Loading ...

Play interactive tourEdit tour

Windows Analysis Report BANK DETAILS.bat

Overview

General Information

Sample Name:BANK DETAILS.bat (renamed file extension from bat to exe)
Analysis ID:458685
MD5:37ecfc300780ade05b85fc969675e415
SHA1:4874e705a0a075997da7d7bd8cf6f8608376600a
SHA256:552db26bdd2347a216bb88e706ebf2bc9a145c8a5d38d082c53dcdd2f344c162
Tags:batexe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • BANK DETAILS.exe (PID: 7028 cmdline: 'C:\Users\user\Desktop\BANK DETAILS.exe' MD5: 37ECFC300780ADE05B85FC969675E415)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: BANK DETAILS.exeVirustotal: Detection: 19%Perma Link
    Source: BANK DETAILS.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI
    Source: BANK DETAILS.exe, 00000000.00000002.1183807890.00000000007FA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess Stats: CPU usage > 98%
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00766F5D NtAllocateVirtualMemory,0_2_00766F5D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00767139 NtAllocateVirtualMemory,0_2_00767139
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00766F5D0_2_00766F5D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076AE730_2_0076AE73
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076147F0_2_0076147F
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076B8780_2_0076B878
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007654790_2_00765479
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076586F0_2_0076586F
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076325B0_2_0076325B
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00769C430_2_00769C43
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007610300_2_00761030
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076163E0_2_0076163E
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A63F0_2_0076A63F
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007676390_2_00767639
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076682A0_2_0076682A
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A0150_2_0076A015
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007606120_2_00760612
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007654040_2_00765404
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00763A0C0_2_00763A0C
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007656080_2_00765608
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007696F10_2_007696F1
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760EFC0_2_00760EFC
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007646FA0_2_007646FA
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A4ED0_2_0076A4ED
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007698DA0_2_007698DA
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007642D80_2_007642D8
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00762ECF0_2_00762ECF
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764EC90_2_00764EC9
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076B4B10_2_0076B4B1
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A8960_2_0076A896
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076B6990_2_0076B699
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760E850_2_00760E85
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076976C0_2_0076976C
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076416B0_2_0076416B
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007625460_2_00762546
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076AB460_2_0076AB46
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F490_2_00760F49
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F350_2_00760F35
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007653350_2_00765335
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A53D0_2_0076A53D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007697380_2_00769738
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00762F270_2_00762F27
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007621290_2_00762129
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00769D110_2_00769D11
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076911A0_2_0076911A
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076B30C0_2_0076B30C
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007631F50_2_007631F5
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00768BE60_2_00768BE6
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007625E20_2_007625E2
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007615D30_2_007615D3
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007625C40_2_007625C4
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD0_2_0076A1CD
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076B3B70_2_0076B3B7
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007641BA0_2_007641BA
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00765FB80_2_00765FB8
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764BA20_2_00764BA2
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F980_2_00760F98
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007615990_2_00761599
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007631850_2_00763185
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007617820_2_00761782
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD0_2_0076A1CD
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764F8D0_2_00764F8D
    Source: BANK DETAILS.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: BANK DETAILS.exe, 00000000.00000000.657476442.000000000041B000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameMeloplasttyskl2.exe vs BANK DETAILS.exe
    Source: BANK DETAILS.exe, 00000000.00000002.1184205233.0000000002A70000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMeloplasttyskl2.exeFE2Xee vs BANK DETAILS.exe
    Source: BANK DETAILS.exe, 00000000.00000002.1183729711.00000000005F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs BANK DETAILS.exe
    Source: BANK DETAILS.exeBinary or memory string: OriginalFilenameMeloplasttyskl2.exe vs BANK DETAILS.exe
    Source: BANK DETAILS.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: classification engineClassification label: mal84.troj.evad.winEXE@1/0@0/0
    Source: C:\Users\user\Desktop\BANK DETAILS.exeFile created: C:\Users\user\AppData\Local\Temp\~DF653C10E4147526EC.TMPJump to behavior
    Source: BANK DETAILS.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\BANK DETAILS.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: BANK DETAILS.exeVirustotal: Detection: 19%

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00412CC0 push dword ptr [ebp-14h]; ret 0_2_00414DE8
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00404460 pushfd ; ret 0_2_00404475
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_004045EE push cs; iretd 0_2_00404609
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0040428E push ds; iretd 0_2_0040429A
    Source: initial sampleStatic PE information: section name: .text entropy: 6.81210830027
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion:

    barindex
    Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00766F5D NtAllocateVirtualMemory,0_2_00766F5D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076AE73 0_2_0076AE73
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076147F 0_2_0076147F
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00765479 0_2_00765479
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00762066 0_2_00762066
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00769C43 0_2_00769C43
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00761030 0_2_00761030
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076163E 0_2_0076163E
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00767639 0_2_00767639
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076682A 0_2_0076682A
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760612 0_2_00760612
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00765404 0_2_00765404
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00763A0C 0_2_00763A0C
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00765608 0_2_00765608
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760EFC 0_2_00760EFC
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007646FA 0_2_007646FA
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764EC9 0_2_00764EC9
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760E85 0_2_00760E85
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F49 0_2_00760F49
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F35 0_2_00760F35
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00765335 0_2_00765335
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076911A 0_2_0076911A
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00768BE6 0_2_00768BE6
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007615D3 0_2_007615D3
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD 0_2_0076A1CD
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764BA2 0_2_00764BA2
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00760F98 0_2_00760F98
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00761599 0_2_00761599
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00761782 0_2_00761782
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD 0_2_0076A1CD
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00764F8D 0_2_00764F8D
    Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000766F8A second address: 0000000000766F8A instructions:
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000769377 second address: 0000000000769377 instructions:
    Tries to detect virtualization through RDTSC time measurementsShow sources
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000766F8A second address: 0000000000766F8A instructions:
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000769479 second address: 00000000007694C2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov eax, dword ptr fs:[00000030h] 0x00000009 mov eax, dword ptr [eax+0Ch] 0x0000000c mov eax, dword ptr [eax+14h] 0x0000000f test al, cl 0x00000011 mov ecx, dword ptr [eax] 0x00000013 mov eax, ecx 0x00000015 cmp ebx, eax 0x00000017 jmp 00007FE334DBD16Bh 0x00000019 test bx, bx 0x0000001c mov ebx, dword ptr [eax+28h] 0x0000001f mov dword ptr [ebp+00000277h], ebx 0x00000025 mov ebx, EFC24E89h 0x0000002a pushad 0x0000002b mov edi, 00000074h 0x00000030 rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000769377 second address: 0000000000769377 instructions:
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 00000000007670DF second address: 0000000000767117 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 xor edi, 4F0B01ABh 0x00000009 cmp ch, ah 0x0000000b push edi 0x0000000c cmp bx, bx 0x0000000f mov edi, dword ptr [ebp+00000203h] 0x00000015 cmp ah, 00000001h 0x00000018 test ecx, ebx 0x0000001a mov dword ptr [ebp+00000148h], 00000000h 0x00000024 add ebx, 04h 0x00000027 mov dword ptr [ebp+0000024Ah], eax 0x0000002d cmp ch, FFFFFFDAh 0x00000030 mov eax, ebx 0x00000032 pushad 0x00000033 mov ecx, 00000042h 0x00000038 rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 000000000076B44E second address: 0000000000769479 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007FE334DBAD90h 0x00000008 test dl, dl 0x0000000a pushad 0x0000000b test bh, ah 0x0000000d cmp cl, bl 0x0000000f push 92D68FDCh 0x00000014 call 00007FE334DBB6C6h 0x00000019 pushad 0x0000001a mov edi, 00000045h 0x0000001f rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 00000000007666CF second address: 00000000007667B7 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp cx, 8B05h 0x00000008 mov dword ptr [ebp+00000212h], edi 0x0000000e test bh, dh 0x00000010 mov edi, ecx 0x00000012 push edi 0x00000013 cmp ecx, edx 0x00000015 mov edi, dword ptr [ebp+00000212h] 0x0000001b cmp bl, bl 0x0000001d test esi, 5BD1BFCAh 0x00000023 call 00007FE334DBD20Dh 0x00000028 call 00007FE334DBD17Eh 0x0000002d lfence 0x00000030 mov edx, C7DAD013h 0x00000035 add edx, 5901ADA8h 0x0000003b xor edx, 770150F3h 0x00000041 xor edx, 28232D5Ch 0x00000047 mov edx, dword ptr [edx] 0x00000049 lfence 0x0000004c ret 0x0000004d mov esi, edx 0x0000004f pushad 0x00000050 rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 00000000007667B7 second address: 0000000000766703 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 27269D29h 0x00000007 xor eax, A18D231Eh 0x0000000c xor eax, 1CE799B1h 0x00000011 sub eax, 9A4C2785h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FE334DBC22Dh 0x0000001e lfence 0x00000021 mov edx, C7DAD013h 0x00000026 add edx, 5901ADA8h 0x0000002c xor edx, 770150F3h 0x00000032 xor edx, 28232D5Ch 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 cmp esi, C7A87762h 0x00000047 pushad 0x00000048 mov eax, 00000008h 0x0000004d rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000766703 second address: 0000000000766745 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 pop ecx 0x00000004 cmp cx, E7B5h 0x00000009 add edi, edx 0x0000000b test bh, dh 0x0000000d dec ecx 0x0000000e mov dword ptr [ebp+0000024Eh], 76D68B9Dh 0x00000018 cmp ecx, edx 0x0000001a xor dword ptr [ebp+0000024Eh], 83B81CB0h 0x00000024 cmp bl, bl 0x00000026 test esi, 7FF4DB34h 0x0000002c xor dword ptr [ebp+0000024Eh], A8C87E56h 0x00000036 cmp esi, 10940B3Dh 0x0000003c pushad 0x0000003d mov eax, 00000064h 0x00000042 rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeRDTSC instruction interceptor: First address: 0000000000766745 second address: 00000000007667B7 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 xor dword ptr [ebp+0000024Eh], 5DA6E97Bh 0x0000000d cmp cx, 91C2h 0x00000012 test bh, dh 0x00000014 cmp ecx, dword ptr [ebp+0000024Eh] 0x0000001a jne 00007FE334DBC193h 0x00000020 cmp cx, 8B05h 0x00000025 mov dword ptr [ebp+00000212h], edi 0x0000002b test bh, dh 0x0000002d mov edi, ecx 0x0000002f push edi 0x00000030 cmp ecx, edx 0x00000032 mov edi, dword ptr [ebp+00000212h] 0x00000038 cmp bl, bl 0x0000003a test esi, 5BD1BFCAh 0x00000040 call 00007FE334DBC2DDh 0x00000045 call 00007FE334DBC24Eh 0x0000004a lfence 0x0000004d mov edx, C7DAD013h 0x00000052 add edx, 5901ADA8h 0x00000058 xor edx, 770150F3h 0x0000005e xor edx, 28232D5Ch 0x00000064 mov edx, dword ptr [edx] 0x00000066 lfence 0x00000069 ret 0x0000006a mov esi, edx 0x0000006c pushad 0x0000006d rdtsc
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00766F5D rdtsc 0_2_00766F5D
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\BANK DETAILS.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00766F5D rdtsc 0_2_00766F5D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00769473 mov eax, dword ptr fs:[00000030h]0_2_00769473
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00763A0C mov eax, dword ptr fs:[00000030h]0_2_00763A0C
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076416B mov eax, dword ptr fs:[00000030h]0_2_0076416B
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076652D mov eax, dword ptr fs:[00000030h]0_2_0076652D
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00763DC6 mov eax, dword ptr fs:[00000030h]0_2_00763DC6
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00768FC0 mov eax, dword ptr fs:[00000030h]0_2_00768FC0
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD mov eax, dword ptr fs:[00000030h]0_2_0076A1CD
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_007641BA mov eax, dword ptr fs:[00000030h]0_2_007641BA
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_0076A1CD mov eax, dword ptr fs:[00000030h]0_2_0076A1CD
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: BANK DETAILS.exe, 00000000.00000002.1183852579.0000000000D80000.00000002.00000001.sdmpBinary or memory string: Program Manager
    Source: BANK DETAILS.exe, 00000000.00000002.1183852579.0000000000D80000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
    Source: BANK DETAILS.exe, 00000000.00000002.1183852579.0000000000D80000.00000002.00000001.sdmpBinary or memory string: Progman
    Source: BANK DETAILS.exe, 00000000.00000002.1183852579.0000000000D80000.00000002.00000001.sdmpBinary or memory string: Progmanlock
    Source: C:\Users\user\Desktop\BANK DETAILS.exeCode function: 0_2_00762C11 cpuid 0_2_00762C11

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery41Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSSystem Information Discovery311Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    BANK DETAILS.exe19%VirustotalBrowse

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:33.0.0 White Diamond
    Analysis ID:458685
    Start date:03.08.2021
    Start time:16:43:54
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 7m 28s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:BANK DETAILS.bat (renamed file extension from bat to exe)
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:13
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal84.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 12.3% (good quality ratio 3.5%)
    • Quality average: 19.7%
    • Quality standard deviation: 29.7%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):6.475587408087338
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:BANK DETAILS.exe
    File size:114688
    MD5:37ecfc300780ade05b85fc969675e415
    SHA1:4874e705a0a075997da7d7bd8cf6f8608376600a
    SHA256:552db26bdd2347a216bb88e706ebf2bc9a145c8a5d38d082c53dcdd2f344c162
    SHA512:4d0c2b9d0ce56400facd5955186441a62cde232db721584c1b97972fb133480e6d7a3b90daf01ce664b3b9e5216e25b548aeab014d20d3ec31555eb3504c831e
    SSDEEP:1536:UMxYU0ZIKPzkNY55AngpUS9UjoAXQXlIKUc3tsVHmwL+:lxYU0Z5PzYY557ORAVIxcKu
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......K..................... ......0.............@................

    File Icon

    Icon Hash:f67aedf6d0c0f98c

    Static PE Info

    General

    Entrypoint:0x401530
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x4B958B80 [Mon Mar 8 23:42:56 2010 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:b28b105866cd7f6746798ef93a2371be

    Entrypoint Preview

    Instruction
    push 00410B8Ch
    call 00007FE335017CD3h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add bl, ah
    int3
    lds edi, ebp
    xor ebp, dword ptr [edi+4Dh]
    mov dl, FDh
    test dword ptr [ecx-7CC23EBFh], 00000000h
    add byte ptr [eax], al
    add dword ptr [eax], eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add al, 00h
    add byte ptr [eax], al
    push eax
    jc 00007FE335017D51h
    push 00000065h
    arpl word ptr [ebp+esi+00h], si
    mov al, byte ptr [00000059h]
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    dec esp
    xor dword ptr [eax], eax
    or dl, byte ptr [edx]
    test byte ptr [ebx+eax*8-2Fh], 0000004Eh
    inc eax
    dec ebx
    xchg eax, edx
    or bh, byte ptr [ebp+14h]
    clc
    out dx, al
    jmp 00007FE2CB92EA81h
    add dword ptr [eax], edi
    mov dword ptr [8EBF45C1h], eax
    mov esp, 499C14E2h
    cmp cl, byte ptr [edi-53h]
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    sub ch, dh
    add byte ptr [eax], al
    nop
    add byte ptr [eax], al
    add byte ptr [esi], cl
    add byte ptr [ecx+edi*2+6Bh], al
    imul esp, dword ptr [ebp+72h], 75h
    outsb
    jnc 00007FE335017D45h
    jne 00007FE335017D4Fh
    insd
    cmp dword ptr [eax], eax
    or eax, 53000801h

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x18f040x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1b0000xfde.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x138.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x1843c0x19000False0.49474609375data6.81210830027IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x1a0000xb680x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x1b0000xfde0x1000False0.3896484375data4.19517055589IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    RT_ICON0x1b9160x6c8data
    RT_ICON0x1b3ae0x568GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x1b38c0x22data
    RT_VERSION0x1b1200x26cdataChineseTaiwan

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaVarErrI4, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaStrComp, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

    Version Infos

    DescriptionData
    Translation0x0404 0x04b0
    InternalNameMeloplasttyskl2
    FileVersion1.00
    CompanyNameCatalyst
    ProductNameProject5
    ProductVersion1.00
    FileDescriptionCatalyst
    OriginalFilenameMeloplasttyskl2.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    ChineseTaiwan

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:16:44:46
    Start date:03/08/2021
    Path:C:\Users\user\Desktop\BANK DETAILS.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\BANK DETAILS.exe'
    Imagebase:0x400000
    File size:114688 bytes
    MD5 hash:37ECFC300780ADE05B85FC969675E415
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Executed Functions

      APIs
      • NtAllocateVirtualMemory.NTDLL(-B4650570,?,-8BECC682), ref: 0076720D
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 235767ae69987f0e28ce75002f3888e69ed08516e4de99775cfd6afa2aeb1ed2
      • Instruction ID: 4b600f19ef1b06c3ea7c2b19fabef63a97dd75f7ad76c6f616c4dea1cf3a6a7d
      • Opcode Fuzzy Hash: 235767ae69987f0e28ce75002f3888e69ed08516e4de99775cfd6afa2aeb1ed2
      • Instruction Fuzzy Hash: AF5149B12443458FEB354E64CDA47DB36A6AF4A350F91003DED8A9B241D374CA8ACB06
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • NtAllocateVirtualMemory.NTDLL(-B4650570,?,-8BECC682), ref: 0076720D
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 1495b3dab2e2499ea5ede4dd7b84d1460d8382e29411de7d0c82b60514e88f54
      • Instruction ID: 37f493722afb8189fa05a2b4921449934ad2d2db8daf90cb27388f258c4b746f
      • Opcode Fuzzy Hash: 1495b3dab2e2499ea5ede4dd7b84d1460d8382e29411de7d0c82b60514e88f54
      • Instruction Fuzzy Hash: 9041E42344C7C54BDB2E8A6D9D587CA7B57FF86374F88025BCD670F2A6E22848C48B45
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaChkstk.MSVBVM60(?,00401366), ref: 00412CDE
      • __vbaVarDup.MSVBVM60 ref: 00412D43
      • #617.MSVBVM60(?,?,00000001), ref: 00412D59
      • __vbaVarTstNe.MSVBVM60(00008008,?), ref: 00412D81
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00412D9E
      • __vbaNew2.MSVBVM60(0041203C,0041A41C,?,?,00401366), ref: 00412DD7
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041202C,0000001C), ref: 00412E40
      • __vbaChkstk.MSVBVM60 ref: 00412E7D
      • __vbaCastObj.MSVBVM60(?,00412070), ref: 00412EB3
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00412EC1
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,00000058), ref: 00412F00
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412F28
      • #615.MSVBVM60(?,?,00401366), ref: 00412F38
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 00412F96
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00412FC8
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413005
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000108), ref: 00413056
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413081
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004130BE
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,00000188), ref: 0041310F
      • __vbaStrMove.MSVBVM60 ref: 0041316F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 004131F1
      • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413225
      • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,00401366), ref: 0041323E
      • __vbaNew2.MSVBVM60(00410F04,0041A010,?,?,?,?,?,?,?,?,00401366), ref: 00413261
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041329E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411FE8,00000190), ref: 004132EF
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041331A
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413357
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000180), ref: 004133A8
      • __vbaStrCopy.MSVBVM60 ref: 004133F6
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 0041347B
      • __vbaFreeStr.MSVBVM60 ref: 004134A5
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004134BB
      • __vbaNew2.MSVBVM60(00410F04,0041A010,?,?,?,?,?,?,?,?,?,?,?,00401366), ref: 004134DE
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041351B
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000070), ref: 00413566
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 004135CE
      • __vbaFreeObj.MSVBVM60 ref: 004135EC
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041360C
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413649
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,00000178), ref: 0041369A
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004136C4
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004136E0
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041371D
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000068), ref: 00413768
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413793
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004137D0
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000180), ref: 00413821
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041384B
      • __vbaStrVarMove.MSVBVM60(?,67700000,?), ref: 00413889
      • __vbaStrMove.MSVBVM60 ref: 00413897
      • __vbaStrVarMove.MSVBVM60(?,?,00000000), ref: 004138AC
      • __vbaStrMove.MSVBVM60 ref: 004138BA
      • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004138F8
      • __vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413926
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041393F
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413962
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041399F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000120), ref: 004139F0
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413A1B
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413A58
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000160), ref: 00413AA9
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00413AD3
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413AEF
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413B2C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000130), ref: 00413B7D
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00413BA7
      • __vbaStrVarMove.MSVBVM60(00000000), ref: 00413BB1
      • __vbaStrMove.MSVBVM60 ref: 00413BBF
      • __vbaI4Var.MSVBVM60(?,00000000), ref: 00413BCD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 00413C0E
      • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413C36
      • __vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413C64
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00413C7D
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413CA0
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413CDD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000178), ref: 00413D2E
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413D59
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413D96
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000048), ref: 00413DE1
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413E0C
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413E49
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411FE8,000000D0), ref: 00413E9A
      • __vbaStrMove.MSVBVM60 ref: 00413EFA
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 00413F84
      • __vbaFreeStr.MSVBVM60 ref: 00413FAE
      • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00413FCB
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00413FEE
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041402B
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000078), ref: 00414076
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 004140DE
      • __vbaFreeObj.MSVBVM60 ref: 004140FC
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041411C
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414159
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000218), ref: 004141AA
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004141D5
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414212
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000108), ref: 00414263
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041428E
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004142CB
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000058), ref: 00414316
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414341
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041437E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000150), ref: 004143CF
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004143FA
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414437
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,000000E0), ref: 00414488
      • __vbaStrMove.MSVBVM60 ref: 004144D8
      • __vbaStrMove.MSVBVM60 ref: 00414500
      • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00414582
      • __vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 004145B0
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004145D3
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414610
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,000000A8), ref: 00414661
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 004146BD
      • __vbaFreeStr.MSVBVM60 ref: 004146DB
      • __vbaFreeObj.MSVBVM60 ref: 004146E7
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414707
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414744
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000068), ref: 0041478F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 004147EB
      • __vbaFreeObj.MSVBVM60 ref: 00414809
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 00414864
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414896
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004148D3
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000190), ref: 00414924
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041494F
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041498C
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000138), ref: 004149DD
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414A08
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414A45
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000170), ref: 00414A96
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414AC1
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414AFE
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000178), ref: 00414B4F
      • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00414B79
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00414B95
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414BD2
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000110), ref: 00414C23
      • __vbaI4Var.MSVBVM60(?), ref: 00414C42
      • __vbaStrCopy.MSVBVM60 ref: 00414C65
      • __vbaStrMove.MSVBVM60 ref: 00414C8D
      • __vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00414D19
      • __vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00414D4E
      • __vbaFreeVar.MSVBVM60 ref: 00414D5D
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411820,000002B4), ref: 00414D9F
      • __vbaOnError.MSVBVM60(000000FF), ref: 00414DC0
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckHresult$New2$Free$List$Move$CallLate$ChkstkCopy$#615#617CastError
      • String ID: =C$@Z@Z$Bagerbutikkernes1$E(.$Enebarnet$Nocent$Orderable7$Riddlings$Sclerosarcoma$Udbytninger$Unaffordable2$balzacian$vapidism$x%PK$.
      • API String ID: 1246614005-4040973372
      • Opcode ID: 7f08eda41299bc58bb635363a9f9a599bdb8379cf2bc6f4e04a58c6ed5225732
      • Instruction ID: dae1eb49fdea69225c34350a54b9c45d9573d66810e8b3b086e076fe3bfe1c13
      • Opcode Fuzzy Hash: 7f08eda41299bc58bb635363a9f9a599bdb8379cf2bc6f4e04a58c6ed5225732
      • Instruction Fuzzy Hash: CF1318B5A01228EFDB20CF50CD88FDAB7B5BB49301F1085DAE64AA7250CB745AC5CF55
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(?), ref: 0040399C
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: df0362a2223331b136a274b003aceee6602823071dd750a2f6212d7a8e182c67
      • Instruction ID: ce263e2532fd9ab1be0a35eacc56f1c1025c002995cc3ae37756b279582709be
      • Opcode Fuzzy Hash: df0362a2223331b136a274b003aceee6602823071dd750a2f6212d7a8e182c67
      • Instruction Fuzzy Hash: 85418B6660F102F6EE110D24844447ABE6C9E3177B76046BBD892F91C2977E13C3976F
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(?), ref: 0040399C
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 3aec941c677451215bc16f60cdfd4b3495ebd2b45e618f3ec837076193f62438
      • Instruction ID: 7fa4739af788cc185d4e1273fa6314e49cf947aa914a22ba22407b33d9252354
      • Opcode Fuzzy Hash: 3aec941c677451215bc16f60cdfd4b3495ebd2b45e618f3ec837076193f62438
      • Instruction Fuzzy Hash: B141526660F602FAEC010D28444447ABD2C9E25B7B3B086B7D893F51C25A7E17C3676F
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(?), ref: 0040399C
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0773c2fdfdbc02948faa280dc643a9b584ef93d107022aea3334da4da78f3acb
      • Instruction ID: ad43d10602fc9b878ed47bc757c174d3c3e33b0088785a3c8d0718843dc404d2
      • Opcode Fuzzy Hash: 0773c2fdfdbc02948faa280dc643a9b584ef93d107022aea3334da4da78f3acb
      • Instruction Fuzzy Hash: CE31316660F601FAED010D28844447ABD2C9D2177B3B086B7D897F91C29A7E27C3676F
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: OY>$OY>$# l$$=&b$L?Pq$Y%a$_mZq$oS~$y=$o_${>$z
      • API String ID: 0-3720263133
      • Opcode ID: 8dcda31684f3319208604a4cec28a497629dafe5a4ad4ea2ac0db84a47d0de4d
      • Instruction ID: f12f123575fd387cbdec38590d0fbc9ad1e45e7e167af18858e94bc979092910
      • Opcode Fuzzy Hash: 8dcda31684f3319208604a4cec28a497629dafe5a4ad4ea2ac0db84a47d0de4d
      • Instruction Fuzzy Hash: F8D28D716043869FDF349F38CD997DA7BA2EF52350F95822ECC8A9B145D3358986CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: )m <$=&b$L?Pq$Y%a$oS~$rr_c$y=$::$o_${>$z
      • API String ID: 0-3916315053
      • Opcode ID: 84dfe197fdc6d95044b5ebea3d16de5a65e8f1d5f581af4c222affa6f2c02f99
      • Instruction ID: 85f82d1991a12d084e9ede2428b5087dc7cd5e092c41a730ec5ad10ab4fe15f9
      • Opcode Fuzzy Hash: 84dfe197fdc6d95044b5ebea3d16de5a65e8f1d5f581af4c222affa6f2c02f99
      • Instruction Fuzzy Hash: A303967160034ACFDF349E38CDA93DA37A2EF55350F95422EDC8A9B245D7358986CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$Y%a$`$oS~$y=$GH)$o_${>$z
      • API String ID: 0-1972577462
      • Opcode ID: 789a6e43f898e5d817135b165a10d9b64fd6ad3c0a25f47abf22afdaacdc8edc
      • Instruction ID: 9746484d51940a5d02c813f9234a24594b273c89dd55b2e109e959b45b5a6b37
      • Opcode Fuzzy Hash: 789a6e43f898e5d817135b165a10d9b64fd6ad3c0a25f47abf22afdaacdc8edc
      • Instruction Fuzzy Hash: B092527160034ADFDF349E38CDA97DA77A2EF51350F95812EDC8A9B244D7358A82CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$IZO$L?Pq$Y%a$oS~$y=$o_${>$z
      • API String ID: 0-1322331030
      • Opcode ID: 12f97dbfa0c42d3099e1db9adfb99ff4bcd0a00b804cbc894b08149571b8cda9
      • Instruction ID: c7bab4c3a6e40453fcc6741ac561f604a127f87cfcac46d1bdc96e80930e4182
      • Opcode Fuzzy Hash: 12f97dbfa0c42d3099e1db9adfb99ff4bcd0a00b804cbc894b08149571b8cda9
      • Instruction Fuzzy Hash: 029266B160434A9FDB349F38CD957DA7BA2FF51350F95812EDC8A8B241D7398986CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
      • API String ID: 0-3445597801
      • Opcode ID: aa7065c1272c25db4567b5722fab86cfb80ed8db62f804ece2022ae37abbd041
      • Instruction ID: cdc1f44caff59ce07c6128856a4de24a35a78c516c264407328938bbc62277d9
      • Opcode Fuzzy Hash: aa7065c1272c25db4567b5722fab86cfb80ed8db62f804ece2022ae37abbd041
      • Instruction Fuzzy Hash: 80B2517160034ADFDB348E38CDA57DA77A2FF46350F95822DDC8A9B241D7358A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
      • API String ID: 0-3445597801
      • Opcode ID: 3c3cbf7fa1fa742aa4d6322cb7933fb5df03cc65de2291db7ac29eacd3c7826b
      • Instruction ID: 5e84d5e340d70ce92f4c6b0d26752d24d87a07a718c5225e11c5413b44918026
      • Opcode Fuzzy Hash: 3c3cbf7fa1fa742aa4d6322cb7933fb5df03cc65de2291db7ac29eacd3c7826b
      • Instruction Fuzzy Hash: 74A241B160034A9FDF349E38CDA57DA7BA2FF55350F95812EDC8A9B240D7358A81CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
      • API String ID: 0-3445597801
      • Opcode ID: 8826a301eaa2cffdb05d47ddb14e7f74ef504de570b87b8dccfc6e917f947a43
      • Instruction ID: 36bf1f34883131ec04fd360a3fcc9297c60957efed04bb16bed28cc6b700e68f
      • Opcode Fuzzy Hash: 8826a301eaa2cffdb05d47ddb14e7f74ef504de570b87b8dccfc6e917f947a43
      • Instruction Fuzzy Hash: 2272537160034A9FDF349E38CDA53DA7BA2FF51350F95822DDC8A9B245C7358A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$oS~$y=$o_${>$z
      • API String ID: 0-3307084070
      • Opcode ID: 33204a92d2d15200e78aadb063c90a7af793d4aa0bcaa0571b8d25bc198b42d5
      • Instruction ID: 4ee4003f09a2a2c26a3afecdcf89563e0847a6e3425b4e4dcfc9d1a20dee0552
      • Opcode Fuzzy Hash: 33204a92d2d15200e78aadb063c90a7af793d4aa0bcaa0571b8d25bc198b42d5
      • Instruction Fuzzy Hash: C852207160034ADFDF349E38CD957DA7BA2EF51350F95812EDC8A9B214D7358A82CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$oS~$y=$o_${>$z
      • API String ID: 0-3307084070
      • Opcode ID: c65e701fd7fe632856006228f0cb1996c6bc58e09dff27eb5d8f1a9afb0ff8b0
      • Instruction ID: 558eeae764ed9b6d706137790f0846e32872ff901f47685443711c25f14aab9c
      • Opcode Fuzzy Hash: c65e701fd7fe632856006228f0cb1996c6bc58e09dff27eb5d8f1a9afb0ff8b0
      • Instruction Fuzzy Hash: 4F52207160034ADFDF349E38CD957DA7BA2EF41350F95822EDC8A9B254D7358A82CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$o_$z
      • API String ID: 0-2211778076
      • Opcode ID: 15fc88c30a2884dc6b13358ed3a987cd77d3f787ecec57f11d0fe88fdbbf794f
      • Instruction ID: d5555e48459920ead5fea6a95802899fa5f2ba62666a69fa3d7a52bf772ec301
      • Opcode Fuzzy Hash: 15fc88c30a2884dc6b13358ed3a987cd77d3f787ecec57f11d0fe88fdbbf794f
      • Instruction Fuzzy Hash: 3122417160034ADFDF358E28CDA57EA3BA3EF51350F95412EDC8A9B254D7358A86CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$z
      • API String ID: 0-1282955176
      • Opcode ID: c42a96e3e4bd82e1415ccfa44001d685feb62a91d94cd816a5914d3428553e35
      • Instruction ID: 437bd7b340fabf123ac6865986693fa1ef0e5790425fd9fc4f08bd4e73764e66
      • Opcode Fuzzy Hash: c42a96e3e4bd82e1415ccfa44001d685feb62a91d94cd816a5914d3428553e35
      • Instruction Fuzzy Hash: FB12427160034ADFDF398E28CDA57EA37A3EF51350F95412EDC8A9B254D7358A86CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$z
      • API String ID: 0-1282955176
      • Opcode ID: 03d4ce721bc79249af9eb84e15bfc98b07591687d56ab9c7c254fc1545d3ea9f
      • Instruction ID: 3b52d3a5cd18faf70c30b0cbf26440eab6e09e045387c7ae62772ab619a0fb77
      • Opcode Fuzzy Hash: 03d4ce721bc79249af9eb84e15bfc98b07591687d56ab9c7c254fc1545d3ea9f
      • Instruction Fuzzy Hash: E3123171600349DFDF399E28CDA57EA37A3EF51350F91412EDC8A9B251D7358A86CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$z
      • API String ID: 0-1282955176
      • Opcode ID: d92a9f81fb6be6d74726be9f13d9b0866181b5ba82638c13d36d902c0ed6d993
      • Instruction ID: 20673fc1fbc6bc7513449f82ecbec816fb974af1c9e34dc6db54591a7636b305
      • Opcode Fuzzy Hash: d92a9f81fb6be6d74726be9f13d9b0866181b5ba82638c13d36d902c0ed6d993
      • Instruction Fuzzy Hash: 5F022271600349DFDF399E28CDA57DA37A3EF52360F91412EDC8A8B151D7368A86CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: #1i1$11l1$R141
      • API String ID: 0-3388815085
      • Opcode ID: 51ab9f5b270a90cc07dda342b8a0758f3030e793019e246754a87015edb18647
      • Instruction ID: 490c229848044cb49a15b985176ea8c92a16bf63e869713051c7f04658310bbe
      • Opcode Fuzzy Hash: 51ab9f5b270a90cc07dda342b8a0758f3030e793019e246754a87015edb18647
      • Instruction Fuzzy Hash: F7B190725047938FCF24AE788CA93CE3B61BF56320F98021EDD479F246D73849868B42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: =&b$L?Pq$z
      • API String ID: 0-1282955176
      • Opcode ID: 6675dffec182a9ab3b4a7ccd39e149f4f25e5e4683d724f676267c02dd784f6a
      • Instruction ID: c10b638a649eaf605543ccab12e59f2ac2fd8e6c4a6a339e2b97024993aa1cc1
      • Opcode Fuzzy Hash: 6675dffec182a9ab3b4a7ccd39e149f4f25e5e4683d724f676267c02dd784f6a
      • Instruction Fuzzy Hash: 41B113716003499FDF398E28CDA57EA37A3FF55350F85412DDC8A8B150D7368A85CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: OY>$OY>$# l$
      • API String ID: 0-3884696089
      • Opcode ID: 2dbc797dc94fb5cd4cd51d7b4966e8395740eabaddb001a460d58eed89198302
      • Instruction ID: 6f4a72f32374b488358efaab8650092d1b2752dc1090bcef395aa8ec36a64d42
      • Opcode Fuzzy Hash: 2dbc797dc94fb5cd4cd51d7b4966e8395740eabaddb001a460d58eed89198302
      • Instruction Fuzzy Hash: 2F8159719403958FDF319E3889A83DA7BE29F12360F8581AECC8A5F14AD3358586CB53
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: 6dbc233d4649eb533319b3200f4f1ccf9b10c9b55c5b8b7fe9a8b1b5ff446560
      • Instruction ID: 851b91dbd3f66f0b4869acac2d49c0cc16d0ef82d75c61ae04de98e6f96fa2af
      • Opcode Fuzzy Hash: 6dbc233d4649eb533319b3200f4f1ccf9b10c9b55c5b8b7fe9a8b1b5ff446560
      • Instruction Fuzzy Hash: 00229E72A443858FDF349E7C8D983DE37A3BF56360F98411ACC4A9B245E3398D858B45
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: 03f5103b6db4a7d2eca60e6cf501f01473c031cc3d6a3d80e32e465a8d49ea94
      • Instruction ID: 681a2dcbacb085a4228df7483a60b965f041a6e16b7468033feb23bfe847a32d
      • Opcode Fuzzy Hash: 03f5103b6db4a7d2eca60e6cf501f01473c031cc3d6a3d80e32e465a8d49ea94
      • Instruction Fuzzy Hash: A3227B71A00349CFDF309E788D983DE37A3AF95350F95812DDC8A9B205E7358E868B52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: 3ddf78eddb3a419cfd47b978d2c75d76411601dae8a098ac1cb9723ab7c1135d
      • Instruction ID: 00d4298c0fd306925d4009e0dec3c096bc48f152a252e576fa09c9fe302d3b22
      • Opcode Fuzzy Hash: 3ddf78eddb3a419cfd47b978d2c75d76411601dae8a098ac1cb9723ab7c1135d
      • Instruction Fuzzy Hash: 4B227C71A00349DFDF309E788D983DE37A3AF95350F95812EDC8A9B205D7358E868B52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: c2f1020279e8282aa82b013160d3054602e80347cbaf877671434f52aee65a60
      • Instruction ID: f270f04284182a3530f965d71cf66de86c164cac405753fb7d7df84c7b442a0d
      • Opcode Fuzzy Hash: c2f1020279e8282aa82b013160d3054602e80347cbaf877671434f52aee65a60
      • Instruction Fuzzy Hash: DE128B71B00349CFDF309E788D983DE37A3AF95350F95812ADC8A9B205D7358E868B52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: 552669a9e891617d379a3e44d2200fe53a6578c7af5ca82e30a6e36b09795878
      • Instruction ID: 9ed4072cc2fd4ef046bb55400c047aa731ec6ac58c75f7be38d429611ea4a85e
      • Opcode Fuzzy Hash: 552669a9e891617d379a3e44d2200fe53a6578c7af5ca82e30a6e36b09795878
      • Instruction Fuzzy Hash: E4127A71B00349DFDF309E788DA83DE37A7AF95350FA5812ADC4A9B205D7358E868B41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rr_c$::
      • API String ID: 0-965447438
      • Opcode ID: bb85925f9da13e4018a5e7c1150d4a1ce416676ae936f5a042a3688de60b094b
      • Instruction ID: 737b472cc90889d6b7623e192d79834aded66c4c4b08fc28603f6856f846d59a
      • Opcode Fuzzy Hash: bb85925f9da13e4018a5e7c1150d4a1ce416676ae936f5a042a3688de60b094b
      • Instruction Fuzzy Hash: D1E18F72A043858FCF319D7D8D983DA3BA3BF56360F99421BCC9A4B245D73989858B41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: qKsU$~I
      • API String ID: 0-2676728823
      • Opcode ID: ad4c454879aad9ae50e7bc3d91f928f4382f0fe71eba4da10b707fd63491aa4c
      • Instruction ID: f3e2dd55088b009781644610af9570db03113d1160f593222480edd4c1b988bf
      • Opcode Fuzzy Hash: ad4c454879aad9ae50e7bc3d91f928f4382f0fe71eba4da10b707fd63491aa4c
      • Instruction Fuzzy Hash: 97A17471604359DFCB389E38CCA97DA37A6AF16790F95412EDC8A9B241D3348A85CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: qKsU$~I
      • API String ID: 0-2676728823
      • Opcode ID: 5fb13c52e12c446175192f2ce15cedea3ec7cf1f4abdf2f0f05b2e2765cc60a8
      • Instruction ID: ec4601acc1da85596bbf919ebd3552caa84a36195bea46f129ef47df8d1a649f
      • Opcode Fuzzy Hash: 5fb13c52e12c446175192f2ce15cedea3ec7cf1f4abdf2f0f05b2e2765cc60a8
      • Instruction Fuzzy Hash: 3C618972544348CFDF389E388DA87DB37E6AF02790F95421ECC8A9B555D3348A85CB41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: )m <
      • API String ID: 0-110772222
      • Opcode ID: 2c9ab0ff716e551a6d88f583156e091a89f34d8d57bf963e52695de3c0081d7a
      • Instruction ID: 02886307eb0735d87f16ef81cf7d41369e34848a76097836de11ce09df905945
      • Opcode Fuzzy Hash: 2c9ab0ff716e551a6d88f583156e091a89f34d8d57bf963e52695de3c0081d7a
      • Instruction Fuzzy Hash: 0252877160034ADFDB349E78CDA57EE37A6AF56390F85412EDC8ADB240D7358A86CB01
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: )m <
      • API String ID: 0-110772222
      • Opcode ID: dc233e50a90c41b6bf72ed12ed9b008dff4cf56e747a7b66ffa9280606f27220
      • Instruction ID: 58ecc42eb4be7d3d9b5523c1975f5c4dc367c32fe92e396e129f81a4acb5914e
      • Opcode Fuzzy Hash: dc233e50a90c41b6bf72ed12ed9b008dff4cf56e747a7b66ffa9280606f27220
      • Instruction Fuzzy Hash: 68027B72604346CFCF309E788DA53DB37A6AF567A0F99022ACD865B245E33948C6CB45
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: )m <
      • API String ID: 0-110772222
      • Opcode ID: 31274ee722d000fdad196a71882b41b35e19019ce91fb40518a9cc97aa4aaca1
      • Instruction ID: d937c94d460b1bc8eb0bc8489e601a26e6b1e7e2904494e532ecf20d866e211c
      • Opcode Fuzzy Hash: 31274ee722d000fdad196a71882b41b35e19019ce91fb40518a9cc97aa4aaca1
      • Instruction Fuzzy Hash: BF027871A0034ADFDF309E288DE43DB37A6AF5A790F95412EDC8A9B245D7358D82CB41
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: )m <
      • API String ID: 0-110772222
      • Opcode ID: 9303407e9fd66c9b52b80346a42a8f5aa0725aa02d4171e665a2d93917cf1fe1
      • Instruction ID: af6192efa1fe7dc15fab3ddad754df5fe422edad73c621bc4798b62de25677b4
      • Opcode Fuzzy Hash: 9303407e9fd66c9b52b80346a42a8f5aa0725aa02d4171e665a2d93917cf1fe1
      • Instruction Fuzzy Hash: 6AF19A7570034ACFDB309E788CB43DB37A6AF66390F95412EDC8A9B245D7358986CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: 11l1
      • API String ID: 0-3572296686
      • Opcode ID: 977c50d61b9c29ce7d1d15e845fb755281d9341d46af5e48cfc6de7680a6ac87
      • Instruction ID: 2fc6f6fb1622fad8bae241ccc24832830645699ec19d948f9f8ef14b7f59c56e
      • Opcode Fuzzy Hash: 977c50d61b9c29ce7d1d15e845fb755281d9341d46af5e48cfc6de7680a6ac87
      • Instruction Fuzzy Hash: 68C1B0339047528FDB209E788C993CF7BA2BF56760F98421FDC869B241D73849C28B42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rh;
      • API String ID: 0-1610986947
      • Opcode ID: ac828125a2b56751d6fedb7e79ee2bf4544405ad53b981b890defd5ee1f19d71
      • Instruction ID: 22a8d724dc00b5aa534197188893f997589f6d2bf9229b01c8942049689cf549
      • Opcode Fuzzy Hash: ac828125a2b56751d6fedb7e79ee2bf4544405ad53b981b890defd5ee1f19d71
      • Instruction Fuzzy Hash: 5FA12431A00386CFDF349E7989E93DA77A2AF56310F96413ECC46DB254D7358985CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ::
      • API String ID: 0-1334805887
      • Opcode ID: 81cd64934d0dabaa64bbb074b38d7e75e66c76d3b191efb7e1abe5fa658ae64d
      • Instruction ID: da2ecfb32d219100a2816b320e74ea32107682849e9edd2a268875ca37d45234
      • Opcode Fuzzy Hash: 81cd64934d0dabaa64bbb074b38d7e75e66c76d3b191efb7e1abe5fa658ae64d
      • Instruction Fuzzy Hash: E8918D75A00349CFDF305E788C993DA37A7AF56360FA5411ACC8A4B245E7398D868B52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ::
      • API String ID: 0-1334805887
      • Opcode ID: 242542d698de35fccc8e9da1838ffc5f37fdb7d8972609f6411d8e226f7cc706
      • Instruction ID: 6c2500ed198b3fe6371da8c81ee956ff9ca246c7768a67e9742257acbea95e6b
      • Opcode Fuzzy Hash: 242542d698de35fccc8e9da1838ffc5f37fdb7d8972609f6411d8e226f7cc706
      • Instruction Fuzzy Hash: 0A919E75600349CFCF305E788DA83DE37A3AF56350FE9411ACC8A5B245E73A8D868B46
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: ::
      • API String ID: 0-1334805887
      • Opcode ID: b01c6f70c1f77ebe6cdf8cfdb4b39ce03b45de1c6f4d97906df621b395d480f5
      • Instruction ID: 1a6557a5c58be88b8b4021be2e68649039248efbfe31cfdd64e7e96d2f0ed33c
      • Opcode Fuzzy Hash: b01c6f70c1f77ebe6cdf8cfdb4b39ce03b45de1c6f4d97906df621b395d480f5
      • Instruction Fuzzy Hash: 6F91C171A04349CFDF319E78CCD83DA37A39F52350F99411ACC8A8B245E7398D868B52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: rh;
      • API String ID: 0-1610986947
      • Opcode ID: 6c12ac94613b37e6918b0d840317cd123a7ca1429f13888b8f0c0a590096bf0e
      • Instruction ID: aad833a7194fa371b9acce00dc7b63add086088ba0d2bcd9443bc591af2dc41a
      • Opcode Fuzzy Hash: 6c12ac94613b37e6918b0d840317cd123a7ca1429f13888b8f0c0a590096bf0e
      • Instruction Fuzzy Hash: 79911431A00386CFDF349E7989A93DA77A2AF56320F96013ECC46DB255D73989C58B42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: # l$
      • API String ID: 0-1589991766
      • Opcode ID: ce106ff72751dee24754df9aa00daa8d476dbe8b78c7e4d80fb547d8109f48a9
      • Instruction ID: ec26866a95b2f781ba17dc0ea7b5b899633c4b9bb0eed14741e0b51667c8ae79
      • Opcode Fuzzy Hash: ce106ff72751dee24754df9aa00daa8d476dbe8b78c7e4d80fb547d8109f48a9
      • Instruction Fuzzy Hash: 608159715043858FDF319E3889A83DB7BE2DF12360F9582AECC8A5F14AD3358586CB56
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: # l$
      • API String ID: 0-1589991766
      • Opcode ID: 052eccaec4b8c03249b0af35ae4727f361b0feaec6a9bc256f38798525be39dd
      • Instruction ID: 835e282a8230422c796aee0170357be7124cee2ac21d81bdf2ef90a80abb7403
      • Opcode Fuzzy Hash: 052eccaec4b8c03249b0af35ae4727f361b0feaec6a9bc256f38798525be39dd
      • Instruction Fuzzy Hash: D8510B716043858FDF35DE3888A83DA7BA29F52320F85817ECC8A5F54AD3358581CB16
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: [
      • API String ID: 0-784033777
      • Opcode ID: ace0f2d1884a4884e2c0d9013a0175a6c4a3874d76cbea92ecb1845539e1bb45
      • Instruction ID: 8bc2010755e8246124f28d83623790b8236da6bc4874410358f878213ffc51fa
      • Opcode Fuzzy Hash: ace0f2d1884a4884e2c0d9013a0175a6c4a3874d76cbea92ecb1845539e1bb45
      • Instruction Fuzzy Hash: C6412C75A043CADADF306E648CA93DE37616F1B750F95002ADC898B241D3794A85C756
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: qKsU
      • API String ID: 0-2434528650
      • Opcode ID: 2bb7abdaaf9c5d905588f758bb9d4b361270bd5b93ca2d4b0f99ae8ab4d2e453
      • Instruction ID: f20fa38c41f145872250c360bbae8b3dc7ecb90ecb3763f06116f766ff2adfab
      • Opcode Fuzzy Hash: 2bb7abdaaf9c5d905588f758bb9d4b361270bd5b93ca2d4b0f99ae8ab4d2e453
      • Instruction Fuzzy Hash: CC417772A44348DFDF349E788DA97CA37A9AF57790F51021ECC8DAB285D3348A458B42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: WF
      • API String ID: 0-731659721
      • Opcode ID: 4b653f74ad6dbf0ad3b420df5e6331b3613c6bdf0654af0f6e22e85653574677
      • Instruction ID: fb76933d2119a5a736114336ac8250791aa34c0736817d9800399650fc23a5c9
      • Opcode Fuzzy Hash: 4b653f74ad6dbf0ad3b420df5e6331b3613c6bdf0654af0f6e22e85653574677
      • Instruction Fuzzy Hash: 4321E53564134E8BCF30DF7D88D47DA33A1AF2A710F95422E8DCA9B241E2344946CF46
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: a1412177cc1feb7ff5e36ce2adea5202dd9dc65fdcdb2612ebfad24b1829abd1
      • Instruction ID: c34616332cc6ea8c753314d3ed2fa87ddd62e31b6b48a5328f63ba7bca6dfc5d
      • Opcode Fuzzy Hash: a1412177cc1feb7ff5e36ce2adea5202dd9dc65fdcdb2612ebfad24b1829abd1
      • Instruction Fuzzy Hash: 53B17771A04346DFDF309E688CE43EB33B7AF56390F95412ACD8A9B244D7359986CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 07df911cf07f61905853248d8b49bba5349f5968a1ad4a0a7e6ca971d9d56342
      • Instruction ID: 2e3a82016a4b40b4bbfdb7b080e83fa8d2bc8efd070941dca575e85ce81990e0
      • Opcode Fuzzy Hash: 07df911cf07f61905853248d8b49bba5349f5968a1ad4a0a7e6ca971d9d56342
      • Instruction Fuzzy Hash: C0A158726403459FDF70CE69C9D87EA36E2AF99310FA4852ADC4BCB204D3349A82CB55
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e9479a2c62df46c70eeef99a98d0a24f25db47a1bd181eee7be74be8dd36c0ef
      • Instruction ID: 1f370361762ee88095aad983842fbb393001a66cca0c64f587de3c54dac8129f
      • Opcode Fuzzy Hash: e9479a2c62df46c70eeef99a98d0a24f25db47a1bd181eee7be74be8dd36c0ef
      • Instruction Fuzzy Hash: C2A11231A44349DFDB308E389C997DA77A7EF85350F96442EDC8ADB211C3358A86CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: bca19ee834539b0aa388cd59e1d9ff3c977d10b8c2e9529a66e3f26b46ba8e0a
      • Instruction ID: 2115a2e05c7b67b99bbb35e1e2a7a28d07bea73362a6b950b661d703b83a29e1
      • Opcode Fuzzy Hash: bca19ee834539b0aa388cd59e1d9ff3c977d10b8c2e9529a66e3f26b46ba8e0a
      • Instruction Fuzzy Hash: C2A11375A44345DFDB308E3898997EB77A7AF85350F96442EDCCAC7214C7318A89CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: a8c918bd3dabdbb39203b9b671232ab83f34777050ee110134eb080107df4f50
      • Instruction ID: a1e7a9cab04ecb8aa95c65ece2549890bdfdd57adf5c1f36106ba3e36dd57fdb
      • Opcode Fuzzy Hash: a8c918bd3dabdbb39203b9b671232ab83f34777050ee110134eb080107df4f50
      • Instruction Fuzzy Hash: F08122717403499FCB349E298CA57EB37B2AFA5390F95812DCCCA9B214D7318986CB02
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 8e8386dd1fb692e1fdaea24a6932907db3153ad78f12d33643a99b03768b4d05
      • Instruction ID: 23f22256a375c20e8f483d27402727d843d5987ad74eed0a12b679c52cefe8f0
      • Opcode Fuzzy Hash: 8e8386dd1fb692e1fdaea24a6932907db3153ad78f12d33643a99b03768b4d05
      • Instruction Fuzzy Hash: 6A714631600346CFDF359E7989E87DA77A2AF5A324F96017ECC469B121D73988C6CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 27358427c44c547cc6f1602949dcd3427dea71fbc26e7b9ecec3e7dd474541b2
      • Instruction ID: a488d21c176a25f614a4b1ead9f3e5fcfd88ccc378974050a55f04489564631e
      • Opcode Fuzzy Hash: 27358427c44c547cc6f1602949dcd3427dea71fbc26e7b9ecec3e7dd474541b2
      • Instruction Fuzzy Hash: 2C615872A00356EFDF309E689DE43D633B7AF16390F96021ACD8A57645C33559CACA82
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 264b5afeb0b42e290da38f07166a874a48062715ab3c76450d85043135531ec6
      • Instruction ID: ab8b20302f6e0c72fd7115db8dae1302b9e4f6a08f37a0b91ae496fc528fe0b2
      • Opcode Fuzzy Hash: 264b5afeb0b42e290da38f07166a874a48062715ab3c76450d85043135531ec6
      • Instruction Fuzzy Hash: C861F031B0025ACFDB649E28CCA57DA33E2BF46750F86412DEC89DB241D735DA8ACB40
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 67bc72ddf6f47a0170b194cfe58665af0527f799b126934621eda415dbed9892
      • Instruction ID: f75d89a19b3dc726588f92ffb42ea4dfd101fa5456c5283029dd02cdcf20943f
      • Opcode Fuzzy Hash: 67bc72ddf6f47a0170b194cfe58665af0527f799b126934621eda415dbed9892
      • Instruction Fuzzy Hash: E6517832A04311DFEB209E748CA63DB77E6AF86390F69452EDCC5A7142D7354D878782
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ee489a6c4b47555e3eac629fd848351b2025f1ef37826939c642c9c0ad5cbf1f
      • Instruction ID: 4074bfa718abe6e285b4df5fcde6f92c6b17f19e3227f1cbc6f76248b6af3c76
      • Opcode Fuzzy Hash: ee489a6c4b47555e3eac629fd848351b2025f1ef37826939c642c9c0ad5cbf1f
      • Instruction Fuzzy Hash: 73514772A0039ADFDF308E688DE43D633B7AF56790F86021ACDCA57645C3315989CA82
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: d5d7c18a0fff2385339d2b739a3c507285ad1894271b6e7800ad8b03d5cb6a87
      • Instruction ID: de2ab6d5fdfbb4b051207300807774ef8f94be8052601b2cb15d6bb3f9d2c137
      • Opcode Fuzzy Hash: d5d7c18a0fff2385339d2b739a3c507285ad1894271b6e7800ad8b03d5cb6a87
      • Instruction Fuzzy Hash: FB515875A40349CFDF305E78CDE83DA37A3AF56360FD5411ADC8A4B145E7398A868B42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 0e5c4f96ba50818130a0ff3359dfcdfbc4053b88991f36e73f778504d77412af
      • Instruction ID: 17d27505b1ada1b0ce1cc6db57355704d62840df096f9d6d2d9e6c4753e9bfc2
      • Opcode Fuzzy Hash: 0e5c4f96ba50818130a0ff3359dfcdfbc4053b88991f36e73f778504d77412af
      • Instruction Fuzzy Hash: 95517D72A0439ADFDF308E689CE43D673B7AF56790F95011ACDC957605C331598ACB42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 8d23069410db8d83be7b780ffe79c165255cd5a55b9e733ec7e2d97ed5357d2f
      • Instruction ID: 527770328cc98d6e2cd18cd76a919e547f695c40af1eeb7ab5c148d401077d7e
      • Opcode Fuzzy Hash: 8d23069410db8d83be7b780ffe79c165255cd5a55b9e733ec7e2d97ed5357d2f
      • Instruction Fuzzy Hash: 715138129587814EDB258A7D9DA83DB7FA3FF46220F48425FCEA34B196D31945C8DB02
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: d485ca524a984cffb0207885dd0c9c14ed3cb6a4fb3bbecc070f6e4d33479105
      • Instruction ID: f29d58d466cae4573b4704c348f81081439bb1d5c699b7e5ddaf49486d19edf2
      • Opcode Fuzzy Hash: d485ca524a984cffb0207885dd0c9c14ed3cb6a4fb3bbecc070f6e4d33479105
      • Instruction Fuzzy Hash: 6241AC32A043029FEB20AE7488A63DF77E6AF87390F6A451EDCC5E7151D7354C868742
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 300ce21116445724027b3ebb73e247794f9ff3609538b4f5c46568bc530aa8c2
      • Instruction ID: da862d58b3294f3f9f21f0cd4932013a7b3284d5c26f2b3bd45b4ae2b3c443bc
      • Opcode Fuzzy Hash: 300ce21116445724027b3ebb73e247794f9ff3609538b4f5c46568bc530aa8c2
      • Instruction Fuzzy Hash: F441CD315403855BDF308E3889A47CE7BA36F13360F99821ACCE66F289D3394987CB52
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: d65b5dcb4f77218d968f425d77555f0871960f7fa584df81678d23c22a59d030
      • Instruction ID: 116a4317ad46c6040120494e9cca8c90e1fc478779efe83190325fcf3bd766c9
      • Opcode Fuzzy Hash: d65b5dcb4f77218d968f425d77555f0871960f7fa584df81678d23c22a59d030
      • Instruction Fuzzy Hash: 37315638A417049FEB305E7498D8BEB77A7AF86384F85452ECDD687156C7329988C702
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 680e6f31e9d529afc3ec35cb828ca6f345cd60da11720fa5492a9d2775cf172e
      • Instruction ID: 378ad2736704e4dd66cb7a5f4da00d9dc6d1bb17e123026207959c7775ea40e0
      • Opcode Fuzzy Hash: 680e6f31e9d529afc3ec35cb828ca6f345cd60da11720fa5492a9d2775cf172e
      • Instruction Fuzzy Hash: 3F411735A003958FDF349E698AD87C673A66F68360F82013BCD4A9B214D739D9C1CA82
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 77cb07073d0ce90826561d3840608ce827d3892a6c0842e3d86c8c9e16ad69e2
      • Instruction ID: 2bc3b652a13d4824ed0044d9033e8548ef4c3c7d93f1f368408fd742932af679
      • Opcode Fuzzy Hash: 77cb07073d0ce90826561d3840608ce827d3892a6c0842e3d86c8c9e16ad69e2
      • Instruction Fuzzy Hash: CE314C756083569BDF318E344DE47DABBD39F52310F958229CC8AEB145C3358982CB12
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4c0a1787f742d5d4c107c2e3f8fda0ab0989846a2eb77bad9d2e4d4196a597cb
      • Instruction ID: b274edb2572b47884f0f5b6d3b07caaeba8f3f9afb7b940956ba2580bb150ae5
      • Opcode Fuzzy Hash: 4c0a1787f742d5d4c107c2e3f8fda0ab0989846a2eb77bad9d2e4d4196a597cb
      • Instruction Fuzzy Hash: 2F313638A507048FEB201D7499D87E777A7AF8A384F85442ECDD687156C73299C8D743
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: a5063904620c98dfcc3c0bf41543676761647495c99116c3b5d89d1973d0f232
      • Instruction ID: 2bbe8214d29f35322cf87ef6c95601d7084225cf17debc489a6d226ad8ed4e05
      • Opcode Fuzzy Hash: a5063904620c98dfcc3c0bf41543676761647495c99116c3b5d89d1973d0f232
      • Instruction Fuzzy Hash: BD2107B234034A8FDB245D688DF57DB77A7AF95780F86003EDCC6CB650D73689898602
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ce991e35f1a9bd833e5b454c94c818a263166677d12532abd4c04811f9f7c36f
      • Instruction ID: 2560477ac794861215de5708ea9104b7e578e1453839f8638d897afe1a63248f
      • Opcode Fuzzy Hash: ce991e35f1a9bd833e5b454c94c818a263166677d12532abd4c04811f9f7c36f
      • Instruction Fuzzy Hash: E221C9716047558FCB21CE28C9C8BDA73A1BF5A7A0F624069ED8EDB212D638DC42CA40
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4679623a5882ac042a9e9fb4559aa6f9165e92fafbecdc1e02fbffe88da4239a
      • Instruction ID: 31b46e84a7583682a3be4322d87489ddfdfb8559f5686af5ec1e39b78dc21bdf
      • Opcode Fuzzy Hash: 4679623a5882ac042a9e9fb4559aa6f9165e92fafbecdc1e02fbffe88da4239a
      • Instruction Fuzzy Hash: 17018CBD1043CA9EDF716F148A113C93772DF237A0F448011AD981B646EB390B83DB14
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 570ca516d0f3295c798aeee026698e16d26a887795c7fc01de4104a18d016740
      • Instruction ID: c348e60c29a638a00e5b6f419ec9d03cba2acfd3faa78c60b6be078fb4b9c610
      • Opcode Fuzzy Hash: 570ca516d0f3295c798aeee026698e16d26a887795c7fc01de4104a18d016740
      • Instruction Fuzzy Hash: 47C08C9E2180520AAA6404BC870438868923F866A0FE1832BA8ABC188CD346CA802004
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: bb2462e4de9505d3511d1a4d710172339ea7753514a19ba10f5e17b152ea6970
      • Instruction ID: 927424167c8bae3de6d813f9bcee0ae78b094b16a951d7488dc683e1cdab2436
      • Opcode Fuzzy Hash: bb2462e4de9505d3511d1a4d710172339ea7753514a19ba10f5e17b152ea6970
      • Instruction Fuzzy Hash: 28C092F32404858FEF02DB08C4B1B8173A1FB25B48FC804D0E043CB712C224ED10CA04
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1183771496.0000000000760000.00000040.00000001.sdmp, Offset: 00760000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 82934a0310a2214c98bbe70eed3f027ff73084bc482b8f2c52108c50f26ce7bd
      • Instruction ID: 7eb7d87ecf377e2d5496f786f5b937309c9449415add9b5aaa1200306207cbd7
      • Opcode Fuzzy Hash: 82934a0310a2214c98bbe70eed3f027ff73084bc482b8f2c52108c50f26ce7bd
      • Instruction Fuzzy Hash: B0B092312106448FCA41CE08C2A0F8173A4BB15A80B014480E8408BB12E324E900CA00
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 004184BD
      • __vbaStrCopy.MSVBVM60 ref: 004184C5
      • #696.MSVBVM60(004122A0), ref: 004184CC
      • __vbaEnd.MSVBVM60 ref: 004184D8
      • __vbaStrComp.MSVBVM60(00000000,004122A0,004122A8), ref: 004184E9
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 0041850C
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041852B
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412090,00000060), ref: 0041854B
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00418564
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041857D
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000138), ref: 004185A3
      • __vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 004185BB
      • __vbaHresultCheckObj.MSVBVM60(00000000,0078E8C4,0041202C,00000044), ref: 00418686
      • __vbaLateIdSt.MSVBVM60(?,00000000), ref: 004186BD
      • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004186CD
      • __vbaFreeVar.MSVBVM60 ref: 004186D9
      • __vbaFreeObj.MSVBVM60(00418728), ref: 00418711
      • __vbaFreeStr.MSVBVM60 ref: 00418720
      • __vbaFreeStr.MSVBVM60 ref: 00418725
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresultNew2$Copy$#696CompLateList
      • String ID: P8$Pieters7
      • API String ID: 1409344031-1329687432
      • Opcode ID: 1b26cad1bf18c9ce9cbe3f5dc8a052fb558706b599271dd156a695803359f0f2
      • Instruction ID: 62ba6aa963b469cc081f3f87b7442bbe7404bf9e69c5d52f50b5e26adbaa364e
      • Opcode Fuzzy Hash: 1b26cad1bf18c9ce9cbe3f5dc8a052fb558706b599271dd156a695803359f0f2
      • Instruction Fuzzy Hash: 3D912970A002089FCB10DFA9C949ADDBBF5FF48300F20816AE549E7265D7759982CF99
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60 ref: 00418BC3
      • __vbaStrCopy.MSVBVM60 ref: 00418BCB
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00418BE0
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00418BFF
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001FC), ref: 00418C44
      • __vbaFreeObj.MSVBVM60 ref: 00418C4D
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00418C66
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00418C7F
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001FC), ref: 00418CBB
      • __vbaFreeObj.MSVBVM60 ref: 00418CC4
      • #538.MSVBVM60(?,000007DB,0000000B,0000000B), ref: 00418CD7
      • #557.MSVBVM60(?), ref: 00418CE1
      • __vbaFreeVar.MSVBVM60 ref: 00418CF8
      • __vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 00418D1A
      • __vbaHresultCheckObj.MSVBVM60(00000000,0078E8C4,0041202C,0000001C), ref: 00418D3F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,00000060), ref: 00418D85
      • __vbaFreeObj.MSVBVM60 ref: 00418D8E
      • __vbaFreeStr.MSVBVM60(00418DCE), ref: 00418DC6
      • __vbaFreeStr.MSVBVM60 ref: 00418DCB
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresult$New2$Copy$#538#557
      • String ID: underdrawing
      • API String ID: 1171355408-3776199456
      • Opcode ID: ac378ef37b1611ed77664ea8631ebee77874710bed7b005c2ab2892e3d68627b
      • Instruction ID: 12ef39c3fff4f039e9a7e5cfddc494da88d07230f9bb98ebab5ffb2591b11c19
      • Opcode Fuzzy Hash: ac378ef37b1611ed77664ea8631ebee77874710bed7b005c2ab2892e3d68627b
      • Instruction Fuzzy Hash: BC616F70A012099BDB14DF64DE49ADABBB8FF4C700F10852AF545F72A4DB74A941CB98
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004187B2
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 004187CB
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001EC), ref: 0041881F
      • __vbaFreeObj.MSVBVM60 ref: 0041882C
      • __vbaVarDup.MSVBVM60 ref: 00418846
      • #522.MSVBVM60(?,?), ref: 00418854
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 00418870
      • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00418883
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401318,00411820,0000015C), ref: 004188B1
      • __vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 004188C6
      • __vbaHresultCheckObj.MSVBVM60(00000000,0078E8C4,0041202C,00000014), ref: 004188EB
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,004122F8,000000F0), ref: 00418911
      • __vbaStrMove.MSVBVM60 ref: 00418920
      • __vbaFreeObj.MSVBVM60 ref: 00418929
      • __vbaFreeStr.MSVBVM60(0041896A), ref: 00418963
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckFreeHresult$New2$#522ListMove
      • String ID: Burrfishes4
      • API String ID: 3040920094-690263893
      • Opcode ID: 4d8c6a2bdb0a1eedfab9301605eefc3b8431c6ead804edf16549d00011ab3095
      • Instruction ID: a7bb6a4fdada2a73822dcc5310ec233baa06be4840b43003059890336c6abcdf
      • Opcode Fuzzy Hash: 4d8c6a2bdb0a1eedfab9301605eefc3b8431c6ead804edf16549d00011ab3095
      • Instruction Fuzzy Hash: 5C514B70900219DFDB10DFA4DD88EEEBBB8FB48704F10812AF545A7251DBB89945CBA9
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #574.MSVBVM60(?), ref: 004128E0
      • __vbaStrMove.MSVBVM60 ref: 004128EB
      • __vbaStrCmp.MSVBVM60(00411FE0,00000000), ref: 004128F7
      • __vbaFreeStr.MSVBVM60 ref: 0041290A
      • __vbaFreeVar.MSVBVM60 ref: 00412913
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00412935
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041294E
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000050), ref: 0041296F
      • __vbaLateMemCall.MSVBVM60(?,MMau2W253,00000003), ref: 004129E7
      • __vbaFreeObj.MSVBVM60 ref: 004129F3
      • __vbaFreeVar.MSVBVM60 ref: 004129FC
      • __vbaFreeObj.MSVBVM60(00412A36), ref: 00412A2F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$#574CallCheckHresultLateMoveNew2
      • String ID: KEY$MMau2W253
      • API String ID: 3816854681-3840626317
      • Opcode ID: 3e15cfdf36cb7364a2bc7900b1a58cfb9718d71049091d99f992b34ccefc1afb
      • Instruction ID: 1015ac91359bd35fd01a11c9c079a71c340cd102382ba304f892b694d079a712
      • Opcode Fuzzy Hash: 3e15cfdf36cb7364a2bc7900b1a58cfb9718d71049091d99f992b34ccefc1afb
      • Instruction Fuzzy Hash: 4B4127B4D002159FCB14DFA8DA89A9EFBF8FF48700F20812AE945E7260D7746941CF98
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 004189E9
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00418A02
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000108), ref: 00418A29
      • __vbaVarErrI4.MSVBVM60(?,?), ref: 00418A38
      • #559.MSVBVM60(00000000), ref: 00418A3F
      • __vbaFreeObj.MSVBVM60 ref: 00418A5B
      • __vbaFreeVar.MSVBVM60 ref: 00418A60
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401328,00411820,00000254), ref: 00418A8B
      • __vbaNew2.MSVBVM60(00410F04,0041A010), ref: 00418AA4
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00418ABD
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000120), ref: 00418AE4
      • #561.MSVBVM60(?), ref: 00418AFB
      • __vbaFreeObj.MSVBVM60 ref: 00418B11
      • __vbaFreeVar.MSVBVM60 ref: 00418B16
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401328,00411850,00000718), ref: 00418B3A
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckFreeHresult$New2$#559#561
      • String ID:
      • API String ID: 2912427131-0
      • Opcode ID: f27e54a9d58687236d9ab59e0347ec16e5d4cc3e23ac1c416d69af69af649d06
      • Instruction ID: a0ba9a0b20591dea56a5ae5ebb364d054225ccfcd6307a88b86851352a92a5f1
      • Opcode Fuzzy Hash: f27e54a9d58687236d9ab59e0347ec16e5d4cc3e23ac1c416d69af69af649d06
      • Instruction Fuzzy Hash: 5A515075A01205AFC714DFA4CD89EEEBBB8FF08741F10453EF545A31A0DB7898858B68
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #671.MSVBVM60(00000000,00000000,00000000,40000000,00000000,40000000), ref: 00412BC5
      • __vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401366), ref: 00412BCB
      • __vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 00412BF4
      • __vbaHresultCheckObj.MSVBVM60(00000000,0078E8C4,0041202C,0000001C), ref: 00412C19
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,0000005C), ref: 00412C5D
      • __vbaStrMove.MSVBVM60 ref: 00412C70
      • __vbaFreeObj.MSVBVM60 ref: 00412C79
      • __vbaFreeStr.MSVBVM60(00412CA4), ref: 00412C9D
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckFreeHresult$#671MoveNew2
      • String ID:
      • API String ID: 3127194502-0
      • Opcode ID: 268449db73bf51c5297fc95b3b9b40202ebac656c7b498d65c9859291dc7bb87
      • Instruction ID: 07cbd5ae98b011e4113b84311ab6838082af34dbc78f5c7f6a8ccb5f9299c35b
      • Opcode Fuzzy Hash: 268449db73bf51c5297fc95b3b9b40202ebac656c7b498d65c9859291dc7bb87
      • Instruction Fuzzy Hash: 24318E70900205EBCB14DF55DE49FAFBBB8FF58740F10802AE641B72A4D7785951CBA9
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418E4C
      • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418E54
      • __vbaNew2.MSVBVM60(00410F04,0041A010,?,?,?,?,?,?,?,?,?,00401366), ref: 00418E69
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401366), ref: 00418E82
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,0000020C,?,?,?,?,?,?,?,?,?,00401366), ref: 00418EA5
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418EAE
      • __vbaFreeStr.MSVBVM60(00418ED6,?,?,?,?,?,?,?,?,?,00401366), ref: 00418ECE
      • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418ED3
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$Copy$CheckHresultNew2
      • String ID:
      • API String ID: 1874231197-0
      • Opcode ID: 8e51eee8695740f562de032b38e38ff537f76ea76fab40dd8ae3d36abced3bb1
      • Instruction ID: 4a8389e0606d3f966416758fdad0e9f8ffa573dd9b7782cc9bbc7f67e997e55f
      • Opcode Fuzzy Hash: 8e51eee8695740f562de032b38e38ff537f76ea76fab40dd8ae3d36abced3bb1
      • Instruction Fuzzy Hash: A6212C71900219ABCB10DFA4DD49ADEBBB8FF58700F20456AF541E32A1DB78A942CF95
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401366), ref: 00412AA3
      • __vbaNew2.MSVBVM60(00410F04,0041A010,?,?,?,?,?,?,?,?,00401366), ref: 00412ABC
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401366), ref: 00412AD5
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000208,?,?,?,?,?,?,?,?,00401366), ref: 00412AF8
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401366), ref: 00412B01
      • __vbaFreeStr.MSVBVM60(00412B22,?,?,?,?,?,?,?,?,00401366), ref: 00412B1B
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckCopyHresultNew2
      • String ID:
      • API String ID: 4138333463-0
      • Opcode ID: b34c4b9eb1990f08a8507f5c352d460869cf7109106a1ea5e361a189e78e4a3f
      • Instruction ID: da92ea17a83bed87ae2f79cfa3c97cb038bdbc0a501b99b45eb503c4cf0c0e7b
      • Opcode Fuzzy Hash: b34c4b9eb1990f08a8507f5c352d460869cf7109106a1ea5e361a189e78e4a3f
      • Instruction Fuzzy Hash: 13114F70900205ABCB10DF94CE49AEEBFB8FF58740F104426F541E72A1C778A592CB95
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,00401366), ref: 00418403
      • #615.MSVBVM60(?,?,?,?,?,?,?,00401366), ref: 00418409
      • __vbaFreeStr.MSVBVM60(00418425), ref: 0041841E
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1183581263.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1183574938.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183597749.000000000041A000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1183604356.000000000041B000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$#615CopyFree
      • String ID: ;\q
      • API String ID: 674679529-3866329233
      • Opcode ID: f4e5b40e26294b43f988e91edeb4b11327b004f8e519b56e791cdb9631fbbfca
      • Instruction ID: 3bbe365c4abe7951e0c5d9729e27019f2611bc70255426ebf2868fcb2884961f
      • Opcode Fuzzy Hash: f4e5b40e26294b43f988e91edeb4b11327b004f8e519b56e791cdb9631fbbfca
      • Instruction Fuzzy Hash: E1F0E7B4D00259EBCB00DFA8CA49A9EBBB8FB08B04F10816AF901B3660D7785905CF94
      Uniqueness

      Uniqueness Score: -1.00%