode Fuzzy Hash: e1d80208e2d3f4bc6fc902a0c9f377c33293c564851c06d407856526d3ba29ac
Instruction Fuzzy Hash: 8C520EB220438A9FDB748F74CD957DABBA2FF45310F54422DDE9A8B250D7709A44CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02B2475A, Relevance: 5.5, Strings: 4, Instructions: 493COMMON

Download Yara Rule

Strings

oi~, xrefs: 02B248A6
H}e>, xrefs: 02B24EBE
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$oi~$pB
API String ID: 0-3551811396
Opcode ID: afdf16353a7669cb9ede50f7a2b574da09757d247c46680f384258a5b6205bf3
Instruction ID: a1f96189d2764b5d6f92be00b20a84d575f3b4479036c1f4480c763244624842
Opcode Fuzzy Hash: afdf16353a7669cb9ede50f7a2b574da09757d247c46680f384258a5b6205bf3
Instruction Fuzzy Hash: 4F220F7220438A9FDB748F74CD557DABBA2FF06320F584619DE9D9B260D3709A44CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02B24693, Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

oi~, xrefs: 02B248A6
H}e>, xrefs: 02B24EBE
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$oi~$pB
API String ID: 0-3551811396
Opcode ID: d98a7c236be208a8c3c15656f3e4560ed7e93ddba362e21036d51a1c58e23305
Instruction ID: c9fe0e38976d0315d78fe51583d9a0f8dbb47468caba044d89f818ef24fd4e71
Opcode Fuzzy Hash: d98a7c236be208a8c3c15656f3e4560ed7e93ddba362e21036d51a1c58e23305
Instruction Fuzzy Hash: A622DAB26403899FDB758F34CD857DABBB2FF58300F558529ED899B210D3709A848F82

Uniqueness

Uniqueness Score: -1.00%

Function 02B24A41, Relevance: 4.1, Strings: 3, Instructions: 314COMMON

Download Yara Rule

Strings

H}e>, xrefs: 02B24EBE
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$pB
API String ID: 0-1275842295
Opcode ID: d75ae6b069b4335bfe66a40b9fdf05567418486d0efa0c82cd86e9d67c7b43fa
Instruction ID: 6fb86eb7e3eac28d35bfc0e925d035c70e6d2152daec69743bf8dee743593c3b
Opcode Fuzzy Hash: d75ae6b069b4335bfe66a40b9fdf05567418486d0efa0c82cd86e9d67c7b43fa
Instruction Fuzzy Hash: 7EE1DDB26403989FDF798F34CC857DA3BA2FF58300F55812AED8D9B254D7709A848B52

Uniqueness

Uniqueness Score: -1.00%

Function 02B24C15, Relevance: 4.0, Strings: 3, Instructions: 294COMMON

Download Yara Rule

Strings

H}e>, xrefs: 02B24EBE
gyK, xrefs: 02B24F60
pB, xrefs: 02B2520A

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H}e>$gyK$pB
API String ID: 0-1275842295
Opcode ID: a175c02be50b9286902968146a80641177ae6e8eb6fc228225ae782b3b6d6059
Instruction ID: 5767abb7439516e29bdf94c44e182a2ac6558469ff722529919327a65ed04898
Opcode Fuzzy Hash: a175c02be50b9286902968146a80641177ae6e8eb6fc228225ae782b3b6d6059
Instruction Fuzzy Hash: A4C1137224438A9FDB358F74CD553CA7BA2FF06324F584219EEAD8B2A0D7709A44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02B2864F, Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

?fB., xrefs: 02B28ADC
_o7, xrefs: 02B206BB

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?fB.$_o7
API String ID: 0-2351114068
Opcode ID: a5df2b347951536e05a25ec4aaab7e4f38929d3322e5cce2483a73ca57a87aa8
Instruction ID: 47020ba375a469b5d459852ee590737cd2d567b0cf95779971b16334a56f4974
Opcode Fuzzy Hash: a5df2b347951536e05a25ec4aaab7e4f38929d3322e5cce2483a73ca57a87aa8
Instruction Fuzzy Hash: 8912E4715083D58FCB35DF38C8987DABBA2AF56310F49C29ACC998F296D3308545CB26

Uniqueness

Uniqueness Score: -1.00%

Function 02B28355, Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

~gQj, xrefs: 02B2838A
?fB., xrefs: 02B28ADC

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?fB.$~gQj
API String ID: 0-331994394
Opcode ID: a37b8f2435da73da57c146cad687f1c22395537c51c96cf50b3aa17223b4948c
Instruction ID: 09995029f287c8243b3658846b592bdccf4ebaab9e9f80084be78bff8147a931
Opcode Fuzzy Hash: a37b8f2435da73da57c146cad687f1c22395537c51c96cf50b3aa17223b4948c
Instruction Fuzzy Hash: A402B2715083D58FCB31DF38C89879ABBA1AF16320F0982DACC9D8F296D7349545CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02B25E11, Relevance: 2.9, Strings: 2, Instructions: 353COMMON

Download Yara Rule

Strings

_o7, xrefs: 02B206BB
} H, xrefs: 02B25E17

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: } H$_o7
API String ID: 2167126740-109503836
Opcode ID: f901022dfb2f1d5f6f235ec8f0756f3e87c049b98ce0e695669b99fa423dae93
Instruction ID: 7279811b404ed6556a70e3c6d7e1c1f969b24b6e0bc0724463f3f58b9944aeaa
Opcode Fuzzy Hash: f901022dfb2f1d5f6f235ec8f0756f3e87c049b98ce0e695669b99fa423dae93
Instruction Fuzzy Hash: DDE12172A0439A8FDB749F38CD847DE7BA6AF59300F51452DDD8DAB214E7308A49CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02B28759, Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

?fB., xrefs: 02B28ADC
w, xrefs: 02B2883F

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?fB.$w
API String ID: 0-1859872851
Opcode ID: 726592695901f5796090d0f34354503750224bb66bf6410bdd1f5ea4ea33e029
Instruction ID: 56637f3127995251704d2bf89a3328ae0aa517fe9ccfe6697ccaeb1b9f81361b
Opcode Fuzzy Hash: 726592695901f5796090d0f34354503750224bb66bf6410bdd1f5ea4ea33e029
Instruction Fuzzy Hash: 85C1EF215087D68EDB318F7889A938ABF929F03334F0D8299CDEE5E1E7D3619604C756

Uniqueness

Uniqueness Score: -1.00%

Function 02B23051, Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

rp}, xrefs: 02B23270
6=lL, xrefs: 02B233F2

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 6=lL$rp}
API String ID: 0-2610716473
Opcode ID: 4bc7956444a598efd7208cb7a6e0336db8f9e4772c6ec9f9879b26fb4d802c97
Instruction ID: 95aa5f1d4932464bac7979619a8e2c7022d7d0b6ece954fffb9e114ca23f4c3e
Opcode Fuzzy Hash: 4bc7956444a598efd7208cb7a6e0336db8f9e4772c6ec9f9879b26fb4d802c97
Instruction Fuzzy Hash: FFB1D27220879A9FDB20CF78CD957C9BBA1FF06324F084249DEAD57291D774AA14CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02B2380C, Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

'#w, xrefs: 02B23B1C
>m9, xrefs: 02B29BE1

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: '#w$>m9
API String ID: 0-4164438735
Opcode ID: 4ddcc08cc40e2931e260e0a9dd0a3a2f950864459ab3d8013d41cf1425f1ad27
Instruction ID: 8b2bd9f3a994ddc7a862a864f89a21a8bb61df1cc305c991ca707d94a2e12bc5
Opcode Fuzzy Hash: 4ddcc08cc40e2931e260e0a9dd0a3a2f950864459ab3d8013d41cf1425f1ad27
Instruction Fuzzy Hash: 7B7112715047959FD7249F38C818BEAB7A2FF55350F56819DE88E8B2A4D3348985CF02

Uniqueness

Uniqueness Score: -1.00%

Function 02B27AA5, Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

="%*, xrefs: 02B27B57
`, xrefs: 02B27B8B

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ="%*$`
API String ID: 0-3267555959
Opcode ID: 834cc398d6c5ae8e992a8e14aaec6f7820581b96bb0233af7666cdfe713cfea7
Instruction ID: b1e9f0ba61a2f103834aacb7b8f82d93699bdc85d228ddc6178bdca43e2b854a
Opcode Fuzzy Hash: 834cc398d6c5ae8e992a8e14aaec6f7820581b96bb0233af7666cdfe713cfea7
Instruction Fuzzy Hash: 5E213D72A117944BEF789E25CD653DE73B39FC6390F62801ACC0EDB218DB300A464B49

Uniqueness

Uniqueness Score: -1.00%

Function 02B209C7, Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

oi~, xrefs: 02B248A6

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: oi~
API String ID: 2167126740-1800798654
Opcode ID: 810cffa487482a506d21372e298ca0cf115e470469caf28b4a71cf436a60cc18
Instruction ID: b0f2faa12fb3a78dbf87d029301e0ab61733e672c338302aaa723800ccf0934b
Opcode Fuzzy Hash: 810cffa487482a506d21372e298ca0cf115e470469caf28b4a71cf436a60cc18
Instruction Fuzzy Hash: 1C222EB1A043499FCB34AF39CD947DABBA2FF59300F55822DDD8E9B214C7309A858B41

Uniqueness

Uniqueness Score: -1.00%

Function 02B28500, Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

?fB., xrefs: 02B28ADC

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?fB.
API String ID: 0-3687817265
Opcode ID: beb2973860074f611573894b6d15e0e54fee3f4c8a7b8b0981cc906e5753ca3a
Instruction ID: 50dfba29a591b3e9694028d4f98cf024cb02d124f4752f88bf4a21d4fa52dc8d
Opcode Fuzzy Hash: beb2973860074f611573894b6d15e0e54fee3f4c8a7b8b0981cc906e5753ca3a
Instruction Fuzzy Hash: D3D1A2715083D68FCB25CF38C89879ABFA1AF16320F4982DEC8998F297D3359545C726

Uniqueness

Uniqueness Score: -1.00%

Function 02B285F7, Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

?fB., xrefs: 02B28ADC

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?fB.
API String ID: 0-3687817265
Opcode ID: 58f51944fc7b409344dab3f245f22e6dcd146f50f8a516537ccf3c1c8e727b8b
Instruction ID: 6e19770f824db8b18223fa2f5128ce61960e6d6dc09aeff2b58ee9c172d403aa
Opcode Fuzzy Hash: 58f51944fc7b409344dab3f245f22e6dcd146f50f8a516537ccf3c1c8e727b8b
Instruction Fuzzy Hash: F0D1B3715083D68FCB25CF38889879ABFE1AF16320F4982DEC8A98F297D3359545C716

Uniqueness

Uniqueness Score: -1.00%

Function 02B29577, Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

H\_m, xrefs: 02B297E2

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: H\_m
API String ID: 0-341976164
Opcode ID: 527463814063ebe24fd45d27f456fdac45d6e40efbb826a6c9e15bef6d82f1f5
Instruction ID: 115c1bb009ddbaff42f3c1f5536d22c37ada5b70942e6990aa0dccd603ef8f46
Opcode Fuzzy Hash: 527463814063ebe24fd45d27f456fdac45d6e40efbb826a6c9e15bef6d82f1f5
Instruction Fuzzy Hash: 81C13172A047498FDB34AE78C9943EA7BA2EF99310F55866ECC4D9B214D3309A49CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02B27EAD, Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

GUb, xrefs: 02B27F10

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: GUb
API String ID: 0-989475670
Opcode ID: b8ecaba17da8340310d6e50dc3054f5e8c76b745ac63d88b8cc61f169632f950
Instruction ID: 7e0c65394852d95726b0efc526c81938cdfd1e0568dd8d857ef2c07c1b4b86f1
Opcode Fuzzy Hash: b8ecaba17da8340310d6e50dc3054f5e8c76b745ac63d88b8cc61f169632f950
Instruction Fuzzy Hash: 8E81D471600799DFCB30CE69CCA57DAB7A2FF88344F55812ACD4C9B204D7309A86CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02B23424, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

6=lL, xrefs: 02B233F2

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 6=lL
API String ID: 0-1855268786
Opcode ID: 9467ec123dbc705f4cfaf0d4c15c797c9ff9c1530521addde0e2a0ad2b5a0c74
Instruction ID: 7dcf59460a38183d084327673b14474850271af7dd7ac549ba97ec30cd9be72a
Opcode Fuzzy Hash: 9467ec123dbc705f4cfaf0d4c15c797c9ff9c1530521addde0e2a0ad2b5a0c74
Instruction Fuzzy Hash: A3710FB2A043569FDB20DF38C9907DABBF2BF59310F658569DC8997204D7309A49CF82

Uniqueness

Uniqueness Score: -1.00%

Function 02B27F61, Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

GUb, xrefs: 02B27F10

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: GUb
API String ID: 0-989475670
Opcode ID: fc3c2ddf8d6c82a92161de380aab238d5a7d4e2b0d348c2ed403b268705363a4
Instruction ID: 0b651e2066c30be0a728164ef530708d6f498f9aedc5915542d13b1ada1109c1
Opcode Fuzzy Hash: fc3c2ddf8d6c82a92161de380aab238d5a7d4e2b0d348c2ed403b268705363a4
Instruction Fuzzy Hash: 5361E3711487DB9FD730CE74CD953CABB92AF0A375F484208CFAD0A291E370A615CA95

Uniqueness

Uniqueness Score: -1.00%

Function 02B28181, Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

GUb, xrefs: 02B27F10

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: GUb
API String ID: 0-989475670
Opcode ID: d1c8f913eb6aad62bfddb4d146a261b8882dbac14e05b4c791d45da163b8aab9
Instruction ID: 232257e882d54d83ad029106d86d075fc16d12c832c3f2cd783045e01a1a5386
Opcode Fuzzy Hash: d1c8f913eb6aad62bfddb4d146a261b8882dbac14e05b4c791d45da163b8aab9
Instruction Fuzzy Hash: 3D5134701457999FCB30CF28CD956DA7BA2FF49300F04826ACC8C8B606C3305A97CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02B21D86, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

_o7, xrefs: 02B206BB

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _o7
API String ID: 0-375896732
Opcode ID: ba2570158708d404784f04b567c15cbc9f21d10bf27141b65c5159544b38b82f
Instruction ID: e38289a3c6ba75f0d586114cf2015bfe030cbed397c649fd38e695e477c40b51
Opcode Fuzzy Hash: ba2570158708d404784f04b567c15cbc9f21d10bf27141b65c5159544b38b82f
Instruction Fuzzy Hash: 8E51F6B2A042589FCB749F69CC507EE7BE6AF98310F15802EED8DDB210D7345A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02B23996, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

'#w, xrefs: 02B23B1C

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: '#w
API String ID: 0-2949755655
Opcode ID: af07e406827e974c2350763d01c24110c5ce44f973993d7f11c16524ed0b6723
Instruction ID: 5ed024207955b1fbf9fa6cb562edc273bb24c25e51ea6fd791c275d28d48c641
Opcode Fuzzy Hash: af07e406827e974c2350763d01c24110c5ce44f973993d7f11c16524ed0b6723
Instruction Fuzzy Hash: F051D172118BDB5EE3208BB48D6638AFE929F07336F585648DFFE061E1E7709614CA41

Uniqueness

Uniqueness Score: -1.00%

Function 02B238B9, Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

'#w, xrefs: 02B23B1C

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID: '#w
API String ID: 0-2949755655
Opcode ID: 7baa2f222025e90aa161ab4da98ebc16a03b25a42f48fe0d6a7c08edce3c5b34
Instruction ID: fe5bcb50246e31f89c62dae13a8796093b40617d68308e6488b509b6a2b4469e
Opcode Fuzzy Hash: 7baa2f222025e90aa161ab4da98ebc16a03b25a42f48fe0d6a7c08edce3c5b34
Instruction Fuzzy Hash: 4A4142711043559FDB34AF39CC18BEA7BA2EF94350F6A849DDC8E8B254D3304986CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02B22559, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@~[5, xrefs: 02B226E9

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: @~[5
API String ID: 2167126740-3955458759
Opcode ID: 1ba7b1152ca7505dbb46b61d628173528489a02228a8c18f5aee22c1e34c2e8e
Instruction ID: d776f5d09ca5ad7908d0dc64eda054adac73d337c2c36ddb45159139bf79ffd5
Opcode Fuzzy Hash: 1ba7b1152ca7505dbb46b61d628173528489a02228a8c18f5aee22c1e34c2e8e
Instruction Fuzzy Hash: 0C41B3716013998FCB749F29CC65BDB37A7FF98300F95852DE84D8B254DB318A818B14

Uniqueness

Uniqueness Score: -1.00%

Function 02B21D8F, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c911b52b3882cc769f0e12ee9d9586674feba2f6aea517dda753902431c70dd
Instruction ID: f4e007e8daa7fe0e2f784eb23219d81407e32cd7948febe101acbe8516af767f
Opcode Fuzzy Hash: 7c911b52b3882cc769f0e12ee9d9586674feba2f6aea517dda753902431c70dd
Instruction Fuzzy Hash: 7D81D27210879A5FD7208FB8CD513DABBD29F4A334F18021CEFAE572A1D7745A50CA81

Uniqueness

Uniqueness Score: -1.00%

Function 02B25C5C, Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5fd7a9329596c593cf96c3f23005aa8c3b690d165af81fcb575a47272e7ac18b
Instruction ID: de6c8ecbf806066194cfb1809fedd12ebfa04b9de337859cfa25f1b8982099f8
Opcode Fuzzy Hash: 5fd7a9329596c593cf96c3f23005aa8c3b690d165af81fcb575a47272e7ac18b
Instruction Fuzzy Hash: 84712571A447998FDB20EF78C9547DE7BB2AF59310F51866DCC899B248E7308A49CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02B23FDB, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42cb47b7d73c82f26e332ef9a69ba4120c104e7f3cee751e2dcf2278c5dedbb
Instruction ID: ceea9e204b993654faf24f2ef9eefff6870d7dd302061924bbf769dca86a46a3
Opcode Fuzzy Hash: d42cb47b7d73c82f26e332ef9a69ba4120c104e7f3cee751e2dcf2278c5dedbb
Instruction Fuzzy Hash: 77711472504358DFCB30CE669D943DAB7F6EFAC300F41422A8D4E9B605C730AA46CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02B2293E, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca7359e7ce9dc4c3a93d8f3d8059f4319d337b52a234ecaed9e05af4a41956b
Instruction ID: fd40bc68c6f6a40e5d051e2d6e34e10bd07ac087e5122b92a25bd7f1ee794809
Opcode Fuzzy Hash: 8ca7359e7ce9dc4c3a93d8f3d8059f4319d337b52a234ecaed9e05af4a41956b
Instruction Fuzzy Hash: 4671DDB25043599FCB749E39CC84BEAB7F6FF94350F85851EDC899B210D7309A818B02

Uniqueness

Uniqueness Score: -1.00%

Function 02B22AAE, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5979cb105c4fe8f24f66410db6856cb9353353e33931b8f4787a914d89eb96
Instruction ID: f46e3eaf47da9af58287e411c5070ec0a568133ccb71071f6e9acfa761fd80ff
Opcode Fuzzy Hash: 8d5979cb105c4fe8f24f66410db6856cb9353353e33931b8f4787a914d89eb96
Instruction Fuzzy Hash: 8451FFB15483999FCB70AF288C85BEA77B6FF84340F84451DDC88DB610C7359A81CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02B206D9, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f40a5e2cf07207e9cce2dc1e03639e8242d7da2dc5510875fbc5fb1586d625
Instruction ID: 0de2471c0e3b6c38d2692d2b2280dcd783739ba5d42734f5636d3fcacb2ed8e3
Opcode Fuzzy Hash: 32f40a5e2cf07207e9cce2dc1e03639e8242d7da2dc5510875fbc5fb1586d625
Instruction Fuzzy Hash: A8411172A443598FDB24AF39C9907DFBBE6AF59300F11892DDC89D7204E7308A498B42

Uniqueness

Uniqueness Score: -1.00%

Function 02B25661, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc67d5228187be669a596961b933bf4293d926c8a623901a6a65bf86b1deffb
Instruction ID: 25aae156cfb5885d99ff0cbd13fa75e36c28681ecec00138056502aec7ac76e0
Opcode Fuzzy Hash: cbc67d5228187be669a596961b933bf4293d926c8a623901a6a65bf86b1deffb
Instruction Fuzzy Hash: DC410271504384AFDF349F799D487DAB7A6EF98340F01422EEC4C8B614D7308A458B1A

Uniqueness

Uniqueness Score: -1.00%

Function 02B28C9D, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4307a20d0c4a1f22eda441bea184d014c05cfa1d963e2338faf627882cb4a5d6
Instruction ID: c7ca2c8b5232048fdcc6ab9552de4eba5e95ff8ddedf6f7e115843d76ee9302c
Opcode Fuzzy Hash: 4307a20d0c4a1f22eda441bea184d014c05cfa1d963e2338faf627882cb4a5d6
Instruction Fuzzy Hash: 4B41D2755083998BDF31DF25CD983DA7B62EF52250F4482AACC8C9F259D3344646CB25

Uniqueness

Uniqueness Score: -1.00%

Function 02B277CC, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4d861e362e604ceb05f81a1b3ca82b15586d18e3197d1eb9dfe4c373184312
Instruction ID: 94dbddb2b16ceedceb7bdeb24cb3bbbb8a4525bd092a9ebd4e19eaa5dc104250
Opcode Fuzzy Hash: 7a4d861e362e604ceb05f81a1b3ca82b15586d18e3197d1eb9dfe4c373184312
Instruction Fuzzy Hash: D52137767057174BCB209E38C9D03E7B793EFBE310F4541AAD9898B619E7305849C705

Uniqueness

Uniqueness Score: -1.00%

Function 02B213FC, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f186e33dedb7298988c9790ef6101b624c7dc3128968a526789e08d50f6b01ad
Instruction ID: 91224f427a8b4cae238adacfb7c65baf555c50e79035293f9ea2b9789b16d6b0
Opcode Fuzzy Hash: f186e33dedb7298988c9790ef6101b624c7dc3128968a526789e08d50f6b01ad
Instruction Fuzzy Hash: F331F830609BC15BC762DF3C884576ABFA2BF52320F58C3DEC4E98A59AC331945AC712

Uniqueness

Uniqueness Score: -1.00%

Function 02B24292, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5d63a74f8617338ded6aac58d30e79afdf39656a735ec1c600f4a0dd0d71f4
Instruction ID: 759c959e453f721df825e966a7e4671b93eaf10716e83955961ea76dda4b8236
Opcode Fuzzy Hash: 7c5d63a74f8617338ded6aac58d30e79afdf39656a735ec1c600f4a0dd0d71f4
Instruction Fuzzy Hash: FA1136741443848FEB64EFB58D946EBB7E2FF89740F92462DCC8A87724C7700A458A05

Uniqueness

Uniqueness Score: -1.00%

Function 02B279C6, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f848d05097df93def732d4b0d1120199fdc590b61596e894b5d48f9113a21b55
Instruction ID: d43b1e26f2e9ed28d1b86a505b975c22ec30a3421e2568e2ac1a434196d63359
Opcode Fuzzy Hash: f848d05097df93def732d4b0d1120199fdc590b61596e894b5d48f9113a21b55
Instruction Fuzzy Hash: 2D01C4756153949FDB34DF18C8D0EDAB3A2FB0A710F5954AAE919AB311CA30AA00DB25

Uniqueness

Uniqueness Score: -1.00%

Function 02B2546D, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd7b0a3219b1127c02cda12faac333263f07eb838cde2bc2ff272d1dd6c1307
Instruction ID: fee9d989c7b3d39a336799225af6743fac457f3456748666a4b9a34bcf7acf9a
Opcode Fuzzy Hash: dfd7b0a3219b1127c02cda12faac333263f07eb838cde2bc2ff272d1dd6c1307
Instruction Fuzzy Hash: 82B092F73025808FEB05CB08C491B0473A0FB00648F0404A0E002CBB12D324ED00CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02B273B7, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1174329957.0000000002B20000.00000040.00000001.sdmp, Offset: 02B20000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Fec9qUX4at.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Fec9qUX4at.exe PID: 6536 Parent PID: 5808

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Fec9qUX4at.exe PID: 6536 Parent PID: 5808 Fec9qUX4at.exeCOMMON

Executed Functions

Function 02B25867, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 372memorynativeCOMMON

Function 00401144, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588COMMON