Play interactive tour

Edit tour

Windows Analysis Report BANK DETAILS.exe

Overview

General Information

Sample Name:	BANK DETAILS.exe
Analysis ID:	458685
MD5:	37ecfc300780ade05b85fc969675e415
SHA1:	4874e705a0a075997da7d7bd8cf6f8608376600a
SHA256:	552db26bdd2347a216bb88e706ebf2bc9a145c8a5d38d082c53dcdd2f344c162
Tags:	batexe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

BANK DETAILS.exe (PID: 5636 cmdline: 'C:\Users\user\Desktop\BANK DETAILS.exe' MD5: 37ECFC300780ADE05B85FC969675E415)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI"}

Multi AV Scanner detection for submitted file

Show sources

Source: BANK DETAILS.exe	Virustotal: Detection: 19%			Perma Link
Source: BANK DETAILS.exe	ReversingLabs: Detection: 15%

Source: BANK DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1xfZvLwUHsJmtVI

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02136F5D NtAllocateVirtualMemory,		0_2_02136F5D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02137139 NtAllocateVirtualMemory,		0_2_02137139

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02136F5D	0_2_02136F5D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130612	0_2_02130612
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A015	0_2_0213A015
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135404	0_2_02135404
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135608	0_2_02135608
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02133A0C	0_2_02133A0C
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131030	0_2_02131030
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02137639	0_2_02137639
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A63F	0_2_0213A63F
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213163E	0_2_0213163E
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213682A	0_2_0213682A
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213325B	0_2_0213325B
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02139C43	0_2_02139C43
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213AE73	0_2_0213AE73
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135479	0_2_02135479
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213B878	0_2_0213B878
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213147F	0_2_0213147F
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213586F	0_2_0213586F
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A896	0_2_0213A896
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213B699	0_2_0213B699
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130E85	0_2_02130E85
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213B4B1	0_2_0213B4B1
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021398DA	0_2_021398DA
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021342D8	0_2_021342D8
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134EC9	0_2_02134EC9
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02132ECF	0_2_02132ECF
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021396F1	0_2_021396F1
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021346FA	0_2_021346FA
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130EFC	0_2_02130EFC
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A4ED	0_2_0213A4ED
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02139D11	0_2_02139D11
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213911A	0_2_0213911A
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213651A	0_2_0213651A
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02136F07	0_2_02136F07
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213B30C	0_2_0213B30C
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130B35	0_2_02130B35
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F35	0_2_02130F35
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135335	0_2_02135335
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02139738	0_2_02139738
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A53D	0_2_0213A53D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02132F27	0_2_02132F27
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02132129	0_2_02132129
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02132546	0_2_02132546
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213AB46	0_2_0213AB46
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F49	0_2_02130F49
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213416B	0_2_0213416B
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213976C	0_2_0213976C
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130791	0_2_02130791
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131599	0_2_02131599
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F98	0_2_02130F98
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131782	0_2_02131782
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02133185	0_2_02133185
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134F8D	0_2_02134F8D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD	0_2_0213A1CD
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213B3B7	0_2_0213B3B7
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021341BA	0_2_021341BA
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135FB8	0_2_02135FB8
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134BA2	0_2_02134BA2
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021315D3	0_2_021315D3
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021307D2	0_2_021307D2
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021325C4	0_2_021325C4
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD	0_2_0213A1CD
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021331F5	0_2_021331F5
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021325E2	0_2_021325E2
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02138BE6	0_2_02138BE6

Source: BANK DETAILS.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: BANK DETAILS.exe, 00000000.00000002.1308709099.00000000020C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs BANK DETAILS.exe
Source: BANK DETAILS.exe, 00000000.00000000.220585259.000000000041B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMeloplasttyskl2.exe vs BANK DETAILS.exe
Source: BANK DETAILS.exe, 00000000.00000002.1308835835.0000000002180000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMeloplasttyskl2.exeFE2Xee vs BANK DETAILS.exe
Source: BANK DETAILS.exe	Binary or memory string: OriginalFilenameMeloplasttyskl2.exe vs BANK DETAILS.exe

Source: BANK DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\BANK DETAILS.exe

File created: C:\Users\user\AppData\Local\Temp\~DF0AA8BB7106EF905B.TMP

Jump to behavior

Source: BANK DETAILS.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BANK DETAILS.exe	Virustotal: Detection: 19%
Source: BANK DETAILS.exe	ReversingLabs: Detection: 15%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_00412CC0 push dword ptr [ebp-14h]; ret	0_2_00414DE8
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_00404460 pushfd ; ret	0_2_00404475
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_004045EE push cs; iretd	0_2_00404609
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0040428E push ds; iretd	0_2_0040429A

Source: initial sample

Static PE information: section name: .text entropy: 6.81210830027

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02136F5D NtAllocateVirtualMemory,	0_2_02136F5D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130612	0_2_02130612
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135404	0_2_02135404
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135608	0_2_02135608
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02133A0C	0_2_02133A0C
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131030	0_2_02131030
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02137639	0_2_02137639
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213163E	0_2_0213163E
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213682A	0_2_0213682A
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213AE73	0_2_0213AE73
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135479	0_2_02135479
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213147F	0_2_0213147F
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02132066	0_2_02132066
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130E85	0_2_02130E85
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134EC9	0_2_02134EC9
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021346FA	0_2_021346FA
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130EFC	0_2_02130EFC
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02136F07	0_2_02136F07
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130B35	0_2_02130B35
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F35	0_2_02130F35
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02135335	0_2_02135335
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F49	0_2_02130F49
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131599	0_2_02131599
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02130F98	0_2_02130F98
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02131782	0_2_02131782
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134F8D	0_2_02134F8D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD	0_2_0213A1CD
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02134BA2	0_2_02134BA2
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021315D3	0_2_021315D3
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD	0_2_0213A1CD
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02138BE6	0_2_02138BE6

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002136F8A second address: 0000000002136F8A instructions:
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002139377 second address: 0000000002139377 instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002136F8A second address: 0000000002136F8A instructions:
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002139479 second address: 00000000021394C2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov eax, dword ptr fs:[00000030h] 0x00000009 mov eax, dword ptr [eax+0Ch] 0x0000000c mov eax, dword ptr [eax+14h] 0x0000000f test al, cl 0x00000011 mov ecx, dword ptr [eax] 0x00000013 mov eax, ecx 0x00000015 cmp ebx, eax 0x00000017 jmp 00007F2CCC39AE9Bh 0x00000019 test bx, bx 0x0000001c mov ebx, dword ptr [eax+28h] 0x0000001f mov dword ptr [ebp+00000277h], ebx 0x00000025 mov ebx, EFC24E89h 0x0000002a pushad 0x0000002b mov edi, 00000074h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002139377 second address: 0000000002139377 instructions:
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 00000000021370DF second address: 0000000002137117 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 xor edi, 4F0B01ABh 0x00000009 cmp ch, ah 0x0000000b push edi 0x0000000c cmp bx, bx 0x0000000f mov edi, dword ptr [ebp+00000203h] 0x00000015 cmp ah, 00000001h 0x00000018 test ecx, ebx 0x0000001a mov dword ptr [ebp+00000148h], 00000000h 0x00000024 add ebx, 04h 0x00000027 mov dword ptr [ebp+0000024Ah], eax 0x0000002d cmp ch, FFFFFFDAh 0x00000030 mov eax, ebx 0x00000032 pushad 0x00000033 mov ecx, 00000042h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 000000000213B44E second address: 0000000002139479 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F2CCC9A9EE0h 0x00000008 test dl, dl 0x0000000a pushad 0x0000000b test bh, ah 0x0000000d cmp cl, bl 0x0000000f push 92D68FDCh 0x00000014 call 00007F2CCC9AA816h 0x00000019 pushad 0x0000001a mov edi, 00000045h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 00000000021366CF second address: 00000000021367B7 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp cx, 8B05h 0x00000008 mov dword ptr [ebp+00000212h], edi 0x0000000e test bh, dh 0x00000010 mov edi, ecx 0x00000012 push edi 0x00000013 cmp ecx, edx 0x00000015 mov edi, dword ptr [ebp+00000212h] 0x0000001b cmp bl, bl 0x0000001d test esi, 5BD1BFCAh 0x00000023 call 00007F2CCC39AF3Dh 0x00000028 call 00007F2CCC39AEAEh 0x0000002d lfence 0x00000030 mov edx, C7DAD013h 0x00000035 add edx, 5901ADA8h 0x0000003b xor edx, 770150F3h 0x00000041 xor edx, 28232D5Ch 0x00000047 mov edx, dword ptr [edx] 0x00000049 lfence 0x0000004c ret 0x0000004d mov esi, edx 0x0000004f pushad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 00000000021367B7 second address: 0000000002136703 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 27269D29h 0x00000007 xor eax, A18D231Eh 0x0000000c xor eax, 1CE799B1h 0x00000011 sub eax, 9A4C2785h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F2CCC9AB37Dh 0x0000001e lfence 0x00000021 mov edx, C7DAD013h 0x00000026 add edx, 5901ADA8h 0x0000002c xor edx, 770150F3h 0x00000032 xor edx, 28232D5Ch 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 cmp esi, C7A87762h 0x00000047 pushad 0x00000048 mov eax, 00000008h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002136703 second address: 0000000002136745 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 pop ecx 0x00000004 cmp cx, E7B5h 0x00000009 add edi, edx 0x0000000b test bh, dh 0x0000000d dec ecx 0x0000000e mov dword ptr [ebp+0000024Eh], 76D68B9Dh 0x00000018 cmp ecx, edx 0x0000001a xor dword ptr [ebp+0000024Eh], 83B81CB0h 0x00000024 cmp bl, bl 0x00000026 test esi, 7FF4DB34h 0x0000002c xor dword ptr [ebp+0000024Eh], A8C87E56h 0x00000036 cmp esi, 10940B3Dh 0x0000003c pushad 0x0000003d mov eax, 00000064h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\BANK DETAILS.exe	RDTSC instruction interceptor: First address: 0000000002136745 second address: 00000000021367B7 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 xor dword ptr [ebp+0000024Eh], 5DA6E97Bh 0x0000000d cmp cx, 91C2h 0x00000012 test bh, dh 0x00000014 cmp ecx, dword ptr [ebp+0000024Eh] 0x0000001a jne 00007F2CCC9AB2E3h 0x00000020 cmp cx, 8B05h 0x00000025 mov dword ptr [ebp+00000212h], edi 0x0000002b test bh, dh 0x0000002d mov edi, ecx 0x0000002f push edi 0x00000030 cmp ecx, edx 0x00000032 mov edi, dword ptr [ebp+00000212h] 0x00000038 cmp bl, bl 0x0000003a test esi, 5BD1BFCAh 0x00000040 call 00007F2CCC9AB42Dh 0x00000045 call 00007F2CCC9AB39Eh 0x0000004a lfence 0x0000004d mov edx, C7DAD013h 0x00000052 add edx, 5901ADA8h 0x00000058 xor edx, 770150F3h 0x0000005e xor edx, 28232D5Ch 0x00000064 mov edx, dword ptr [edx] 0x00000066 lfence 0x00000069 ret 0x0000006a mov esi, edx 0x0000006c pushad 0x0000006d rdtsc

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Code function: 0_2_02136F5D rdtsc

0_2_02136F5D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Code function: 0_2_02136F5D rdtsc

0_2_02136F5D

Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02133A0C mov eax, dword ptr fs:[00000030h]	0_2_02133A0C
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02139473 mov eax, dword ptr fs:[00000030h]	0_2_02139473
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213652D mov eax, dword ptr fs:[00000030h]	0_2_0213652D
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213416B mov eax, dword ptr fs:[00000030h]	0_2_0213416B
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD mov eax, dword ptr fs:[00000030h]	0_2_0213A1CD
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_021341BA mov eax, dword ptr fs:[00000030h]	0_2_021341BA
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02138FC0 mov eax, dword ptr fs:[00000030h]	0_2_02138FC0
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_02133DC6 mov eax, dword ptr fs:[00000030h]	0_2_02133DC6
Source: C:\Users\user\Desktop\BANK DETAILS.exe	Code function: 0_2_0213A1CD mov eax, dword ptr fs:[00000030h]	0_2_0213A1CD

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: BANK DETAILS.exe, 00000000.00000002.1308437695.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: BANK DETAILS.exe, 00000000.00000002.1308437695.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: BANK DETAILS.exe, 00000000.00000002.1308437695.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: BANK DETAILS.exe, 00000000.00000002.1308437695.0000000000C40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\BANK DETAILS.exe

Code function: 0_2_02132C11 cpuid

0_2_02132C11

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery311	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BANK DETAILS.exe	19%	Virustotal		Browse
BANK DETAILS.exe	15%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458685
Start date:	03.08.2021
Start time:	16:52:33
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BANK DETAILS.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Suspected Instruction Hammering Hide Perf
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 16.5% (good quality ratio 5.7%) Quality average: 22.8% Quality standard deviation: 31.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, taskhostw.exe, RuntimeBroker.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.475587408087338
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BANK DETAILS.exe
File size:	114688
MD5:	37ecfc300780ade05b85fc969675e415
SHA1:	4874e705a0a075997da7d7bd8cf6f8608376600a
SHA256:	552db26bdd2347a216bb88e706ebf2bc9a145c8a5d38d082c53dcdd2f344c162
SHA512:	4d0c2b9d0ce56400facd5955186441a62cde232db721584c1b97972fb133480e6d7a3b90daf01ce664b3b9e5216e25b548aeab014d20d3ec31555eb3504c831e
SSDEEP:	1536:UMxYU0ZIKPzkNY55AngpUS9UjoAXQXlIKUc3tsVHmwL+:lxYU0Z5PzYY557ORAVIxcKu
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......K..................... ......0.............@................

File Icon


Icon Hash:	f67aedf6d0c0f98c

Static PE Info

General
Entrypoint:	0x401530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4B958B80 [Mon Mar 8 23:42:56 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b28b105866cd7f6746798ef93a2371be

Entrypoint Preview

Instruction
push 00410B8Ch
call 00007F2CCC9E59B3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bl, ah
int3
lds edi, ebp
xor ebp, dword ptr [edi+4Dh]
mov dl, FDh
test dword ptr [ecx-7CC23EBFh], 00000000h
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
push eax
jc 00007F2CCC9E5A31h
push 00000065h
arpl word ptr [ebp+esi+00h], si
mov al, byte ptr [00000059h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or dl, byte ptr [edx]
test byte ptr [ebx+eax*8-2Fh], 0000004Eh
inc eax
dec ebx
xchg eax, edx
or bh, byte ptr [ebp+14h]
clc
out dx, al
jmp 00007F2C632FC761h
add dword ptr [eax], edi
mov dword ptr [8EBF45C1h], eax
mov esp, 499C14E2h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub ch, dh
add byte ptr [eax], al
nop
add byte ptr [eax], al
add byte ptr [esi], cl
add byte ptr [ecx+edi*2+6Bh], al
imul esp, dword ptr [ebp+72h], 75h
outsb
jnc 00007F2CCC9E5A25h
jne 00007F2CCC9E5A2Fh
insd
cmp dword ptr [eax], eax
or eax, 53000801h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18f04	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1b000	0xfde	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x138	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1843c	0x19000	False	0.49474609375	data	6.81210830027	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1a000	0xb68	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1b000	0xfde	0x1000	False	0.3896484375	data	4.19517055589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1b916	0x6c8	data
RT_ICON	0x1b3ae	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1b38c	0x22	data
RT_VERSION	0x1b120	0x26c	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaVarErrI4, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaStrComp, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	Meloplasttyskl2
FileVersion	1.00
CompanyName	Catalyst
ProductName	Project5
ProductVersion	1.00
FileDescription	Catalyst
OriginalFilename	Meloplasttyskl2.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: BANK DETAILS.exe PID: 5636 Parent PID: 5732

General

Start time:	16:53:30
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\BANK DETAILS.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BANK DETAILS.exe'
Imagebase:	0x400000
File size:	114688 bytes
MD5 hash:	37ECFC300780ADE05B85FC969675E415
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: BANK DETAILS.exe PID: 5636 Parent PID: 5732 BANK DETAILS.exeCOMMON

Executed Functions

Function 02136F5D, Relevance: 1.7, APIs: 1, Instructions: 182memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-B4650570,?,-8BECC682), ref: 0213720D

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 235767ae69987f0e28ce75002f3888e69ed08516e4de99775cfd6afa2aeb1ed2
Instruction ID: 944bc6ca62d8cd66fc4bb7c7dc7a235f3f66181982552a841f3c6ad03e7c3963
Opcode Fuzzy Hash: 235767ae69987f0e28ce75002f3888e69ed08516e4de99775cfd6afa2aeb1ed2
Instruction Fuzzy Hash: 305158B13403458FEB354E648DA47DF36A7AF4A350F91003DED8A9B245D374CA8A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 02137139, Relevance: 1.6, APIs: 1, Instructions: 134memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-B4650570,?,-8BECC682), ref: 0213720D

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 1495b3dab2e2499ea5ede4dd7b84d1460d8382e29411de7d0c82b60514e88f54
Instruction ID: af8f7ad8d003822a97aec5003d17fa600b383d8798a839110e8d416a45a788d0
Opcode Fuzzy Hash: 1495b3dab2e2499ea5ede4dd7b84d1460d8382e29411de7d0c82b60514e88f54
Instruction Fuzzy Hash: FF41F3634887814BDB278A6D9D587CABB57FF46330F88025BCE660F2E9E32400C18F45

Uniqueness

Uniqueness Score: -1.00%

Function 00412CC0, Relevance: 288.9, APIs: 148, Strings: 16, Instructions: 1910COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401366), ref: 00412CDE
__vbaVarDup.MSVBVM60 ref: 00412D43
#617.MSVBVM60(?,?,00000001), ref: 00412D59
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 00412D81
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00412D9E
__vbaNew2.MSVBVM60(0041203C,0041A41C,?,?,00401366), ref: 00412DD7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041202C,0000001C), ref: 00412E40
__vbaChkstk.MSVBVM60 ref: 00412E7D
__vbaCastObj.MSVBVM60(?,00412070), ref: 00412EB3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412EC1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,00000058), ref: 00412F00
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412F28
#615.MSVBVM60(?,?,00401366), ref: 00412F38
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 00412F96
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00412FC8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413005
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000108), ref: 00413056
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413081
__vbaObjSet.MSVBVM60(?,00000000), ref: 004130BE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,00000188), ref: 0041310F
__vbaStrMove.MSVBVM60 ref: 0041316F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 004131F1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413225
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,00401366), ref: 0041323E
__vbaNew2.MSVBVM60(00410F04,hF,?,?,?,?,?,?,?,?,00401366), ref: 00413261
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041329E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FE8,00000190), ref: 004132EF
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041331A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413357
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000180), ref: 004133A8
__vbaStrCopy.MSVBVM60 ref: 004133F6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 0041347B
__vbaFreeStr.MSVBVM60 ref: 004134A5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004134BB
__vbaNew2.MSVBVM60(00410F04,hF,?,?,?,?,?,?,?,?,?,?,?,00401366), ref: 004134DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041351B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000070), ref: 00413566
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 004135CE
__vbaFreeObj.MSVBVM60 ref: 004135EC
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041360C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413649
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,00000178), ref: 0041369A
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004136C4
__vbaNew2.MSVBVM60(00410F04,hF), ref: 004136E0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041371D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000068), ref: 00413768
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413793
__vbaObjSet.MSVBVM60(?,00000000), ref: 004137D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000180), ref: 00413821
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041384B
__vbaStrVarMove.MSVBVM60(?,67700000,?), ref: 00413889
__vbaStrMove.MSVBVM60 ref: 00413897
__vbaStrVarMove.MSVBVM60(?,?,00000000), ref: 004138AC
__vbaStrMove.MSVBVM60 ref: 004138BA
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004138F8
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413926
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041393F
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413962
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041399F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000120), ref: 004139F0
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413A1B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413A58
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000160), ref: 00413AA9
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00413AD3
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413AEF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B2C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000130), ref: 00413B7D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00413BA7
__vbaStrVarMove.MSVBVM60(00000000), ref: 00413BB1
__vbaStrMove.MSVBVM60 ref: 00413BBF
__vbaI4Var.MSVBVM60(?,00000000), ref: 00413BCD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 00413C0E
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00413C36
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413C64
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00413C7D
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413CA0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413CDD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000178), ref: 00413D2E
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413D59
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413D96
__vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000048), ref: 00413DE1
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413E0C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413E49
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FE8,000000D0), ref: 00413E9A
__vbaStrMove.MSVBVM60 ref: 00413EFA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,000006FC), ref: 00413F84
__vbaFreeStr.MSVBVM60 ref: 00413FAE
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 00413FCB
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00413FEE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041402B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000078), ref: 00414076
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 004140DE
__vbaFreeObj.MSVBVM60 ref: 004140FC
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041411C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414159
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000218), ref: 004141AA
__vbaNew2.MSVBVM60(00410F04,hF), ref: 004141D5
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414212
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000108), ref: 00414263
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041428E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004142CB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,00000058), ref: 00414316
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414341
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041437E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000150), ref: 004143CF
__vbaNew2.MSVBVM60(00410F04,hF), ref: 004143FA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414437
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041200C,000000E0), ref: 00414488
__vbaStrMove.MSVBVM60 ref: 004144D8
__vbaStrMove.MSVBVM60 ref: 00414500
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00414582
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?), ref: 004145B0
__vbaNew2.MSVBVM60(00410F04,hF), ref: 004145D3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414610
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412090,000000A8), ref: 00414661
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 004146BD
__vbaFreeStr.MSVBVM60 ref: 004146DB
__vbaFreeObj.MSVBVM60 ref: 004146E7
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414707
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414744
__vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000068), ref: 0041478F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000708), ref: 004147EB
__vbaFreeObj.MSVBVM60 ref: 00414809
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411850,00000700), ref: 00414864
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414896
__vbaObjSet.MSVBVM60(?,00000000), ref: 004148D3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000190), ref: 00414924
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041494F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041498C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412080,00000138), ref: 004149DD
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414A08
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414A45
__vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000170), ref: 00414A96
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414AC1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414AFE
__vbaHresultCheckObj.MSVBVM60(00000000,?,004120D8,00000178), ref: 00414B4F
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00414B79
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00414B95
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414BD2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412080,00000110), ref: 00414C23
__vbaI4Var.MSVBVM60(?), ref: 00414C42
__vbaStrCopy.MSVBVM60 ref: 00414C65
__vbaStrMove.MSVBVM60 ref: 00414C8D
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00414D19
__vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00414D4E
__vbaFreeVar.MSVBVM60 ref: 00414D5D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411820,000002B4), ref: 00414D9F
__vbaOnError.MSVBVM60(000000FF), ref: 00414DC0

Strings

Orderable7, xrefs: 004147B3
Sclerosarcoma, xrefs: 0041341D
@Z@Z, xrefs: 00414DD0
Udbytninger, xrefs: 00413F26
vapidism, xrefs: 004133EB
hF, xrefs: 00412FB5, 00412FBE, 00412FCE, 00412FDA, 0041306E, 00413077, 00413087, 00413093, 0041324E, 00413257, 00413267, 00413273, 00413307, 00413310, 00413320, 0041332C, 004134CB, 004134D4, 004134E4, 004134F0, 004135F9, 00413602, 00413612, 0041361E, 004136CD, 004136D6, 004136E6, 004136F2, 00413780, 00413789, 00413799, 004137A5, 0041394F, 00413958, 00413968, 00413974, 00413A08, 00413A11, 00413A21, 00413A2D, 00413ADC, 00413AE5, 00413AF5, 00413B01, 00413C8D, 00413C96, 00413CA6, 00413CB2, 00413D46, 00413D4F, 00413D5F, 00413D6B, 00413DF9, 00413E02, 00413E12, 00413E1E, 00413FDB, 00413FE4, 00413FF4, 00414000, 00414109, 00414112, 00414122, 0041412E, 004141C2, 004141CB, 004141DB, 004141E7, 0041427B, 00414284, 00414294, 004142A0, 0041432E, 00414337, 00414347, 00414353, 004143E7, 004143F0, 00414400, 0041440C, 004145C0, 004145C9, 004145D9, 004145E5, 004146F4, 004146FD, 0041470D, 00414719, 00414883, 0041488C, 0041489C, 004148A8, 0041493C, 00414945, 00414955, 00414961, 004149F5, 004149FE, 00414A0E, 00414A1A, 00414AAE, 00414AB7, 00414AC7, 00414AD3, 00414B82, 00414B8B, 00414B9B, 00414BA7
E(., xrefs: 00413F1F, 00413F25
Unaffordable2, xrefs: 0041451E
=C, xrefs: 004133FC
Enebarnet, xrefs: 00414685
x%PK, xrefs: 00412F57, 00412F5D
balzacian, xrefs: 00414531
Bagerbutikkernes1, xrefs: 00414CBE
Nocent, xrefs: 004147A7
., xrefs: 00413ECF
Riddlings, xrefs: 00414C5A

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Move$CallLate$ChkstkCopy$#615#617CastError
String ID: =C$@Z@Z$Bagerbutikkernes1$E(.$Enebarnet$Nocent$Orderable7$Riddlings$Sclerosarcoma$Udbytninger$Unaffordable2$balzacian$hF$vapidism$x%PK$.
API String ID: 1246614005-2195407785
Opcode ID: 7f08eda41299bc58bb635363a9f9a599bdb8379cf2bc6f4e04a58c6ed5225732
Instruction ID: dae1eb49fdea69225c34350a54b9c45d9573d66810e8b3b086e076fe3bfe1c13
Opcode Fuzzy Hash: 7f08eda41299bc58bb635363a9f9a599bdb8379cf2bc6f4e04a58c6ed5225732
Instruction Fuzzy Hash: CF1318B5A01228EFDB20CF50CD88FDAB7B5BB49301F1085DAE64AA7250CB745AC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004038F8, Relevance: 1.4, APIs: 1, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 0040399C

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: df0362a2223331b136a274b003aceee6602823071dd750a2f6212d7a8e182c67
Instruction ID: ce263e2532fd9ab1be0a35eacc56f1c1025c002995cc3ae37756b279582709be
Opcode Fuzzy Hash: df0362a2223331b136a274b003aceee6602823071dd750a2f6212d7a8e182c67
Instruction Fuzzy Hash: 85418B6660F102F6EE110D24844447ABE6C9E3177B76046BBD892F91C2977E13C3976F

Uniqueness

Uniqueness Score: -1.00%

Function 00403933, Relevance: 1.4, APIs: 1, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 0040399C

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3aec941c677451215bc16f60cdfd4b3495ebd2b45e618f3ec837076193f62438
Instruction ID: 7fa4739af788cc185d4e1273fa6314e49cf947aa914a22ba22407b33d9252354
Opcode Fuzzy Hash: 3aec941c677451215bc16f60cdfd4b3495ebd2b45e618f3ec837076193f62438
Instruction Fuzzy Hash: B141526660F602FAEC010D28444447ABD2C9E25B7B3B086B7D893F51C25A7E17C3676F

Uniqueness

Uniqueness Score: -1.00%

Function 00403967, Relevance: 1.4, APIs: 1, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 0040399C

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0773c2fdfdbc02948faa280dc643a9b584ef93d107022aea3334da4da78f3acb
Instruction ID: ad43d10602fc9b878ed47bc757c174d3c3e33b0088785a3c8d0718843dc404d2
Opcode Fuzzy Hash: 0773c2fdfdbc02948faa280dc643a9b584ef93d107022aea3334da4da78f3acb
Instruction Fuzzy Hash: CE31316660F601FAED010D28844447ABD2C9D2177B3B086B7D897F91C29A7E27C3676F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0213A1CD, Relevance: 16.6, Strings: 12, Instructions: 1636COMMON

Download Yara Rule

Strings

OY>, xrefs: 0213A51C
# l$, xrefs: 0213A69F
OY>, xrefs: 0213A521
o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
_mZq, xrefs: 0213A1D3
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: OY>$OY>$# l$$=&b$L?Pq$Y%a$_mZq$oS~$y=$o_${>$z
API String ID: 0-3720263133
Opcode ID: e7002a2c6ed27004c7f2134679a7408bbe7019d743632f27c68b5438bf17ff7a
Instruction ID: ec437cd205ef824166aa7b03e98f15115e935f82e73a9c1cad9ca4c6fa5cded3
Opcode Fuzzy Hash: e7002a2c6ed27004c7f2134679a7408bbe7019d743632f27c68b5438bf17ff7a
Instruction Fuzzy Hash: 6BD26A716443868FDF359F38CDA87DA7BA3AF56350F85822ECC898B255D3358586CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02130F49, Relevance: 15.8, Strings: 11, Instructions: 2024COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
::, xrefs: 02131710
{>, xrefs: 021350EB
)m <, xrefs: 0213080F
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <$=&b$L?Pq$Y%a$oS~$rr_c$y=$::$o_${>$z
API String ID: 0-3916315053
Opcode ID: 6992dde763e6c120004ddaec4b82987e779be892dbef90365d933c6221ca7372
Instruction ID: fcc68522963d053899b086c00a5e58f07de2ecb3e42d649793f1d9bea5c6df8a
Opcode Fuzzy Hash: 6992dde763e6c120004ddaec4b82987e779be892dbef90365d933c6221ca7372
Instruction Fuzzy Hash: F1F2757164034A9FDF359E78CDA43DA37A3EF46390F95812ECC899B244D7358A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0213682A, Relevance: 13.7, Strings: 10, Instructions: 1151COMMON

Download Yara Rule

Strings

GH), xrefs: 0213691C
`, xrefs: 02136A0B
o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$Y%a$`$oS~$y=$GH)$o_${>$z
API String ID: 0-1972577462
Opcode ID: 34db06fa33d11c036d3b1b7df1cc2445279e9544e9c1f3b3556a849b5e985c56
Instruction ID: 98345cfdc2ca2d04f89410d424d5a5508ca24f17dd0b9996dafdbf0ce224a972
Opcode Fuzzy Hash: 34db06fa33d11c036d3b1b7df1cc2445279e9544e9c1f3b3556a849b5e985c56
Instruction Fuzzy Hash: 9F9250B164034A9FDF359E38CDA53DA77A3EF45350F95812ECC8A8B244D7318A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0213AE73, Relevance: 12.4, Strings: 9, Instructions: 1174COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
IZO, xrefs: 0213AFEC
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$IZO$L?Pq$Y%a$oS~$y=$o_${>$z
API String ID: 0-1322331030
Opcode ID: a0713c5b89728f38545004667d89d286545278b486b0d3c33b4ebd5ec8eaf88d
Instruction ID: fb42131d304b1bacc70d2a02797cba02abeca505f49c326c7825d57b132d78d3
Opcode Fuzzy Hash: a0713c5b89728f38545004667d89d286545278b486b0d3c33b4ebd5ec8eaf88d
Instruction Fuzzy Hash: 169263B164434A9FDB358E38CD957EA7BA3FF45350F95812EDC8A8B241D7348986CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02133A0C, Relevance: 11.4, Strings: 8, Instructions: 1376COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
API String ID: 0-3445597801
Opcode ID: 4b08e6e3ed9669cfda883e8a5033f82c1ad245d88754cfa88eb87658f8d506c4
Instruction ID: b632ca1422f6303b7de5f1b9bbebed3597056679074fbc2bc1e0d527f58d3f37
Opcode Fuzzy Hash: 4b08e6e3ed9669cfda883e8a5033f82c1ad245d88754cfa88eb87658f8d506c4
Instruction Fuzzy Hash: CFB2517164034A9FDB398E38CDA57DA77A3FF45350F95822DDC8A9B240D7318A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02138BE6, Relevance: 11.2, Strings: 8, Instructions: 1182COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
API String ID: 0-3445597801
Opcode ID: 8ed6c11cce5f9698a15d1e2ea4c38173f4aee12b657d17c6a6fea7baab58c0aa
Instruction ID: 737c3a2ea3cf22aa435e4a43a6235897b2c26536090b70d149073166f28bf93f
Opcode Fuzzy Hash: 8ed6c11cce5f9698a15d1e2ea4c38173f4aee12b657d17c6a6fea7baab58c0aa
Instruction Fuzzy Hash: E3A250B164034A9FDB359E38CDA57DA7BA3FF45350F95812EDC8A9B240D7318A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02134BA2, Relevance: 11.0, Strings: 8, Instructions: 958COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
Y%a, xrefs: 02134C36
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$Y%a$oS~$y=$o_${>$z
API String ID: 0-3445597801
Opcode ID: aef543125fe866d37348b06c299f2a62177adcb50d9849e674c573c22dbbff28
Instruction ID: 3daeedcd9dc03c5457a3907836fe5c615c034781a1cc3cc749fdbb33ca4689b6
Opcode Fuzzy Hash: aef543125fe866d37348b06c299f2a62177adcb50d9849e674c573c22dbbff28
Instruction Fuzzy Hash: A872527164034A9FDB359E38CDA53DA7BA3FF45350F95822DCC8A9B244D7358A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02134EC9, Relevance: 9.5, Strings: 7, Instructions: 781COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$oS~$y=$o_${>$z
API String ID: 0-3307084070
Opcode ID: 9ec941533d658fdee2946a23470a0e883563390d9578562ec6325a0126286fe5
Instruction ID: 60a4c4ab13e26c57df9b4aa590ca2fa7ac435f1a07a1992b26e47ae0675b63df
Opcode Fuzzy Hash: 9ec941533d658fdee2946a23470a0e883563390d9578562ec6325a0126286fe5
Instruction Fuzzy Hash: 0A52417164034A9FDB359E38CD957DA7BA3FF41350F96812ECC8A9B214D3318A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02134F8D, Relevance: 9.5, Strings: 7, Instructions: 738COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
oS~, xrefs: 0213516E
{>, xrefs: 021350EB
y=, xrefs: 021350AA
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$oS~$y=$o_${>$z
API String ID: 0-3307084070
Opcode ID: f1972bf5ee1fdde479f2b1ed96ef00dc4f812d77db369f272c4ded0b91ccb4a0
Instruction ID: c60562db44db2630b389ee0757bfa398fa80e88ba6203fe61c80da5e4ff6b614
Opcode Fuzzy Hash: f1972bf5ee1fdde479f2b1ed96ef00dc4f812d77db369f272c4ded0b91ccb4a0
Instruction Fuzzy Hash: BE52327164034A9FDB359E38CD957DA7BA3FF41350F96812ECC8A9B214D3358A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02135335, Relevance: 5.6, Strings: 4, Instructions: 555COMMON

Download Yara Rule

Strings

o_, xrefs: 02135393
z, xrefs: 021359D2
=&b, xrefs: 02135B9C
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$o_$z
API String ID: 0-2211778076
Opcode ID: b78f637db95ccf38787e4a9ad4cfd088761c8aa0b2a7fc5e5eedea735a4a7567
Instruction ID: 107b017b9269528aaaa6593be78032c11e18dd76b263e7dd126a4cbb002097c1
Opcode Fuzzy Hash: b78f637db95ccf38787e4a9ad4cfd088761c8aa0b2a7fc5e5eedea735a4a7567
Instruction Fuzzy Hash: 0D224371640349EFDF398E38CDA57DA37A3AF45350F92412EDC899B254D7358A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02135404, Relevance: 4.3, Strings: 3, Instructions: 528COMMON

Download Yara Rule

Strings

z, xrefs: 021359D2
=&b, xrefs: 02135B9C
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$z
API String ID: 0-1282955176
Opcode ID: 450bdf541438e1f93b9ff88ac229f0db294920ad4c97149f2e2daa91c7e1e8ba
Instruction ID: 7cfef3feaad33b59a41c4428c744dbfade054a7ba350cfe9367d2a2774715b53
Opcode Fuzzy Hash: 450bdf541438e1f93b9ff88ac229f0db294920ad4c97149f2e2daa91c7e1e8ba
Instruction Fuzzy Hash: EE124371640349DFDF398E28CDA57DA37A3EF45350F96412EDC899B254D7318A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02135479, Relevance: 4.3, Strings: 3, Instructions: 505COMMON

Download Yara Rule

Strings

z, xrefs: 021359D2
=&b, xrefs: 02135B9C
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$z
API String ID: 0-1282955176
Opcode ID: c40d455a215014fa0a71e25ca447c0416c6469d45e4b7f55d978e1e9c818603d
Instruction ID: c761729174ad22aee83cb43f84ce9947d54a4b1e3bb3e48777279f36cbd7de20
Opcode Fuzzy Hash: c40d455a215014fa0a71e25ca447c0416c6469d45e4b7f55d978e1e9c818603d
Instruction Fuzzy Hash: 381242716403499FDF398E38CDA57EA37A3AF45350F92412EDC8A9B244D7358A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02135608, Relevance: 4.2, Strings: 3, Instructions: 451COMMON

Download Yara Rule

Strings

z, xrefs: 021359D2
=&b, xrefs: 02135B9C
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$z
API String ID: 0-1282955176
Opcode ID: 1e5b0b300cd1b07934b0ab03a65391a998ef9374709cd62fe5505b364f048135
Instruction ID: 43e04e42cfbf77057d42fece05f32aaee4458e3d75ff2059b85fdde07c41b7c2
Opcode Fuzzy Hash: 1e5b0b300cd1b07934b0ab03a65391a998ef9374709cd62fe5505b364f048135
Instruction Fuzzy Hash: 91021271644349EFDF3A9E38CDA57DA77A3AF45350F91412EDC898B150D7318A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02135FB8, Relevance: 4.1, Strings: 3, Instructions: 343COMMON

Download Yara Rule

Strings

11l1, xrefs: 0213895D
R141, xrefs: 02138833
#1i1, xrefs: 0213893B

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: #1i1$11l1$R141
API String ID: 0-3388815085
Opcode ID: 39bddfcb86b903b1ba5150ecae159b9b4324f74c7c1ec51e489e2501f4c4b97b
Instruction ID: 0f65f38d110f1bf739dfceab09e1101725861e81a314d82ed5425b35f911a82d
Opcode Fuzzy Hash: 39bddfcb86b903b1ba5150ecae159b9b4324f74c7c1ec51e489e2501f4c4b97b
Instruction Fuzzy Hash: 3BB18D725843929FCB26AF788CA83CA3BA3BF56330F55016ADD999B255D33049868F41

Uniqueness

Uniqueness Score: -1.00%

Function 0213586F, Relevance: 4.0, Strings: 3, Instructions: 298COMMON

Download Yara Rule

Strings

z, xrefs: 021359D2
=&b, xrefs: 02135B9C
L?Pq, xrefs: 02135D58

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =&b$L?Pq$z
API String ID: 0-1282955176
Opcode ID: f7149c4b5d13635bb37e41fc3805477bba7a08cd82c535071d39673da6779ce6
Instruction ID: 8e0a4e8aa9fd6274686a34c7f198e6790e09037202f12e32d2d0cf0509686848
Opcode Fuzzy Hash: f7149c4b5d13635bb37e41fc3805477bba7a08cd82c535071d39673da6779ce6
Instruction Fuzzy Hash: 86B100B16403499FDF398E28CDA57EA77A3EF45350F95812EDC898B254D7328686CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0213A4ED, Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

OY>, xrefs: 0213A51C
# l$, xrefs: 0213A69F
OY>, xrefs: 0213A521

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: OY>$OY>$# l$
API String ID: 0-3884696089
Opcode ID: 7f9ad07de981b7ab44c5dc1200addedb9afd6cc61f0f4d92d590fca7d77ae5d0
Instruction ID: 1313e2bc2802a3430dfdfef9f3d44ce4a85d5c4fc076b2772df1d85bbe18349d
Opcode Fuzzy Hash: 7f9ad07de981b7ab44c5dc1200addedb9afd6cc61f0f4d92d590fca7d77ae5d0
Instruction Fuzzy Hash: DE8129719443958FDF369E3889E83DA7BE29F12360F8581AECCC94F14AD3358586C752

Uniqueness

Uniqueness Score: -1.00%

Function 02131030, Relevance: 3.1, Strings: 2, Instructions: 640COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: 6dbc233d4649eb533319b3200f4f1ccf9b10c9b55c5b8b7fe9a8b1b5ff446560
Instruction ID: e9852f941e01fe8401e1b4ffdc16be60d567520afe6e9f3ecd22ec75eab7c4c6
Opcode Fuzzy Hash: 6dbc233d4649eb533319b3200f4f1ccf9b10c9b55c5b8b7fe9a8b1b5ff446560
Instruction Fuzzy Hash: 9C22B072A843869FDF359E6C8D983DE3BA3BF46360F95411ECC499B248E33489858F45

Uniqueness

Uniqueness Score: -1.00%

Function 02130E85, Relevance: 3.1, Strings: 2, Instructions: 615COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: 03f5103b6db4a7d2eca60e6cf501f01473c031cc3d6a3d80e32e465a8d49ea94
Instruction ID: 533a58fd59ec4c0a62d87650e9700939e1f97674273565b1696ac6bb6e6d46d9
Opcode Fuzzy Hash: 03f5103b6db4a7d2eca60e6cf501f01473c031cc3d6a3d80e32e465a8d49ea94
Instruction Fuzzy Hash: A1229D71A8034ADFDF359E688D943DE37A3AF95350F95812DCC8D9B204E7318A868F45

Uniqueness

Uniqueness Score: -1.00%

Function 02130EFC, Relevance: 3.1, Strings: 2, Instructions: 604COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: 3ddf78eddb3a419cfd47b978d2c75d76411601dae8a098ac1cb9723ab7c1135d
Instruction ID: 669110c1901afa3b19cb1c6d841b64ee60a6042ba3c1e5650ebf126f5179c492
Opcode Fuzzy Hash: 3ddf78eddb3a419cfd47b978d2c75d76411601dae8a098ac1cb9723ab7c1135d
Instruction Fuzzy Hash: A0228D71A4034ADFDF359E688D943DE37A3AF95350F95812ECC8D9B208E7318A868F45

Uniqueness

Uniqueness Score: -1.00%

Function 02130F35, Relevance: 3.1, Strings: 2, Instructions: 591COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: c2f1020279e8282aa82b013160d3054602e80347cbaf877671434f52aee65a60
Instruction ID: 17a9447a72106722fb042390b4ef6ef28fb54e6924a8d2fc3fc22d773b3df014
Opcode Fuzzy Hash: c2f1020279e8282aa82b013160d3054602e80347cbaf877671434f52aee65a60
Instruction Fuzzy Hash: B5128D71A4034ADFDF359E688D983DE37A3AF95350F95812ECC8D9B208D7318A868F45

Uniqueness

Uniqueness Score: -1.00%

Function 02130F98, Relevance: 3.1, Strings: 2, Instructions: 581COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: 552669a9e891617d379a3e44d2200fe53a6578c7af5ca82e30a6e36b09795878
Instruction ID: ff1d3e2b06a98543a67c169e7d79d78a4bfc613bb9bbbf0f6d1b3eeeb89a3fe0
Opcode Fuzzy Hash: 552669a9e891617d379a3e44d2200fe53a6578c7af5ca82e30a6e36b09795878
Instruction Fuzzy Hash: 2A128C71B4034ADFDF319E688D983DE37A7AF95350F95812ECC4D9B208E7318A868B45

Uniqueness

Uniqueness Score: -1.00%

Function 0213147F, Relevance: 2.9, Strings: 2, Instructions: 415COMMON

Download Yara Rule

Strings

rr_c, xrefs: 0213152B
::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rr_c$::
API String ID: 0-965447438
Opcode ID: bb85925f9da13e4018a5e7c1150d4a1ce416676ae936f5a042a3688de60b094b
Instruction ID: 60ef8ca3d3fbf874e2f51fe19cd9772c200a9eadf69c00407fa370d31445b58b
Opcode Fuzzy Hash: bb85925f9da13e4018a5e7c1150d4a1ce416676ae936f5a042a3688de60b094b
Instruction Fuzzy Hash: 08E19D72A443859FCF368E6C8D943CB3BA3BF56330F99411ACC994B249E33589858F41

Uniqueness

Uniqueness Score: -1.00%

Function 0213416B, Relevance: 2.8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

~I, xrefs: 02134229
qKsU, xrefs: 021343E7

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: qKsU$~I
API String ID: 0-2676728823
Opcode ID: ad4c454879aad9ae50e7bc3d91f928f4382f0fe71eba4da10b707fd63491aa4c
Instruction ID: cc9825b229af984a1e5c69921dcc54082dda6c12556dbdba56ea5690c04d5f0b
Opcode Fuzzy Hash: ad4c454879aad9ae50e7bc3d91f928f4382f0fe71eba4da10b707fd63491aa4c
Instruction Fuzzy Hash: 56A15671644359DFDB349E38CCA87DA37A6AF167A0F85412ECC8A9B241D3309A85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 021341BA, Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

~I, xrefs: 02134229
qKsU, xrefs: 021343E7

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: qKsU$~I
API String ID: 0-2676728823
Opcode ID: 5fb13c52e12c446175192f2ce15cedea3ec7cf1f4abdf2f0f05b2e2765cc60a8
Instruction ID: 7733c2be74a89bcd517eb965371bc257197b6bc5f017e74ad1b7cecc6228a36d
Opcode Fuzzy Hash: 5fb13c52e12c446175192f2ce15cedea3ec7cf1f4abdf2f0f05b2e2765cc60a8
Instruction Fuzzy Hash: 98615772544348CFDF389E388DA87DB77A6AF42790F96421ECC8A9B555E3308A45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02137639, Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: c3440e661e9aa6d6ce10eda472fd774a0495d76656296a5c28fe1783b2d93631
Instruction ID: ffee325e24cb36ceba6ea1e03c9ae3a26460d04c03993308b520bcbca8fca1cb
Opcode Fuzzy Hash: c3440e661e9aa6d6ce10eda472fd774a0495d76656296a5c28fe1783b2d93631
Instruction Fuzzy Hash: 2022567164434A9FDB34AE78CDA47EE37A7AF55390F85412EDC89DB240E7318A86CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02130612, Relevance: 1.7, Strings: 1, Instructions: 489COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: 9303407e9fd66c9b52b80346a42a8f5aa0725aa02d4171e665a2d93917cf1fe1
Instruction ID: 0c1a37fadf15ecc6e21580df68ff9f5a5cf97853971a431c8b36e2f96b03c7ff
Opcode Fuzzy Hash: 9303407e9fd66c9b52b80346a42a8f5aa0725aa02d4171e665a2d93917cf1fe1
Instruction Fuzzy Hash: D6F1897574034ADFDB309E7888A43DB37A7AF5A790F95012ECC899B244E7318986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02139C43, Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: 5594e6724bb06f71eeef3396bd39c822d5050e683246e7672d1ff602f45d1ac8
Instruction ID: 0263ca77855b246b5dfe7af8e52245fa19671b03c7fd773676e7b57f6d8fa727
Opcode Fuzzy Hash: 5594e6724bb06f71eeef3396bd39c822d5050e683246e7672d1ff602f45d1ac8
Instruction Fuzzy Hash: A2C178726843969FCF219E7C4DA43DA3BE7AF567A0F99022BCC915B284E33444C6CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02132546, Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

11l1, xrefs: 0213895D

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 11l1
API String ID: 0-3572296686
Opcode ID: 004438a447a098d10bbb3339d4bbf99c7a628a6fadc89126e1be1b04b18b7acc
Instruction ID: 7518b261a50940459e7b6ce523a59d0b6d7f5b55b6f11cc6ecddf521a7565b7a
Opcode Fuzzy Hash: 004438a447a098d10bbb3339d4bbf99c7a628a6fadc89126e1be1b04b18b7acc
Instruction Fuzzy Hash: C8C1AF739843919FDB26AE788C983CF7BA3BF56770F59016EDC959B250D33049828B42

Uniqueness

Uniqueness Score: -1.00%

Function 0213911A, Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: b19e17517eed6762c020b5d9c399e0927b6b88682dfae8668f80270b3aab168d
Instruction ID: 482d384556088068ae0f73315ea6dbe6c81e31af1b636d4a971a1c3153e9ffa4
Opcode Fuzzy Hash: b19e17517eed6762c020b5d9c399e0927b6b88682dfae8668f80270b3aab168d
Instruction Fuzzy Hash: 81A16976A40359DFDF30DE688DE43DA37A3AF597A0F96412EDC889B244D3309982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0213B30C, Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

rh;, xrefs: 0213B3EE

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rh;
API String ID: 0-1610986947
Opcode ID: ac828125a2b56751d6fedb7e79ee2bf4544405ad53b981b890defd5ee1f19d71
Instruction ID: 16fbcd811fa31f6c6ec67a88c733fcd74ae1737d7e819b29dc1cd8c357633cdb
Opcode Fuzzy Hash: ac828125a2b56751d6fedb7e79ee2bf4544405ad53b981b890defd5ee1f19d71
Instruction Fuzzy Hash: 99A17731A44385CFDF359E7989E93DA77A3AF55324F96013ECC468B154E7348A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02131599, Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ::
API String ID: 0-1334805887
Opcode ID: 81cd64934d0dabaa64bbb074b38d7e75e66c76d3b191efb7e1abe5fa658ae64d
Instruction ID: a9f6df6646a720a381894d0d795f465333ec30f745839a9a6236dcf4248b96e3
Opcode Fuzzy Hash: 81cd64934d0dabaa64bbb074b38d7e75e66c76d3b191efb7e1abe5fa658ae64d
Instruction Fuzzy Hash: C791A075A40349DFDF315E688CD83DE37A3AF56360F95412ACC8D4B245E33589878B45

Uniqueness

Uniqueness Score: -1.00%

Function 021315D3, Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ::
API String ID: 0-1334805887
Opcode ID: 242542d698de35fccc8e9da1838ffc5f37fdb7d8972609f6411d8e226f7cc706
Instruction ID: 639d4df872bde2e3f17f8bf9faba07535552bc4368f6a3ce3961cf3e6788b0f1
Opcode Fuzzy Hash: 242542d698de35fccc8e9da1838ffc5f37fdb7d8972609f6411d8e226f7cc706
Instruction Fuzzy Hash: D5919DB6A80349DFDF315E688CE43DE37A3AF56360F95411ACC8E4B245E33589868F46

Uniqueness

Uniqueness Score: -1.00%

Function 0213163E, Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

::, xrefs: 02131710

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ::
API String ID: 0-1334805887
Opcode ID: b01c6f70c1f77ebe6cdf8cfdb4b39ce03b45de1c6f4d97906df621b395d480f5
Instruction ID: b29330974bebb20101860a9caeb4237b3f44be89fecece7258ec50232f19356b
Opcode Fuzzy Hash: b01c6f70c1f77ebe6cdf8cfdb4b39ce03b45de1c6f4d97906df621b395d480f5
Instruction Fuzzy Hash: BF91C272A8434ADFDF329E788CD83DE37A39F52350F95411ACC898B245E3358986CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0213B3B7, Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

rh;, xrefs: 0213B3EE

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: rh;
API String ID: 0-1610986947
Opcode ID: 6c12ac94613b37e6918b0d840317cd123a7ca1429f13888b8f0c0a590096bf0e
Instruction ID: 6c9d3062aaae680c253556b97e3501477e2cfd08ac7a5c8cde89a47b1c100af1
Opcode Fuzzy Hash: 6c12ac94613b37e6918b0d840317cd123a7ca1429f13888b8f0c0a590096bf0e
Instruction Fuzzy Hash: 63915731A44385CFDF359E7989E93DA77A3AF45324F96013ECD469B250D7348986CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02136F07, Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: a0f2c55d21b0927f7987d3dc589b756dfb9d2d19d0b8c68db5b4cf73f0e9a9b2
Instruction ID: 8c06b38d493edf8de3acba15cc2216939bbe1454dfe63ac59b63bc2d01b62cef
Opcode Fuzzy Hash: a0f2c55d21b0927f7987d3dc589b756dfb9d2d19d0b8c68db5b4cf73f0e9a9b2
Instruction Fuzzy Hash: E8717A76A4034A9FDF309E748DE43DB37A79F56BA0F96012EDC859B205E3348986CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02130791, Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: b453e6b4b45b18a9f8cfbe9449943e76d7faaae046aa6d19eed16c546243bfa1
Instruction ID: c72a3b6c8fc716179066f5023aa8724a4f649e46c8b2e3749d06d3df671ddf8f
Opcode Fuzzy Hash: b453e6b4b45b18a9f8cfbe9449943e76d7faaae046aa6d19eed16c546243bfa1
Instruction Fuzzy Hash: F6716976A403469FDB309E7889E43DB3BE79F96790F96012EDCC59B244E7348886CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0213A53D, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

# l$, xrefs: 0213A69F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: # l$
API String ID: 0-1589991766
Opcode ID: ce106ff72751dee24754df9aa00daa8d476dbe8b78c7e4d80fb547d8109f48a9
Instruction ID: f39073e66f9be209833bc3963a76cae6415c9385694e4eb7159a691c43164758
Opcode Fuzzy Hash: ce106ff72751dee24754df9aa00daa8d476dbe8b78c7e4d80fb547d8109f48a9
Instruction Fuzzy Hash: 748146719443858FDF319E7889E83DB7BA29F12360F9582AECCC94F14AD3358186C756

Uniqueness

Uniqueness Score: -1.00%

Function 0213651A, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: 5492025dcec262c4b6b595428f565df2fd03401fe526eccf14bec3a00cff73a2
Instruction ID: c2b8f267f0d7d401c0b962c2b17a169a9d4ef4c95eda543654596e54a42052e4
Opcode Fuzzy Hash: 5492025dcec262c4b6b595428f565df2fd03401fe526eccf14bec3a00cff73a2
Instruction Fuzzy Hash: 1C61487664034A9FDF309E788DE43DB37A79F967A0F96012ECC849B245E7348986CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021307D2, Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

)m <, xrefs: 0213080F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: )m <
API String ID: 0-110772222
Opcode ID: 6b07fa350051a95c215b2582f732971ee0a4f1b42668845e4584c6a12eb8730e
Instruction ID: dc0ae365315dddb9afc72bc798ed3ca1a19cd59716640d64c0a4dbe1e74b89f1
Opcode Fuzzy Hash: 6b07fa350051a95c215b2582f732971ee0a4f1b42668845e4584c6a12eb8730e
Instruction Fuzzy Hash: A1615776A4034A9FDF309E788DE43DB37A79F96790F96012ECC849B204E7348986CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0213A63F, Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

# l$, xrefs: 0213A69F

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: # l$
API String ID: 0-1589991766
Opcode ID: 052eccaec4b8c03249b0af35ae4727f361b0feaec6a9bc256f38798525be39dd
Instruction ID: cdec05b81b12c5a93903840bcfe92c1bd102b387203d08bdfb0d459bfa9ef7fc
Opcode Fuzzy Hash: 052eccaec4b8c03249b0af35ae4727f361b0feaec6a9bc256f38798525be39dd
Instruction Fuzzy Hash: FC51E6716443858FDF35DE7888A83EABBA3AF55320F85816ECC898F14AD3358186C716

Uniqueness

Uniqueness Score: -1.00%

Function 0213B878, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

[, xrefs: 0213B894

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: ace0f2d1884a4884e2c0d9013a0175a6c4a3874d76cbea92ecb1845539e1bb45
Instruction ID: ee3f8ad57a3b5d6cbe9e4faf29cfc3c89799826443467f83ef72b6fc1062869b
Opcode Fuzzy Hash: ace0f2d1884a4884e2c0d9013a0175a6c4a3874d76cbea92ecb1845539e1bb45
Instruction Fuzzy Hash: 13415E75A483CA9EDF316F64CCA83EE3762AF06760F85003ACC898B241D3754785CB16

Uniqueness

Uniqueness Score: -1.00%

Function 021342D8, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

qKsU, xrefs: 021343E7

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: qKsU
API String ID: 0-2434528650
Opcode ID: 2bb7abdaaf9c5d905588f758bb9d4b361270bd5b93ca2d4b0f99ae8ab4d2e453
Instruction ID: d6985f927ebdd2c54a90f7fd49197ed5b35141768ef485476118819ece7d8864
Opcode Fuzzy Hash: 2bb7abdaaf9c5d905588f758bb9d4b361270bd5b93ca2d4b0f99ae8ab4d2e453
Instruction Fuzzy Hash: 13416A72988358DFDF349E788D997CA37FAAF56790F45421ECC4CAB185D3308A458B41

Uniqueness

Uniqueness Score: -1.00%

Function 0213A015, Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

WF, xrefs: 0213A053

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID: WF
API String ID: 0-731659721
Opcode ID: 4b653f74ad6dbf0ad3b420df5e6331b3613c6bdf0654af0f6e22e85653574677
Instruction ID: 263e916cab0db432bc8ac558d298197ad8ed8b2541a4cd99a64d60630596ecab
Opcode Fuzzy Hash: 4b653f74ad6dbf0ad3b420df5e6331b3613c6bdf0654af0f6e22e85653574677
Instruction Fuzzy Hash: B021E53968134A8BCF30DF7D88D43DA33A2AF2A710F95422E8CC98B241E3344946CB46

Uniqueness

Uniqueness Score: -1.00%

Function 021396F1, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50a6318fea01ebd6299bfaf75602d42281dc8c63746db520dad9a53c27dc378
Instruction ID: 406359f647b2310f6c3634165487e23170d419dad94019956be98a68821e0290
Opcode Fuzzy Hash: f50a6318fea01ebd6299bfaf75602d42281dc8c63746db520dad9a53c27dc378
Instruction Fuzzy Hash: 90B18971A443469FDF349E288CE43EA33B3AF56390F95422ECC8997248D33199C6CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021346FA, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199273c8bab62fb51e071274b7331313539960c4e5c7dbab0650d20fd6ba314f
Instruction ID: 8e4638d182a71b80d47d8814a2fc28a2c1fd797ca5dff2f8e47c0a59a86c97a5
Opcode Fuzzy Hash: 199273c8bab62fb51e071274b7331313539960c4e5c7dbab0650d20fd6ba314f
Instruction Fuzzy Hash: E1A157726803459FDF71CE6989D87DA37E3AF99314F94452EDC8ACB204D3309A82CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02132ECF, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b750f523ca1294522f775d2edc706dc24522affc96f5a87d292cb41998f394
Instruction ID: 149866d6f9acee0ede92d1e5eff91d273e8299e3fee3ef6badb3b5ded55bf4a2
Opcode Fuzzy Hash: e5b750f523ca1294522f775d2edc706dc24522affc96f5a87d292cb41998f394
Instruction Fuzzy Hash: F6A13131A44349DFDB309E389C987DA77A7EF85350F96442EDC99DB211C3318A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02132F27, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565d2995d16e38951292ce94b2cf3b99afa69d0288e63d0f84e01dc72b7fdfaa
Instruction ID: faa1f75d496ea5f57182e65812dd3021b997cfd4282f9d4192f8ecb9e4eda6d9
Opcode Fuzzy Hash: 565d2995d16e38951292ce94b2cf3b99afa69d0288e63d0f84e01dc72b7fdfaa
Instruction Fuzzy Hash: 2BA12475A443459FDB348E3898987EB77A7AF85350F96442EDCC9C7214D7318A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02132129, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3415f282b66d86aebe1d5b1faae570dd2b653c33cf3dd7e60a1e3dd88dfd5d84
Instruction ID: da04b0fd82842112c856ecfdf3cf1d5aa969b77d183aeb384c1ea73adf03bdac
Opcode Fuzzy Hash: 3415f282b66d86aebe1d5b1faae570dd2b653c33cf3dd7e60a1e3dd88dfd5d84
Instruction Fuzzy Hash: 768133717443499FCB389E288CA47EB77B3AF95390F85812DCCCA8B214D7318985CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02130B35, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b60bb6647b416da021f09bdb6c3475ea0d4de37f10f4f567706fbc334c03d1
Instruction ID: 7bd9c2e362995c56ce6fc225dafc1bbf135f10dd506f0142be6db914d1968043
Opcode Fuzzy Hash: 85b60bb6647b416da021f09bdb6c3475ea0d4de37f10f4f567706fbc334c03d1
Instruction Fuzzy Hash: E3617871A4034ACFDB319E6CDCA43DB33E7AF5A390F95412ADC899B204E7318A85CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0213B4B1, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8386dd1fb692e1fdaea24a6932907db3153ad78f12d33643a99b03768b4d05
Instruction ID: d92b7acc9ec19bd0ef4be08eabfce51db6c4c4c886b4eef280378d10f43039eb
Opcode Fuzzy Hash: 8e8386dd1fb692e1fdaea24a6932907db3153ad78f12d33643a99b03768b4d05
Instruction Fuzzy Hash: A6715631A44345CFDF359E7989E83DA77A2AF45324F96017ECC469B120E7358986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02139738, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa4bb6419560baf4c30efdf678b215eea7b60b650ceeeb9f09c4a23818b19bf
Instruction ID: 6600512a67c86170fb98cc914d6c75be332a6ca3e0b4f0ab15f3ee6691c97c46
Opcode Fuzzy Hash: bfa4bb6419560baf4c30efdf678b215eea7b60b650ceeeb9f09c4a23818b19bf
Instruction Fuzzy Hash: 8C617A72A40356DFDF309E689DE43D633B3AF16390F86022ACCC957645C33159CACA82

Uniqueness

Uniqueness Score: -1.00%

Function 02133DC6, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264b5afeb0b42e290da38f07166a874a48062715ab3c76450d85043135531ec6
Instruction ID: 16c7edb525daab6708e9d5842e3947542634865114256f27d43fd71099e6318b
Opcode Fuzzy Hash: 264b5afeb0b42e290da38f07166a874a48062715ab3c76450d85043135531ec6
Instruction Fuzzy Hash: 27610071B4025A8FDB299E28CC947DA33E3BF46760F86412DDC99DB201D731DA8ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 021325C4, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af17bdf2f83343a5cac7ed2e77443cdbec79f1d8d0c656d0ac3058df67a39c11
Instruction ID: 1dc620ec38d13cd7bfe3dc4c14a7d926b8e0c0e473ea4f26912e406c5b9691e1
Opcode Fuzzy Hash: af17bdf2f83343a5cac7ed2e77443cdbec79f1d8d0c656d0ac3058df67a39c11
Instruction Fuzzy Hash: BF51A932A443159FEB21AE748CA53DB77E3AF873A0F66452EDCC4A7100D7314D868B82

Uniqueness

Uniqueness Score: -1.00%

Function 0213976C, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ce6ccf93472a3f8668c25d223199ce746cedaa90c8815742f27bc998c7db4e
Instruction ID: dbb1b1e8cbfa676fd5d983cfecbfce1f582a2bcd09761d14660dd93df4661fd5
Opcode Fuzzy Hash: 14ce6ccf93472a3f8668c25d223199ce746cedaa90c8815742f27bc998c7db4e
Instruction Fuzzy Hash: D0513772A4439ADFDF309E689DE43D633B7AF56390F86022ACCC967645C3315989CA42

Uniqueness

Uniqueness Score: -1.00%

Function 02131782, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d7c18a0fff2385339d2b739a3c507285ad1894271b6e7800ad8b03d5cb6a87
Instruction ID: 973fd002d5d32d0075cb6605a8dad948e6105115362861e3327e3ccd1f279018
Opcode Fuzzy Hash: d5d7c18a0fff2385339d2b739a3c507285ad1894271b6e7800ad8b03d5cb6a87
Instruction Fuzzy Hash: 105167B5A80349CFDF315E788DE83DE37A3AF56360F95411ACC994B145E3358A8A8F06

Uniqueness

Uniqueness Score: -1.00%

Function 021398DA, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc8418dbc89ec710aa88d038ff341c38eff7b415c94258469f9459e2ba01bb4
Instruction ID: 198c8a9b90563baae99b69f3d8fe528fbb1cc58f3ef841417d04ee7c608e0635
Opcode Fuzzy Hash: 7dc8418dbc89ec710aa88d038ff341c38eff7b415c94258469f9459e2ba01bb4
Instruction Fuzzy Hash: 78518B72A4439AEFDF309E289CE43DA73B7AF56390F85022ACCC957205C3315986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0213325B, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d23069410db8d83be7b780ffe79c165255cd5a55b9e733ec7e2d97ed5357d2f
Instruction ID: b013bc549d465b2cb343d00fc43723193dc51ca72b804297f58992c165f7fca6
Opcode Fuzzy Hash: 8d23069410db8d83be7b780ffe79c165255cd5a55b9e733ec7e2d97ed5357d2f
Instruction Fuzzy Hash: DA5128129987C10EDB268A7D5D983DBBFA7FF56220F48429FCAB20B196D31540C4DB46

Uniqueness

Uniqueness Score: -1.00%

Function 021325E2, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b919caa4fc73e8bbdd689b4acd80d3a2ec7adfa49a1a92449b486767eacacff7
Instruction ID: c2cc58738d6372efed701b5bf635d51f8b1ad7ea6a9ed70cea3478275331186e
Opcode Fuzzy Hash: b919caa4fc73e8bbdd689b4acd80d3a2ec7adfa49a1a92449b486767eacacff7
Instruction Fuzzy Hash: 98419936A443129FEB21AE7488A53DF77E7AF873A0F66441EDCC4A7150D7314C868B42

Uniqueness

Uniqueness Score: -1.00%

Function 0213A896, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300ce21116445724027b3ebb73e247794f9ff3609538b4f5c46568bc530aa8c2
Instruction ID: 912aae15b5b483d9b7487a632f05709df77a128f3da654531d62f6204d321298
Opcode Fuzzy Hash: 300ce21116445724027b3ebb73e247794f9ff3609538b4f5c46568bc530aa8c2
Instruction Fuzzy Hash: 704179315803954BDF319E3889A47DE7BA36F13360F898229CCE56F289D3754987C751

Uniqueness

Uniqueness Score: -1.00%

Function 02133185, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65b5dcb4f77218d968f425d77555f0871960f7fa584df81678d23c22a59d030
Instruction ID: 887d57f2e05a27b53a9ae3b5e23b6ea3f3cbc02db9308af01bd430ed9653e341
Opcode Fuzzy Hash: d65b5dcb4f77218d968f425d77555f0871960f7fa584df81678d23c22a59d030
Instruction Fuzzy Hash: 91317838A403049FEB305E7498D4BEB77A7AF85384F85842ECDD287155C7329988CB43

Uniqueness

Uniqueness Score: -1.00%

Function 0213B699, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680e6f31e9d529afc3ec35cb828ca6f345cd60da11720fa5492a9d2775cf172e
Instruction ID: f873aeec46b373cef3c1b2b5a162f22c7aa74bb8476485fe0ae0df2f616b9901
Opcode Fuzzy Hash: 680e6f31e9d529afc3ec35cb828ca6f345cd60da11720fa5492a9d2775cf172e
Instruction Fuzzy Hash: EB413535A443958FDF359E7DCAD87C673A2AF58364F82017BCD099B214D335DA80CA82

Uniqueness

Uniqueness Score: -1.00%

Function 0213AB46, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cb07073d0ce90826561d3840608ce827d3892a6c0842e3d86c8c9e16ad69e2
Instruction ID: 3aa8ad0b290fb8935e4d743fd562de5142c5daaa014d4fbab1b9cae6e196d2c3
Opcode Fuzzy Hash: 77cb07073d0ce90826561d3840608ce827d3892a6c0842e3d86c8c9e16ad69e2
Instruction Fuzzy Hash: DE3115356083968BDF328E388DE47DABBD39F56310F958629CCD9DB185C3358982C712

Uniqueness

Uniqueness Score: -1.00%

Function 021331F5, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0a1787f742d5d4c107c2e3f8fda0ab0989846a2eb77bad9d2e4d4196a597cb
Instruction ID: 115fdc877351408f668ebb9cd87650f0e3aa1f95221cab607ab77b330e89c717
Opcode Fuzzy Hash: 4c0a1787f742d5d4c107c2e3f8fda0ab0989846a2eb77bad9d2e4d4196a597cb
Instruction Fuzzy Hash: 32315638A507008FEB201D7099D87E777A7AF89284F86442EC9D687116C7329988C743

Uniqueness

Uniqueness Score: -1.00%

Function 02139D11, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5063904620c98dfcc3c0bf41543676761647495c99116c3b5d89d1973d0f232
Instruction ID: fe5950df9f5f6d1ad2bad53659175ce027842e697fa36fd8a8802316a49e8a21
Opcode Fuzzy Hash: a5063904620c98dfcc3c0bf41543676761647495c99116c3b5d89d1973d0f232
Instruction Fuzzy Hash: A32107B224034A8FDB245D688DF57DB77A7AF95780F86003EDCC6CB650D73689898602

Uniqueness

Uniqueness Score: -1.00%

Function 02139473, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba485f7016452b75a2ec68ab9260de13c0da727ba13b16cdc3253a43ebf5bc4
Instruction ID: 0628d715047f0ee7d550d638034d71471a07b418a8a0d291361bc0c32ad6e164
Opcode Fuzzy Hash: 0ba485f7016452b75a2ec68ab9260de13c0da727ba13b16cdc3253a43ebf5bc4
Instruction Fuzzy Hash: 1D21DB726047118FCB26CE28C9C4BDA73A2BF5A3A0F624079EC8EDB311D734D881CA40

Uniqueness

Uniqueness Score: -1.00%

Function 02132066, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4679623a5882ac042a9e9fb4559aa6f9165e92fafbecdc1e02fbffe88da4239a
Instruction ID: 6e5c0c0959fa196fa9a9e4b08b9be7ceb00fd7f9a5c524d3722029d8f30a239a
Opcode Fuzzy Hash: 4679623a5882ac042a9e9fb4559aa6f9165e92fafbecdc1e02fbffe88da4239a
Instruction Fuzzy Hash: 3F018CBD1043CA9EDF726F148A113C93772DF227A0F4480119D980B646E7390B86DB14

Uniqueness

Uniqueness Score: -1.00%

Function 02132C11, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570ca516d0f3295c798aeee026698e16d26a887795c7fc01de4104a18d016740
Instruction ID: c348e60c29a638a00e5b6f419ec9d03cba2acfd3faa78c60b6be078fb4b9c610
Opcode Fuzzy Hash: 570ca516d0f3295c798aeee026698e16d26a887795c7fc01de4104a18d016740
Instruction Fuzzy Hash: 47C08C9E2180520AAA6404BC870438868923F866A0FE1832BA8ABC188CD346CA802004

Uniqueness

Uniqueness Score: -1.00%

Function 0213652D, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2462e4de9505d3511d1a4d710172339ea7753514a19ba10f5e17b152ea6970
Instruction ID: 927424167c8bae3de6d813f9bcee0ae78b094b16a951d7488dc683e1cdab2436
Opcode Fuzzy Hash: bb2462e4de9505d3511d1a4d710172339ea7753514a19ba10f5e17b152ea6970
Instruction Fuzzy Hash: 28C092F32404858FEF02DB08C4B1B8173A1FB25B48FC804D0E043CB712C224ED10CA04

Uniqueness

Uniqueness Score: -1.00%

Function 02138FC0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1308788382.0000000002130000.00000040.00000001.sdmp, Offset: 02130000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82934a0310a2214c98bbe70eed3f027ff73084bc482b8f2c52108c50f26ce7bd
Instruction ID: 7eb7d87ecf377e2d5496f786f5b937309c9449415add9b5aaa1200306207cbd7
Opcode Fuzzy Hash: 82934a0310a2214c98bbe70eed3f027ff73084bc482b8f2c52108c50f26ce7bd
Instruction Fuzzy Hash: B0B092312106448FCA41CE08C2A0F8173A4BB15A80B014480E8408BB12E324E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00418450, Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 210COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004184BD
__vbaStrCopy.MSVBVM60 ref: 004184C5
#696.MSVBVM60(004122A0), ref: 004184CC
__vbaEnd.MSVBVM60 ref: 004184D8
__vbaStrComp.MSVBVM60(00000000,004122A0,004122A8), ref: 004184E9
__vbaNew2.MSVBVM60(00410F04,hF), ref: 0041850C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041852B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00412090,00000060), ref: 0041854B
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00418564
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041857D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000138), ref: 004185A3
__vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 004185BB
__vbaHresultCheckObj.MSVBVM60(00000000,0045E8C4,0041202C,00000044), ref: 00418686
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 004186BD
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004186CD
__vbaFreeVar.MSVBVM60 ref: 004186D9
__vbaFreeObj.MSVBVM60(00418728), ref: 00418711
__vbaFreeStr.MSVBVM60 ref: 00418720
__vbaFreeStr.MSVBVM60 ref: 00418725

Strings

hF, xrefs: 004184F9, 00418502, 00418512, 00418551, 0041855A, 0041856A
P8, xrefs: 004186DF
Pieters7, xrefs: 00418665

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$Copy$#696CompLateList
String ID: P8$Pieters7$hF
API String ID: 1409344031-1310204752
Opcode ID: 1b26cad1bf18c9ce9cbe3f5dc8a052fb558706b599271dd156a695803359f0f2
Instruction ID: 62ba6aa963b469cc081f3f87b7442bbe7404bf9e69c5d52f50b5e26adbaa364e
Opcode Fuzzy Hash: 1b26cad1bf18c9ce9cbe3f5dc8a052fb558706b599271dd156a695803359f0f2
Instruction Fuzzy Hash: 3D912970A002089FCB10DFA9C949ADDBBF5FF48300F20816AE549E7265D7759982CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00418B80, Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00418BC3
__vbaStrCopy.MSVBVM60 ref: 00418BCB
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00418BE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418BFF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001FC), ref: 00418C44
__vbaFreeObj.MSVBVM60 ref: 00418C4D
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00418C66
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418C7F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001FC), ref: 00418CBB
__vbaFreeObj.MSVBVM60 ref: 00418CC4
#538.MSVBVM60(?,000007DB,0000000B,0000000B), ref: 00418CD7
#557.MSVBVM60(?), ref: 00418CE1
__vbaFreeVar.MSVBVM60 ref: 00418CF8
__vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 00418D1A
__vbaHresultCheckObj.MSVBVM60(00000000,0045E8C4,0041202C,0000001C), ref: 00418D3F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,00000060), ref: 00418D85
__vbaFreeObj.MSVBVM60 ref: 00418D8E
__vbaFreeStr.MSVBVM60(00418DCE), ref: 00418DC6
__vbaFreeStr.MSVBVM60 ref: 00418DCB

Strings

hF, xrefs: 00418BCD, 00418BD6, 00418BE6, 00418C53, 00418C5C, 00418C6C
underdrawing, xrefs: 00418D64

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Copy$#538#557
String ID: hF$underdrawing
API String ID: 1171355408-2503379458
Opcode ID: ac378ef37b1611ed77664ea8631ebee77874710bed7b005c2ab2892e3d68627b
Instruction ID: 12ef39c3fff4f039e9a7e5cfddc494da88d07230f9bb98ebab5ffb2591b11c19
Opcode Fuzzy Hash: ac378ef37b1611ed77664ea8631ebee77874710bed7b005c2ab2892e3d68627b
Instruction Fuzzy Hash: BC616F70A012099BDB14DF64DE49ADABBB8FF4C700F10852AF545F72A4DB74A941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00418750, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410F04,hF), ref: 004187B2
__vbaObjSet.MSVBVM60(?,00000000), ref: 004187CB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,000001EC), ref: 0041881F
__vbaFreeObj.MSVBVM60 ref: 0041882C
__vbaVarDup.MSVBVM60 ref: 00418846
#522.MSVBVM60(?,?), ref: 00418854
__vbaVarTstNe.MSVBVM60(?,?), ref: 00418870
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00418883
__vbaHresultCheckObj.MSVBVM60(00000000,00401318,00411820,0000015C), ref: 004188B1
__vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 004188C6
__vbaHresultCheckObj.MSVBVM60(00000000,0045E8C4,0041202C,00000014), ref: 004188EB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004122F8,000000F0), ref: 00418911
__vbaStrMove.MSVBVM60 ref: 00418920
__vbaFreeObj.MSVBVM60 ref: 00418929
__vbaFreeStr.MSVBVM60(0041896A), ref: 00418963

Strings

hF, xrefs: 00418787, 004187A8, 004187B8
Burrfishes4, xrefs: 004187F8

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$New2$#522ListMove
String ID: Burrfishes4$hF
API String ID: 3040920094-769532254
Opcode ID: 4d8c6a2bdb0a1eedfab9301605eefc3b8431c6ead804edf16549d00011ab3095
Instruction ID: a7bb6a4fdada2a73822dcc5310ec233baa06be4840b43003059890336c6abcdf
Opcode Fuzzy Hash: 4d8c6a2bdb0a1eedfab9301605eefc3b8431c6ead804edf16549d00011ab3095
Instruction Fuzzy Hash: 5C514B70900219DFDB10DFA4DD88EEEBBB8FB48704F10812AF545A7251DBB89945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00418990, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410F04,hF), ref: 004189E9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418A02
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000108), ref: 00418A29
__vbaVarErrI4.MSVBVM60(?,?), ref: 00418A38
#559.MSVBVM60(00000000), ref: 00418A3F
__vbaFreeObj.MSVBVM60 ref: 00418A5B
__vbaFreeVar.MSVBVM60 ref: 00418A60
__vbaHresultCheckObj.MSVBVM60(00000000,00401328,00411820,00000254), ref: 00418A8B
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00418AA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418ABD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000120), ref: 00418AE4
#561.MSVBVM60(?), ref: 00418AFB
__vbaFreeObj.MSVBVM60 ref: 00418B11
__vbaFreeVar.MSVBVM60 ref: 00418B16
__vbaHresultCheckObj.MSVBVM60(00000000,00401328,00411850,00000718), ref: 00418B3A

Strings

hF, xrefs: 004189C7, 004189DF, 004189EF, 00418A91, 00418A9A, 00418AAA

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$New2$#559#561
String ID: hF
API String ID: 2912427131-3786020738
Opcode ID: f27e54a9d58687236d9ab59e0347ec16e5d4cc3e23ac1c416d69af69af649d06
Instruction ID: a0ba9a0b20591dea56a5ae5ebb364d054225ccfcd6307a88b86851352a92a5f1
Opcode Fuzzy Hash: f27e54a9d58687236d9ab59e0347ec16e5d4cc3e23ac1c416d69af69af649d06
Instruction Fuzzy Hash: 5A515075A01205AFC714DFA4CD89EEEBBB8FF08741F10453EF545A31A0DB7898858B68

Uniqueness

Uniqueness Score: -1.00%

Function 00412890, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

#574.MSVBVM60(?), ref: 004128E0
__vbaStrMove.MSVBVM60 ref: 004128EB
__vbaStrCmp.MSVBVM60(00411FE0,00000000), ref: 004128F7
__vbaFreeStr.MSVBVM60 ref: 0041290A
__vbaFreeVar.MSVBVM60 ref: 00412913
__vbaNew2.MSVBVM60(00410F04,hF), ref: 00412935
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041294E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411FE8,00000050), ref: 0041296F
__vbaLateMemCall.MSVBVM60(?,MMau2W253,00000003), ref: 004129E7
__vbaFreeObj.MSVBVM60 ref: 004129F3
__vbaFreeVar.MSVBVM60 ref: 004129FC
__vbaFreeObj.MSVBVM60(00412A36), ref: 00412A2F

Strings

hF, xrefs: 00412922, 0041292B, 0041293B
KEY, xrefs: 004129D2
MMau2W253, xrefs: 004129DE

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#574CallCheckHresultLateMoveNew2
String ID: KEY$MMau2W253$hF
API String ID: 3816854681-3759102327
Opcode ID: 3e15cfdf36cb7364a2bc7900b1a58cfb9718d71049091d99f992b34ccefc1afb
Instruction ID: 1015ac91359bd35fd01a11c9c079a71c340cd102382ba304f892b694d079a712
Opcode Fuzzy Hash: 3e15cfdf36cb7364a2bc7900b1a58cfb9718d71049091d99f992b34ccefc1afb
Instruction Fuzzy Hash: 4B4127B4D002159FCB14DFA8DA89A9EFBF8FF48700F20812AE945E7260D7746941CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00418E00, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418E4C
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418E54
__vbaNew2.MSVBVM60(00410F04,hF,?,?,?,?,?,?,?,?,?,00401366), ref: 00418E69
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00401366), ref: 00418E82
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,0000020C,?,?,?,?,?,?,?,?,?,00401366), ref: 00418EA5
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418EAE
__vbaFreeStr.MSVBVM60(00418ED6,?,?,?,?,?,?,?,?,?,00401366), ref: 00418ECE
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,00401366), ref: 00418ED3

Strings

hF, xrefs: 00418E56, 00418E5F, 00418E6F

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$CheckHresultNew2
String ID: hF
API String ID: 1874231197-3786020738
Opcode ID: 8e51eee8695740f562de032b38e38ff537f76ea76fab40dd8ae3d36abced3bb1
Instruction ID: 4a8389e0606d3f966416758fdad0e9f8ffa573dd9b7782cc9bbc7f67e997e55f
Opcode Fuzzy Hash: 8e51eee8695740f562de032b38e38ff537f76ea76fab40dd8ae3d36abced3bb1
Instruction Fuzzy Hash: A6212C71900219ABCB10DFA4DD49ADEBBB8FF58700F20456AF541E32A1DB78A942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00412A60, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00401366), ref: 00412AA3
__vbaNew2.MSVBVM60(00410F04,hF,?,?,?,?,?,?,?,?,00401366), ref: 00412ABC
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401366), ref: 00412AD5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041200C,00000208,?,?,?,?,?,?,?,?,00401366), ref: 00412AF8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401366), ref: 00412B01
__vbaFreeStr.MSVBVM60(00412B22,?,?,?,?,?,?,?,?,00401366), ref: 00412B1B

Strings

hF, xrefs: 00412AA9, 00412AB2, 00412AC2

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckCopyHresultNew2
String ID: hF
API String ID: 4138333463-3786020738
Opcode ID: b34c4b9eb1990f08a8507f5c352d460869cf7109106a1ea5e361a189e78e4a3f
Instruction ID: da92ea17a83bed87ae2f79cfa3c97cb038bdbc0a501b99b45eb503c4cf0c0e7b
Opcode Fuzzy Hash: b34c4b9eb1990f08a8507f5c352d460869cf7109106a1ea5e361a189e78e4a3f
Instruction Fuzzy Hash: 13114F70900205ABCB10DF94CE49AEEBFB8FF58740F104426F541E72A1C778A592CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412B80, Relevance: 12.1, APIs: 8, Instructions: 86COMMON

Download Yara Rule

APIs

#671.MSVBVM60(00000000,00000000,00000000,40000000,00000000,40000000), ref: 00412BC5
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401366), ref: 00412BCB
__vbaNew2.MSVBVM60(0041203C,0041A41C), ref: 00412BF4
__vbaHresultCheckObj.MSVBVM60(00000000,0045E8C4,0041202C,0000001C), ref: 00412C19
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041204C,0000005C), ref: 00412C5D
__vbaStrMove.MSVBVM60 ref: 00412C70
__vbaFreeObj.MSVBVM60 ref: 00412C79
__vbaFreeStr.MSVBVM60(00412CA4), ref: 00412C9D

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#671MoveNew2
String ID:
API String ID: 3127194502-0
Opcode ID: 268449db73bf51c5297fc95b3b9b40202ebac656c7b498d65c9859291dc7bb87
Instruction ID: 07cbd5ae98b011e4113b84311ab6838082af34dbc78f5c7f6a8ccb5f9299c35b
Opcode Fuzzy Hash: 268449db73bf51c5297fc95b3b9b40202ebac656c7b498d65c9859291dc7bb87
Instruction Fuzzy Hash: 24318E70900205EBCB14DF55DE49FAFBBB8FF58740F10802AE641B72A4D7785951CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004183C0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,00401366), ref: 00418403
#615.MSVBVM60(?,?,?,?,?,?,?,00401366), ref: 00418409
__vbaFreeStr.MSVBVM60(00418425), ref: 0041841E

Strings

;\q, xrefs: 0041840F

Memory Dump Source

Source File: 00000000.00000002.1307457111.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1307394903.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1307580459.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1307604893.000000000041B000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#615CopyFree
String ID: ;\q
API String ID: 674679529-3866329233
Opcode ID: f4e5b40e26294b43f988e91edeb4b11327b004f8e519b56e791cdb9631fbbfca
Instruction ID: 3bbe365c4abe7951e0c5d9729e27019f2611bc70255426ebf2868fcb2884961f
Opcode Fuzzy Hash: f4e5b40e26294b43f988e91edeb4b11327b004f8e519b56e791cdb9631fbbfca
Instruction Fuzzy Hash: E1F0E7B4D00259EBCB00DFA8CA49A9EBBB8FB08B04F10816AF901B3660D7785905CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report BANK DETAILS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: BANK DETAILS.exe PID: 5636 Parent PID: 5732

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: BANK DETAILS.exe PID: 5636 Parent PID: 5732 BANK DETAILS.exeCOMMON

Executed Functions

Function 02136F5D, Relevance: 1.7, APIs: 1, Instructions: 182memorynativeCOMMON

Function 02137139, Relevance: 1.6, APIs: 1, Instructions: 134memorynativeCOMMON