Play interactive tour

Edit tour

Windows Analysis Report JXblq0dqPN.exe

Overview

General Information

Sample Name:	JXblq0dqPN.exe
Analysis ID:	458740
MD5:	8718d75b7cac53f13d01ddea9b52cee0
SHA1:	2a37a01df74c887bb52eb2762d7d6ae0bd5e6b0b
SHA256:	6f40242247db00eea1922d0c2a38337ddea49d9da02693679d2e4bfb19e6c088
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

JXblq0dqPN.exe (PID: 5092 cmdline: 'C:\Users\user\Desktop\JXblq0dqPN.exe' MD5: 8718D75B7CAC53F13D01DDEA9B52CEE0)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://101.99.94.119/WEALTH_fkWglQyCXO188.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "http://101.99.94.119/WEALTH_fkWglQyCXO188.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: JXblq0dqPN.exe	Virustotal: Detection: 35%			Perma Link
Source: JXblq0dqPN.exe	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Show sources

Source: JXblq0dqPN.exe

Joe Sandbox ML: detected

Source: JXblq0dqPN.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://101.99.94.119/WEALTH_fkWglQyCXO188.bin

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA58C6 NtAllocateVirtualMemory,	1_2_02BA58C6
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA58B5 NtAllocateVirtualMemory,	1_2_02BA58B5
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA5983 NtAllocateVirtualMemory,	1_2_02BA5983

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA58C6	1_2_02BA58C6
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA26BA	1_2_02BA26BA
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA42BF	1_2_02BA42BF
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA46B5	1_2_02BA46B5
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA58B5	1_2_02BA58B5
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7E98	1_2_02BA7E98
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA80FC	1_2_02BA80FC
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA20EC	1_2_02BA20EC
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA24E2	1_2_02BA24E2
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA28E2	1_2_02BA28E2
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA5CD0	1_2_02BA5CD0
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA483C	1_2_02BA483C
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA1C35	1_2_02BA1C35
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA0223	1_2_02BA0223
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7012	1_2_02BA7012
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA4214	1_2_02BA4214
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA4A0A	1_2_02BA4A0A
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA6475	1_2_02BA6475
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA4C62	1_2_02BA4C62
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA885F	1_2_02BA885F
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA0641	1_2_02BA0641
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA0647	1_2_02BA0647
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7FAE	1_2_02BA7FAE
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA3FA3	1_2_02BA3FA3
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA218A	1_2_02BA218A
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA5D82	1_2_02BA5D82
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA1784	1_2_02BA1784
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA85F4	1_2_02BA85F4
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA4BEB	1_2_02BA4BEB
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7BEC	1_2_02BA7BEC
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA13C7	1_2_02BA13C7
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA4BC5	1_2_02BA4BC5
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA473E	1_2_02BA473E
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA2D2C	1_2_02BA2D2C
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA951E	1_2_02BA951E
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA0708	1_2_02BA0708
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA950D	1_2_02BA950D
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA2F7B	1_2_02BA2F7B
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7776	1_2_02BA7776
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA3D6D	1_2_02BA3D6D
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA8764	1_2_02BA8764
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA0557	1_2_02BA0557
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA2F54	1_2_02BA2F54
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA3147	1_2_02BA3147

Source: JXblq0dqPN.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: JXblq0dqPN.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: JXblq0dqPN.exe, 00000001.00000002.732873822.00000000021E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs JXblq0dqPN.exe
Source: JXblq0dqPN.exe, 00000001.00000002.730732122.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUBESKADIGEDES.exe vs JXblq0dqPN.exe
Source: JXblq0dqPN.exe	Binary or memory string: OriginalFilenameUBESKADIGEDES.exe vs JXblq0dqPN.exe

Source: JXblq0dqPN.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal88.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

File created: C:\Users\user\AppData\Local\Temp\~DFB54DFFF23F1C40FA.TMP

Jump to behavior

Source: JXblq0dqPN.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: JXblq0dqPN.exe	Virustotal: Detection: 35%
Source: JXblq0dqPN.exe	ReversingLabs: Detection: 17%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_00401367 pushfd ; iretd	1_2_0040136A
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_00403268 pushfd ; iretd	1_2_0040326E
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BAA0E4 push FFFFFFD2h; iretd	1_2_02BAA0E9

Source: initial sample

Static PE information: section name: .text entropy: 7.08584386702

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA42BF	1_2_02BA42BF
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA46B5	1_2_02BA46B5
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA483C	1_2_02BA483C
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA1C35	1_2_02BA1C35
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7012	1_2_02BA7012
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA6183	1_2_02BA6183
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA85F4	1_2_02BA85F4
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA473E	1_2_02BA473E

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

RDTSC instruction interceptor: First address: 0000000002BA7485 second address: 0000000002BA7485 instructions:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	RDTSC instruction interceptor: First address: 0000000002BA7485 second address: 0000000002BA7485 instructions:
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	RDTSC instruction interceptor: First address: 0000000002BA98AE second address: 0000000002BA9A11 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 pop eax 0x00000004 call 00007FD99CC64BD8h 0x00000009 mov bl, byte ptr [eax] 0x0000000b test ebx, eax 0x0000000d mov byte ptr [ebp+000001EFh], FFFFFFCFh 0x00000014 xor byte ptr [ebp+000001EFh], 00000064h 0x0000001b xor byte ptr [ebp+000001EFh], 00000049h 0x00000022 sub byte ptr [ebp+000001EFh], 00000016h 0x00000029 cmp bl, byte ptr [ebp+000001EFh] 0x0000002f je 00007FD99CC64B6Bh 0x00000031 mov bx, word ptr [eax] 0x00000034 cmp eax, edx 0x00000036 test edi, 0B419DFAh 0x0000003c mov word ptr [ebp+00000218h], si 0x00000043 mov si, 2562h 0x00000047 jmp 00007FD99CC64C85h 0x0000004c pushad 0x0000004d lfence 0x00000050 rdtsc

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Code function: 1_2_02BA42BF rdtsc

1_2_02BA42BF

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\JXblq0dqPN.exe

Code function: 1_2_02BA42BF rdtsc

1_2_02BA42BF

Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA54A8 mov eax, dword ptr fs:[00000030h]	1_2_02BA54A8
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7879 mov eax, dword ptr fs:[00000030h]	1_2_02BA7879
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7874 mov eax, dword ptr fs:[00000030h]	1_2_02BA7874
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA85F4 mov eax, dword ptr fs:[00000030h]	1_2_02BA85F4
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA2D2C mov eax, dword ptr fs:[00000030h]	1_2_02BA2D2C
Source: C:\Users\user\Desktop\JXblq0dqPN.exe	Code function: 1_2_02BA7377 mov eax, dword ptr fs:[00000030h]	1_2_02BA7377

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: JXblq0dqPN.exe, 00000001.00000002.732335333.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: JXblq0dqPN.exe, 00000001.00000002.732335333.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: JXblq0dqPN.exe, 00000001.00000002.732335333.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: JXblq0dqPN.exe, 00000001.00000002.732335333.0000000000D80000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery41	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
JXblq0dqPN.exe	36%	Virustotal		Browse
JXblq0dqPN.exe	18%	ReversingLabs	Win32.Trojan.Vebzenpak
JXblq0dqPN.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://101.99.94.119/WEALTH_fkWglQyCXO188.bin	1%	Virustotal		Browse
http://101.99.94.119/WEALTH_fkWglQyCXO188.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://101.99.94.119/WEALTH_fkWglQyCXO188.bin	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458740
Start date:	03.08.2021
Start time:	17:49:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	JXblq0dqPN.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 22.6% (good quality ratio 11.6%) Quality average: 33.2% Quality standard deviation: 37.7%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6665085666892185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JXblq0dqPN.exe
File size:	114688
MD5:	8718d75b7cac53f13d01ddea9b52cee0
SHA1:	2a37a01df74c887bb52eb2762d7d6ae0bd5e6b0b
SHA256:	6f40242247db00eea1922d0c2a38337ddea49d9da02693679d2e4bfb19e6c088
SHA512:	bd5ef6a34d6ce64ff42ccc54cec25fcba9813cb794e046c7929da98cb11cd15f4edbbcea430b0859f7a3a2b34376bb9f904eb8bc50f9bc014e41a8c8397deeb2
SSDEEP:	1536:mHPwUa96PZfLN0CNzYRn5ZxtBMAphNQmiPYDEZfM96nHPwU:mHIuZ1NzMBXMGh7DEhHI
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...\|T.Q.................@..........D........P....@................

File Icon


Icon Hash:	6a6a6a6a6a6a6a6a

Static PE Info

General
Entrypoint:	0x401144
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5188547C [Tue May 7 01:10:20 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5565993a5a9f2bfb76f28ab304be6bc1

Entrypoint Preview

Instruction
push 00406B3Ch
call 00007FD99CD22075h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi-1B674E90h], bh
sbb eax, 8587498Dh
cmpsb
inc edi
jo 00007FD99CD22037h
nop
sub al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edx+00h], al
push es
push eax
add dword ptr [ecx], 55h
inc esi
dec edi
push edx
dec ebp
push ebp
inc ebp
dec esi
dec eax
inc ebp
inc esp
push ebx
add byte ptr [eax], ch
add al, 02h
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
pop es
xchg eax, ebx
inc byte ptr [eax-6Bh]
test al, CBh
xchg byte ptr [ebx-80h], al
xor dword ptr [esi+0Ah], edi
push FEA6E7D3h
wait
adc bh, dh
stc
retn 964Fh
xchg eax, ebx
jmp 00007FD9D08C012Ah
sbb dword ptr [edx], edi
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec edi
pop ecx
add byte ptr [eax], al
and al, 58h
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [esi+41h], cl
push esp
push esp
dec ecx
dec esp
dec esp
inc edi
push ebx
add byte ptr [48000601h], cl
dec edi
pop ecx
inc esp
inc ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14b54	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x5ba2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x7c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13dd4	0x14000	False	0.650927734375	data	7.08584386702	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0x115c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x5ba2	0x6000	False	0.545939127604	data	6.04233444538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1bcfa	0xea8	data
RT_ICON	0x1b452	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 4062978580, next used block 4061278239
RT_ICON	0x1aeea	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x18942	0x25a8	data
RT_ICON	0x1789a	0x10a8	data
RT_ICON	0x17432	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x173d8	0x5a	data
RT_VERSION	0x171e0	0x1f8	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, _allmul, _CItan, _CIexp

Version Infos

Description	Data
Translation	0x0404 0x04b0
ProductVersion	1.00
InternalName	UBESKADIGEDES
FileVersion	1.00
OriginalFilename	UBESKADIGEDES.exe
ProductName	SESAMBRDENE

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: JXblq0dqPN.exe PID: 5092 Parent PID: 5604

General

Start time:	17:49:49
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\JXblq0dqPN.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\JXblq0dqPN.exe'
Imagebase:	0x400000
File size:	114688 bytes
MD5 hash:	8718D75B7CAC53F13D01DDEA9B52CEE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: JXblq0dqPN.exe PID: 5092 Parent PID: 5604 JXblq0dqPN.exeCOMMON

Executed Functions

Function 02BA58C6, Relevance: 1.8, APIs: 1, Instructions: 280memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(BBD28F8A,0000013C), ref: 02BA5AF2

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f0780d1009f7aa2d31ebd5057ff2ac3467768b6def71a32673977a943574b5a4
Instruction ID: 8a422cd5814334f30baf9f99091b61dc7154922c15b830256b35fd0eb355df55
Opcode Fuzzy Hash: f0780d1009f7aa2d31ebd5057ff2ac3467768b6def71a32673977a943574b5a4
Instruction Fuzzy Hash: 48A147B16083499FDB24AF38C9617EEBBE2EF4A340F45455DDCC99B211D7344A45CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA5983, Relevance: 1.7, APIs: 1, Instructions: 201memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(BBD28F8A,0000013C), ref: 02BA5AF2

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c073f77b334e76b58c1470a233f6e99bcf72b55d833d89692a5007662d9892f4
Instruction ID: 40ca89f94daa1ff0b6dfaae866fdffa4aad59b51ca7506c3a8621edd04f6c3d7
Opcode Fuzzy Hash: c073f77b334e76b58c1470a233f6e99bcf72b55d833d89692a5007662d9892f4
Instruction Fuzzy Hash: 4451E7336093455FFB626EE0ECC03C5BBA0FF52314F1C157AE808AA295E7749B458B14

Uniqueness

Uniqueness Score: -1.00%

Function 02BA58B5, Relevance: 1.7, APIs: 1, Instructions: 159memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(BBD28F8A,0000013C), ref: 02BA5AF2

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6c5f1f8d10f98ff5f1a20a97faa676bc786488b964f6e9d3b853d48c49fac610
Instruction ID: c8f639d8003dfa3e77350e73b704d7de0c86adc0ae1948332ddbfe59184c5e20
Opcode Fuzzy Hash: 6c5f1f8d10f98ff5f1a20a97faa676bc786488b964f6e9d3b853d48c49fac610
Instruction Fuzzy Hash: E35101716083889FDB74AF28D9603EE7BE2EF49310F444599DC8A9B265D7308A45CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00401144, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401149

Strings

VB5!6&*, xrefs: 00401144

Memory Dump Source

Source File: 00000001.00000002.730575703.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.730552432.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.730700472.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.730732122.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 5069cdc45634e3489cebcfc69ba62eb0dca88c2a95e9ccd84eea668ab0f3af80
Instruction ID: 16227ebb38a356db4d9e85d4ab2aa19eae043b2816f1af8546ef6c1cde2fed9f
Opcode Fuzzy Hash: 5069cdc45634e3489cebcfc69ba62eb0dca88c2a95e9ccd84eea668ab0f3af80
Instruction Fuzzy Hash: 2411CAA154E7C05FC3134BB41C256527F78AE5365431A46EBD4C2DE4B3C21D498AC7A2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BA7776, Relevance: 8.1, Strings: 6, Instructions: 598COMMON

Download Yara Rule

Strings

[qwT, xrefs: 02BA4732
zV, xrefs: 02BA0B42
^M)$, xrefs: 02BA0A28
UCE^, xrefs: 02BA44DD
*[~, xrefs: 02BA4508
~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: zV$*[~$UCE^$[qwT$^M)$$~}
API String ID: 0-1522969816
Opcode ID: 290a669912dab322928e5dd578ba26db41cbbc15fe0fca9ddf91e1f7a6a40387
Instruction ID: be0e6f5dc67bf7b370e4a007640f2394e083c15ff9ea1d45bf67b4b9d6b321e7
Opcode Fuzzy Hash: 290a669912dab322928e5dd578ba26db41cbbc15fe0fca9ddf91e1f7a6a40387
Instruction Fuzzy Hash: 561215336083429FFB622EE0ECD47C5BBA1FF52358F1C597AE844A6149E7789B418B10

Uniqueness

Uniqueness Score: -1.00%

Function 02BA1C35, Relevance: 5.7, Strings: 4, Instructions: 746COMMON

Download Yara Rule

Strings

[qwT, xrefs: 02BA4732
UCE^, xrefs: 02BA44DD
*[~, xrefs: 02BA4508
~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: *[~$UCE^$[qwT$~}
API String ID: 2167126740-2082405245
Opcode ID: 824c7aaf87145b4bf288c090bcbeb036d5037ecf4861f8f36890d6a86cb6dfd7
Instruction ID: 50d9a606d0335badd3f71cb4ffa588acf85c737a3c46983365980b9abb222c33
Opcode Fuzzy Hash: 824c7aaf87145b4bf288c090bcbeb036d5037ecf4861f8f36890d6a86cb6dfd7
Instruction Fuzzy Hash: 5C62CAB26083899FDB749F34CD857EABBB2FF55310F56412ADC899B210D3719A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA42BF, Relevance: 5.7, Strings: 4, Instructions: 693COMMON

Download Yara Rule

Strings

[qwT, xrefs: 02BA4732
UCE^, xrefs: 02BA44DD
*[~, xrefs: 02BA4508
~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *[~$UCE^$[qwT$~}
API String ID: 0-2082405245
Opcode ID: 3e6e277698c5b1fbc29b29b57164d0d79633a897407368a758bd629d2f5210fc
Instruction ID: d97586d1d3a5adb00fb167a2823eed0c1f994a20f6ece4dd6837db0b413f74a8
Opcode Fuzzy Hash: 3e6e277698c5b1fbc29b29b57164d0d79633a897407368a758bd629d2f5210fc
Instruction Fuzzy Hash: F3520E72608349AFEB759FB4CC857DABBB2FF55310F55462ADC88AB210D3749A80CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7012, Relevance: 5.7, Strings: 4, Instructions: 656COMMON

Download Yara Rule

Strings

[qwT, xrefs: 02BA4732
UCE^, xrefs: 02BA44DD
*[~, xrefs: 02BA4508
~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *[~$UCE^$[qwT$~}
API String ID: 0-2082405245
Opcode ID: eaf73a64dc044ad6acbb724917cbef81273c0cca70e0f453e8a8eea6945fc475
Instruction ID: 4dca90a6dc1e87c1f6e16af2bcaf3092144c7c160295753c7042c463231a40c5
Opcode Fuzzy Hash: eaf73a64dc044ad6acbb724917cbef81273c0cca70e0f453e8a8eea6945fc475
Instruction Fuzzy Hash: 3E52BAB2608389AFDB749F34CD857DABBB2FF55310F56452ADC899B210D3705A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA46B5, Relevance: 4.2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

Strings

[qwT, xrefs: 02BA4732
V?A9, xrefs: 02BA46B6
~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: V?A9$[qwT$~}
API String ID: 0-2222510667
Opcode ID: 14052a5fcc79d9066ff83ee85d943b01e44d503e920099e54958d92f687b0bfe
Instruction ID: 62007632e786e72ba1df0b4448c016c51fcd3c2fc818ddd1b1a67acc500ccb13
Opcode Fuzzy Hash: 14052a5fcc79d9066ff83ee85d943b01e44d503e920099e54958d92f687b0bfe
Instruction Fuzzy Hash: 4012AA72608389EFDB748F74CC857EABBB2FF55310F55452AD8899B210C3759A81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02BA85F4, Relevance: 3.2, Strings: 2, Instructions: 731COMMON

Download Yara Rule

Strings

bO2m, xrefs: 02BA8DEA
_jb, xrefs: 02BA8B6B

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _jb$bO2m
API String ID: 0-517183647
Opcode ID: 19335503b572edeb1e91912c9f46194573628123d57f412f297f09991e211ebd
Instruction ID: 20a4e32b085138b78f503e49daef4347f459da3c722b51e7fc2b61e2a9a846fb
Opcode Fuzzy Hash: 19335503b572edeb1e91912c9f46194573628123d57f412f297f09991e211ebd
Instruction Fuzzy Hash: 5B522B716083858FDB31DF38C8A47DABBE2AF56350F4981AECC998F696D7308545CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02BA6475, Relevance: 3.1, Strings: 2, Instructions: 591COMMON

Download Yara Rule

Strings

zV, xrefs: 02BA0B42
^M)$, xrefs: 02BA0A28

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: zV$^M)$
API String ID: 2167126740-1559512919
Opcode ID: 6c616e37309aea9aff734dfc9ceadba10fa9078007046782a82f229449ba7fa5
Instruction ID: ee41fb82d35be4d3020c103428da2b1b5a0c4e635e43515c3d5a3f2c5b4c407b
Opcode Fuzzy Hash: 6c616e37309aea9aff734dfc9ceadba10fa9078007046782a82f229449ba7fa5
Instruction Fuzzy Hash: 2112073360C342AFF7626EE0ECD47C5BBA1FF42354F1C597AE844A6249E7789A418B10

Uniqueness

Uniqueness Score: -1.00%

Function 02BA951E, Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

g):O, xrefs: 02BA985F
g):O, xrefs: 02BA9864

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g):O$g):O
API String ID: 0-2898885234
Opcode ID: edab975e425486371a9489f9828793d1ea5ce290c77e66468eaeb843626c1e97
Instruction ID: 919e8b58a2b3aa282a12d60b2d8453f413354f0543c4ab8af8dba97856d5531f
Opcode Fuzzy Hash: edab975e425486371a9489f9828793d1ea5ce290c77e66468eaeb843626c1e97
Instruction Fuzzy Hash: F4A121336083459FFB769EE4EDD43C9BB61FF92360F09456AD808AB288D7749B418B10

Uniqueness

Uniqueness Score: -1.00%

Function 02BA950D, Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

g):O, xrefs: 02BA985F
g):O, xrefs: 02BA9864

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g):O$g):O
API String ID: 0-2898885234
Opcode ID: 1b9b7b58636109707e82d5c1d17750a7059303e3bcb70451cb9a49c9011d55b4
Instruction ID: b96e3e39a18165e29ce19650d8538c0b9442249283e998eb60195c9feb014228
Opcode Fuzzy Hash: 1b9b7b58636109707e82d5c1d17750a7059303e3bcb70451cb9a49c9011d55b4
Instruction Fuzzy Hash: EB710072A48748CFDB39DE28C9A87E937A2FF95350F16416ECC0A9F654D7309A41CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02BA3D6D, Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

o1,, xrefs: 02BA3E05
o1,, xrefs: 02BA3E00

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: o1,$o1,
API String ID: 0-737522226
Opcode ID: 9cb357a55b08b7e1cd5ce3467c494f3d05ab42890ae62433736aa30916872959
Instruction ID: 572e657e302fbc29cc2750ac295367560871aaea0d48c74d943f7c35935f26c5
Opcode Fuzzy Hash: 9cb357a55b08b7e1cd5ce3467c494f3d05ab42890ae62433736aa30916872959
Instruction Fuzzy Hash: FC3108312046808BEB31CE7D88D4BC67ED2AF86314F49C2DECC989B29BE3769542C751

Uniqueness

Uniqueness Score: -1.00%

Function 02BA2D2C, Relevance: 1.8, Strings: 1, Instructions: 538COMMON

Download Yara Rule

Strings

?{$, xrefs: 02BA3044

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?{$
API String ID: 0-3885635938
Opcode ID: 7c972deef6352350cab7dcdac4a3f7b410c549cb246bb7a4108efa83979464c6
Instruction ID: 4ac9de4899fbc7cc185841bfa8d1cd76591803641d5fd03ca3a08702450ec20c
Opcode Fuzzy Hash: 7c972deef6352350cab7dcdac4a3f7b410c549cb246bb7a4108efa83979464c6
Instruction Fuzzy Hash: 07229A71B4474A9FDB64CF28CC90BDAB7E2FF88310F45826ADC599B341DB30A9558B90

Uniqueness

Uniqueness Score: -1.00%

Function 02BA473E, Relevance: 1.7, Strings: 1, Instructions: 496COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: 0fe98c3216342403fcc2d49c5c31d7e0a75d33a4e64e40f1529cf997ad3811e7
Instruction ID: c335c9525d6c903afb438bc8b37ee342c7eaa3dc16e1df42581185cd8f295f17
Opcode Fuzzy Hash: 0fe98c3216342403fcc2d49c5c31d7e0a75d33a4e64e40f1529cf997ad3811e7
Instruction Fuzzy Hash: D522FD32608389EFEBB59FB4DC857DABBB1FF55310F45462AD848AB250C3748A80CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02BA483C, Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: 4ed716ed9a8ab7949f1408e083bc7eae4cfe4a09edefb94c6aaa7ef31b0069b8
Instruction ID: ccfc026f2ecdbb6c0873780bceb98a35c12bb0f28013737fe240edd06c3f1980
Opcode Fuzzy Hash: 4ed716ed9a8ab7949f1408e083bc7eae4cfe4a09edefb94c6aaa7ef31b0069b8
Instruction Fuzzy Hash: 2F02A772608389EFDB748F74CC857EA7BA2FF59300F55452ADC899B210C3719A85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02BA4A0A, Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: d13e6b610cfdedd6c00b5515cd94d3b1ea9b16cb9b14e87193fd6224ee93b8b4
Instruction ID: 98774fb8b9b20c3eca73d018416284b5553265314c11c69ff1c7cbd93225c261
Opcode Fuzzy Hash: d13e6b610cfdedd6c00b5515cd94d3b1ea9b16cb9b14e87193fd6224ee93b8b4
Instruction Fuzzy Hash: 48D1A971608388EFCBB58F34CC957EA7BA2FF59300F55412ADD899B220C7759A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA4C62, Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: 4e1ff39accb0c704c6823f11dd2d8370900d3b04d4511349d5b55cb19d40a0ff
Instruction ID: 771ba93884fc17336569299bc4853b09aad9b4b91f17dc777e2517a38f523068
Opcode Fuzzy Hash: 4e1ff39accb0c704c6823f11dd2d8370900d3b04d4511349d5b55cb19d40a0ff
Instruction Fuzzy Hash: 2FC1E132608389EFEBB69EB0DCC57CABB61FF55314F18452ADD08AA254D7B45B81CB10

Uniqueness

Uniqueness Score: -1.00%

Function 02BA5D82, Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

3/, xrefs: 02BA6060

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 3/
API String ID: 0-585577955
Opcode ID: 82e7b80fa7b8e4375fd111d8fd83d4b481192e4e3128be2da7f26eb8b0e918f3
Instruction ID: 80731ed5dd086d00071262af8326a524bddc7a246603ce923b598dd8f8ac5745
Opcode Fuzzy Hash: 82e7b80fa7b8e4375fd111d8fd83d4b481192e4e3128be2da7f26eb8b0e918f3
Instruction Fuzzy Hash: AC91D132608346AFFB755EE4DDC07DABBB0FF01350F084529EC48AA285E7348B419B11

Uniqueness

Uniqueness Score: -1.00%

Function 02BA2F54, Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

?{$, xrefs: 02BA3044

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?{$
API String ID: 0-3885635938
Opcode ID: 3681c65022a4b0a52a08d4ecb44cd7e516885667a917a86a6219952a5cc0e98f
Instruction ID: a7a3124aa45d68b5747c950d8ad675144c47877a6f2fda2e6461c360ed760c99
Opcode Fuzzy Hash: 3681c65022a4b0a52a08d4ecb44cd7e516885667a917a86a6219952a5cc0e98f
Instruction Fuzzy Hash: 84A19E716447869FDB64CF28CCA0BDAB7E2FF49310F05826ADC599B351DB31AA11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BA2F7B, Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

?{$, xrefs: 02BA3044

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ?{$
API String ID: 0-3885635938
Opcode ID: dbccffb4e08d55e0ab76aa5a2d1718c32027f2afcf15f5fe32aadf7a40fdc6ef
Instruction ID: f49e7b28519a21cec6caefc9f1cd14dc05f18bb1498b5a349b0f6004dd69ab24
Opcode Fuzzy Hash: dbccffb4e08d55e0ab76aa5a2d1718c32027f2afcf15f5fe32aadf7a40fdc6ef
Instruction Fuzzy Hash: 99A19F717447869FDB64CF28CCA0BDAB7E2FF49310F09426ADC599B351DB30AA118B90

Uniqueness

Uniqueness Score: -1.00%

Function 02BA8764, Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

_jb, xrefs: 02BA8B6B

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _jb
API String ID: 0-2055512382
Opcode ID: e0dc33869d39372f9cf2c3b970b021c9931bc07f746f61932ed1db14de1838bd
Instruction ID: 09a367c2cf233baeed86f6cc05b75293418fa3635738f1bb538c8f50cf210c3a
Opcode Fuzzy Hash: e0dc33869d39372f9cf2c3b970b021c9931bc07f746f61932ed1db14de1838bd
Instruction Fuzzy Hash: 6D91F5715083C48EDF328F38C8A87D97FD2AF56364F5982AEC8A94F696D3744242C716

Uniqueness

Uniqueness Score: -1.00%

Function 02BA4BC5, Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: 83fadce32791bd7d019225fd12ebfad84343e0a3bc63206494e78d0526956a02
Instruction ID: adc5dd3d87ecee635902aec95a354426ff15a43c3617ff674078baa5227e3646
Opcode Fuzzy Hash: 83fadce32791bd7d019225fd12ebfad84343e0a3bc63206494e78d0526956a02
Instruction Fuzzy Hash: 10A1A971608288EFCF798F34CC957DA7BA2FF59300F55812ADD499B220C7715A81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02BA4BEB, Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

~}, xrefs: 02BA4D79

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ~}
API String ID: 0-3829341042
Opcode ID: 310878b295a1ebd184083160397091eb3cb565d31ae233038da8f28bc623b6ce
Instruction ID: 9824a7babe67d1dfc9c57c4e85b9db6caa7d57482337c4be32cd213b45869c77
Opcode Fuzzy Hash: 310878b295a1ebd184083160397091eb3cb565d31ae233038da8f28bc623b6ce
Instruction Fuzzy Hash: 2EA19971608289EFCF798F38CC857DA7BA2FF59300F95416ADC499B220C7715A81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02BA885F, Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

_jb, xrefs: 02BA8B6B

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: _jb
API String ID: 0-2055512382
Opcode ID: b1fb3e0df041f5c3538860f6b5e62ed01e2bfd3da38e71d914d190f599a62096
Instruction ID: a87dace71838ca940058c9e63030e52cf3ec09d8f88f4f4e857f770ffcaeac76
Opcode Fuzzy Hash: b1fb3e0df041f5c3538860f6b5e62ed01e2bfd3da38e71d914d190f599a62096
Instruction Fuzzy Hash: FC91F5715083C48EDF368F388CA87D97BE2AF56350F5982AEC8994F69AD3344642C716

Uniqueness

Uniqueness Score: -1.00%

Function 02BA5CD0, Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

3/, xrefs: 02BA6060

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: 3/
API String ID: 2167126740-585577955
Opcode ID: 42409fe40ba585c01ddaa7774acb4246f6df31a073276f00d264dde8d7172f49
Instruction ID: 609ba03f3a2378ae8f5110bc882eb7173f8f9e9ee4a10ad83b521b3d80577f60
Opcode Fuzzy Hash: 42409fe40ba585c01ddaa7774acb4246f6df31a073276f00d264dde8d7172f49
Instruction Fuzzy Hash: 9A91CE7164838ADFDF789F68CD54BEE3BA6FF08340F4584299D899B254E3308A41DB12

Uniqueness

Uniqueness Score: -1.00%

Function 02BA26BA, Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

GRvB, xrefs: 02BA26C0

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: GRvB
API String ID: 2167126740-2835921802
Opcode ID: 7aa7fc4b2bfe63ff11113d1d954a0f02f70271ca21a010330caf2d20104c134f
Instruction ID: 297554a1e7fa775e8fe368211d4195b7e6bedba826214c39d1f91a4df3f456c4
Opcode Fuzzy Hash: 7aa7fc4b2bfe63ff11113d1d954a0f02f70271ca21a010330caf2d20104c134f
Instruction Fuzzy Hash: F47118B16083499FDB24AF28CDA57EF77E6EF85340F86441DDC89A7204D7359A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA6183, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

'+XG, xrefs: 02BA63C4

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: '+XG
API String ID: 0-2992890613
Opcode ID: 6b74f0181bb9eb1f9904f870969d04eb73ddc7efc29f158619c10e29167b1356
Instruction ID: c323fc178c1cc77f407d93d482ebccc057e5774e13e658757e023da7e7af856a
Opcode Fuzzy Hash: 6b74f0181bb9eb1f9904f870969d04eb73ddc7efc29f158619c10e29167b1356
Instruction Fuzzy Hash: 52411AB460920ACFDB54EF65C670ADE7BA3AF88350F5181999C154B345EF30D842DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BA1784, Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

>, xrefs: 02BA17FD

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: >
API String ID: 0-175997068
Opcode ID: dc7616cae8f23a7002ae7d9eb1942593d86538777d4a332428036b5a4ed3ac6f
Instruction ID: cc4db2533258b0688ea4376fce3028f84a61dab84f0be3039cada1cab6737121
Opcode Fuzzy Hash: dc7616cae8f23a7002ae7d9eb1942593d86538777d4a332428036b5a4ed3ac6f
Instruction Fuzzy Hash: B24148729092898FDB34DF25CD50BDB7BE7AFC5300F15806ADC886B295D3359A42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0223, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 74c0e8ab12102c630bea9d2933995e2265cbc0eb02c40bd22dae6638f7430c69
Instruction ID: 061ebc6d9d5ca6f33a3be134bca167c7b465c1f5038d701705866c1883bf2b3c
Opcode Fuzzy Hash: 74c0e8ab12102c630bea9d2933995e2265cbc0eb02c40bd22dae6638f7430c69
Instruction Fuzzy Hash: 56A1F43360D3426FF7932DF0ADC57C5FBA0FB52264F1C5A7AE904B4189E6A88B458720

Uniqueness

Uniqueness Score: -1.00%

Function 02BA28E2, Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d235aec80f43f44971a5e62d7085aec0063baca36f3c6d5badc9afa5536021
Instruction ID: 13178e474c2ae8a95f21bc947ceba2676d3638ba83a9a2d45717d389c55fa862
Opcode Fuzzy Hash: 61d235aec80f43f44971a5e62d7085aec0063baca36f3c6d5badc9afa5536021
Instruction Fuzzy Hash: 30A1D072A083899FDB749E39CC65BEF7BA2EF89350F55452E9C89DB204D7318A41CB01

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7E98, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fd706077f9577470ece5c440190ebca7f65c29bf32348ac6e4923fb4fdfc2f
Instruction ID: e9b4e7c643f0388b70a271e0ca7daa602d2c60539284bc554e2aa5f1a612dfde
Opcode Fuzzy Hash: f1fd706077f9577470ece5c440190ebca7f65c29bf32348ac6e4923fb4fdfc2f
Instruction Fuzzy Hash: CB8114729083489FCB349F69DCA57EA7BA1EF44350F55412ECC8A9B644E7309A81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7FAE, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e362c1dcf1754cabac4b234ecbf6a1b106f51a756771e858dbbaa7728116a76
Instruction ID: 22b4e614e82b2aa2735e697457884a197228b4ddffb9c7c64958a43c377a58db
Opcode Fuzzy Hash: 5e362c1dcf1754cabac4b234ecbf6a1b106f51a756771e858dbbaa7728116a76
Instruction Fuzzy Hash: 05710533608341AFFB721EE0EDD57C6BB70FB51354F08567AD848AA248E3749B818B60

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0557, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f092f44202f841a6949414c800958be33ea0325efc1c9536bbf6d84e54f3f3
Instruction ID: 10b01f5d253a3e76890ccd45472a660730a667f2b49861da424b6fec0896bc67
Opcode Fuzzy Hash: 62f092f44202f841a6949414c800958be33ea0325efc1c9536bbf6d84e54f3f3
Instruction Fuzzy Hash: 73610475508349DFDB64AF78C9A97EEBBA2EF45340F45452DDCC9AB200D7348A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA3147, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e93405911f01b15dbcc469198ea0f1c9a6017ee707b6cffa0af8fff94f307a
Instruction ID: 58144406d73c8ae983adb918cb4a83b306d34ecf5f024680d6131d47abc476b4
Opcode Fuzzy Hash: 82e93405911f01b15dbcc469198ea0f1c9a6017ee707b6cffa0af8fff94f307a
Instruction Fuzzy Hash: C37191717447869FDB64CF28C8A0BDAB7E2FF49310F04426EDC699B251DB30AA11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0647, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd900d19b2621b828db3037454b0a5a74a49981f168427350b234cd39eb270b
Instruction ID: c5dd456763648e9161783081c4d4b655cf623949e7873b6c864d334f05859dd9
Opcode Fuzzy Hash: 8fd900d19b2621b828db3037454b0a5a74a49981f168427350b234cd39eb270b
Instruction Fuzzy Hash: 865147B1608349CFCB24AF38C9A97DEBBA2EF45340F45485DDCC99B201D7358A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA80FC, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0741c1880a52997337577bf68d6cf628e0c5d371f3d0e8ae9beb89db27f7c5
Instruction ID: c2f83f56587f3f4f9a217c4e968ed35cd317c102599eb39147576b706119cf9d
Opcode Fuzzy Hash: ac0741c1880a52997337577bf68d6cf628e0c5d371f3d0e8ae9beb89db27f7c5
Instruction Fuzzy Hash: 18514572949344EFCB344F28CC617DABBB1FF15340F46412ADC8A8B614E3315A82CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7879, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0644d98d5f2fadf6592341b8d33b11362c47294c799b98670658ca889013ab6
Instruction ID: 00660673095013fa149540b5fc9d2e5026ca469d960dc63d788e7ec087de3fd6
Opcode Fuzzy Hash: a0644d98d5f2fadf6592341b8d33b11362c47294c799b98670658ca889013ab6
Instruction Fuzzy Hash: 9E417133608342AFF7A25EE0EDC47C1FB60FB52328B1C5A76E504A5189E7A89B459724

Uniqueness

Uniqueness Score: -1.00%

Function 02BA3FA3, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32f669dbe6110c966848f23ea13e2cccbf3bce6c45179b552e3230a51a587e7
Instruction ID: 47d7bf41ce571ef15cf8e74d8320870679abcdf2b449917120428d111333c870
Opcode Fuzzy Hash: a32f669dbe6110c966848f23ea13e2cccbf3bce6c45179b552e3230a51a587e7
Instruction Fuzzy Hash: 2C51AF726083449BDB34CE65D9B57EA3BF2FB58740F94062EC94E9B600C375AA81CB15

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0641, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a02eee9fabcb9041bb96da052aba30a0825fd2b66b74810101598e6f38145ea
Instruction ID: f5d68a986abd82eafa4c607d24530abfcf30007b488fb3a362c508ec158a4932
Opcode Fuzzy Hash: 7a02eee9fabcb9041bb96da052aba30a0825fd2b66b74810101598e6f38145ea
Instruction Fuzzy Hash: 7F4118B1608349DFDB24AF78C9A57EEB7A2EF45340F85491DDCC5A7201D7348982CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7BEC, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcafc850f192a3b66390e4054bd13dc2159ccd911ea5271d8ae3cce97fefa743
Instruction ID: bd74b9ca432cbe849dece1da31a479e5e23c442ddd46b4eecab86e2674552dda
Opcode Fuzzy Hash: bcafc850f192a3b66390e4054bd13dc2159ccd911ea5271d8ae3cce97fefa743
Instruction Fuzzy Hash: B531C2716082469BDF30DE399C60BEF7AA6AF89350F50816AEC08CF205DB31CA41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 02BA24E2, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4f14e6992f19409983266fed952a94ad742fe22e030706eede9dcefd59d44880
Instruction ID: 95147edab014c0bef96198d59f403dbf40844496229e0cb6489459bf9b6a1c11
Opcode Fuzzy Hash: 4f14e6992f19409983266fed952a94ad742fe22e030706eede9dcefd59d44880
Instruction Fuzzy Hash: 7B418272B082498FDB749F68CCA97DA37A3AF98340F85011ED88D8B354D7719A41CB15

Uniqueness

Uniqueness Score: -1.00%

Function 02BA20EC, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f0d15db5f6f2594086c2daa9a1c32cc9f14a62370d3b444e8f72e4993708b9e2
Instruction ID: d84784e3ebe63dd1a0a16889e669b88bc9263497000a1552c6ce4990b1937b0c
Opcode Fuzzy Hash: f0d15db5f6f2594086c2daa9a1c32cc9f14a62370d3b444e8f72e4993708b9e2
Instruction Fuzzy Hash: 983192B6A04699CBDB709F29CD84BCA77AAAF99340F5641169C0CEB300C3319E018B95

Uniqueness

Uniqueness Score: -1.00%

Function 02BA218A, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b03d0e2418e6c718ea95124234410f13c3d25576af891afc451300790d77039
Instruction ID: b8c05936d8cde1561e8345f6c5b8777c2eea482b1354cf70c6a7f65b77208a87
Opcode Fuzzy Hash: 1b03d0e2418e6c718ea95124234410f13c3d25576af891afc451300790d77039
Instruction Fuzzy Hash: 9A31D3B6A087A9CFCB709F69CD84BDB77A6AF59304F454156EC08EB240C3359E40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0708, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f671071a72ca4d942f70460dca8b727a77ef4cc0d5fc678552834a94f9a5aa2e
Instruction ID: e46178ba9ada4d48f4da7f777a2d548f82bb13baa6e3da0cbab93a5e96445a74
Opcode Fuzzy Hash: f671071a72ca4d942f70460dca8b727a77ef4cc0d5fc678552834a94f9a5aa2e
Instruction Fuzzy Hash: 6221477258834A8BDB64AF38C9A5BDFB7A6AF45684F46081DDCC5D7201D3348D86CF82

Uniqueness

Uniqueness Score: -1.00%

Function 02BA13C7, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8730a1aa444d7f9342c244759ca0bf428eb99a5fa03e0a339e9da10697c9a1be
Instruction ID: 9b6a3236c9ed4bb0bda76c33ca32ab8bd4c0d3bad4bfcb3f8ace05412cd0f21c
Opcode Fuzzy Hash: 8730a1aa444d7f9342c244759ca0bf428eb99a5fa03e0a339e9da10697c9a1be
Instruction Fuzzy Hash: E331EE7050D7C66FD7728B3C88243DABFA5AF03310F8882DAD8D88B182C7751559CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02BA4214, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164e913386ca31f5ec9a974abe84790ff10acc93f695e3da687d2f20b00ce682
Instruction ID: b27c6f4db3d90852087f6e7859311b4248fa83e8824aac04b92f7a70966ed731
Opcode Fuzzy Hash: 164e913386ca31f5ec9a974abe84790ff10acc93f695e3da687d2f20b00ce682
Instruction Fuzzy Hash: 47118B365482449FDB682E358E856EBBBF6FF95200F57491ED8C4D3711D3709A868B03

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7874, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7d1d386b8e9e5b6100579f2ab258b820b5aa1435d50a10f982e318089fb0cc
Instruction ID: b58a8e6986b813cb823ecc61610f14f00e939bab3bbc8a7fa01f6cf373cfcd97
Opcode Fuzzy Hash: bb7d1d386b8e9e5b6100579f2ab258b820b5aa1435d50a10f982e318089fb0cc
Instruction Fuzzy Hash: B9012975708B849FCB70CE28C9D8BD9B3B1BF58311F4144AAD90A8B712CB309A40DB14

Uniqueness

Uniqueness Score: -1.00%

Function 02BA54A8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 02BA7377, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.734564394.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98569c65fbcda4dd1c0fb20c3d2fefd5c4362a961a1c00039a074420407667e3
Instruction ID: 758c7bf6f36641e7c056e9f40e92a203235c1e1b10139e0ca3b31f201ab5a253
Opcode Fuzzy Hash: 98569c65fbcda4dd1c0fb20c3d2fefd5c4362a961a1c00039a074420407667e3
Instruction Fuzzy Hash: 98B002757A2644CFDF55CF19C190E8073B5F755750F8554D1E45187B11C264E904CA14

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report JXblq0dqPN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: JXblq0dqPN.exe PID: 5092 Parent PID: 5604

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: JXblq0dqPN.exe PID: 5092 Parent PID: 5604 JXblq0dqPN.exeCOMMON

Executed Functions

Function 02BA58C6, Relevance: 1.8, APIs: 1, Instructions: 280memorynativeCOMMON

Function 02BA5983, Relevance: 1.7, APIs: 1, Instructions: 201memorynativeCOMMON